Function at 0x11f5a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x15390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, dword [ebp + 8]
push edi
push 0x21
pop ecx
mov esi, 0x14d7a
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
push 0x206
lea eax, [ebp - 0x292]
push esi
push eax
mov dword [ebp - 0x2b8], ebx
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2b4], esi
mov word [ebp - 0x294], si
call sub.ntoskrnl.exe_memset
add esp, 0xc
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
test al, al
jne 0x12206
push ebx
lea eax, [ebp - 0x8c]
push 0x14d68
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x294]
push 0x208
push eax
mov word [ebp - 0x2c8], 0x84
mov word [ebp - 0x2c6], 0x86
mov word [ebp - 0x2c0], 0x36
mov word [ebp - 0x2be], 0x38
mov dword [ebp - 0x2bc], 0x14d30
call fcn.000109fc
mov eax, ebx
add esp, 0x10
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1201e
sub eax, ecx
mov ebx, eax
lea eax, [ebp - 0x2c8]
mov dword [ebp - 0x2d8], eax
lea eax, [ebp - 0x2e0]
push eax
push 0x20019
lea eax, [ebp - 0x2ac]
push eax
mov dword [ebp - 0x2e0], 0x18
mov dword [ebp - 0x2dc], esi
mov dword [ebp - 0x2d4], 0x40
mov dword [ebp - 0x2d0], esi
mov dword [ebp - 0x2cc], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x12206
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp - 0x2b0]
push eax
push 0x10
lea eax, [ebp - 0x2a4]
push eax
push 2
lea eax, [ebp - 0x2c0]
push eax
push dword [ebp - 0x2ac]
call edi
cmp eax, esi
jge 0x120e3
cmp eax, 0x80000005
je 0x120e3
cmp eax, 0xc0000023
je 0x120e3
cmp eax, 0xc0000034
jne 0x12206
lea eax, [ebx + ebx + 0xe]
push eax
push 7
lea eax, [ebp - 0x294]
push eax
push 0x14d30
push dword [ebp - 0x2ac]
call fcn.00011334
jmp 0x121fa
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push 0x76734d4d
push dword [ebp - 0x2b0]
mov byte [ebp - 0x2a5], 0
push 1
call ebx
mov esi, eax
test esi, esi
je 0x121fa
lea eax, [ebp - 0x2b0]
push eax
push dword [ebp - 0x2b0]
lea eax, [ebp - 0x2c0]
push esi
push 2
push eax
push dword [ebp - 0x2ac]
call edi
test eax, eax
jl 0x121be
push dword [ebp - 0x2b8]
lea eax, [ebp - 0x294]
push 0x14d20
push 0x208
push eax
call fcn.000109fc
mov eax, dword [ebp - 0x2b8]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x12158
sub eax, edi
lea edi, [eax + eax + 0xc]
mov eax, dword [esi + 8]
add eax, edi
push 0x76734d4d
push eax
push 1
mov dword [ebp - 0x2b0], eax
call ebx
test eax, eax
mov dword [ebp - 0x2b4], eax
je 0x121be
push dword [ebp - 0x2b0]
mov ebx, eax
push 0
push ebx
call sub.ntoskrnl.exe_memset
lea eax, [edi - 2]
push eax
lea eax, [ebp - 0x294]
push eax
push ebx
call sub.ntoskrnl.exe_memcpy
push dword [esi + 8]
lea eax, [esi + 0xc]
push eax
add edi, ebx
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0x24
mov byte [ebp - 0x2a5], 1
push 0
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
call esi
cmp byte [ebp - 0x2a5], 0
je 0x121fa
push dword [ebp - 0x2b0]
push 7
push dword [ebp - 0x2b4]
push 0x14d30
push dword [ebp - 0x2ac]
call fcn.00011334
push 0
push dword [ebp - 0x2b4]
call esi
push dword [ebp - 0x2ac]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00012c87
leave
ret 4