Function at 0x126b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x294d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x126d8
xor al, al
jmp 0x129c1
cmp word [ebx], 0x4c
mov dword [0x1869d6c], ebx
jbe 0x126d1
push esi
mov esi, dword [ebx + 4]
push edi
add esi, 0x46
mov edi, 0x29048
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movzx eax, word [ebx]
mov edi, dword [ebx + 4]
shr eax, 1
push eax
push edi
call fcn.00012002
cmp eax, 0x28
jle 0x129bd
lea ecx, [ebp - 0x414]
push ecx
add eax, eax
push eax
xor esi, esi
push edi
mov dword [ebp - 0x414], esi
call fcn.00012074
cmp eax, esi
je 0x129bd
mov ecx, dword [ebp - 0x414]
lea edx, [ecx - 1]
cmp edx, 0x63
ja 0x129bd
mov dword [0x1869f78], ecx
add ecx, ecx
push ecx
push eax
push 0x1869d70
call sub.ntoskrnl.exe_memcpy
xor eax, eax
lea edi, [ebp - 0x430]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
push 0xf003f
lea eax, [ebp - 0x408]
push eax
mov dword [ebp - 0x434], 0x18
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x428], 0x240
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x420], esi
mov dword [ebp - 0x408], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x129bd
push 0x12
pop eax
push 0x14
mov word [ebp - 0x41c], ax
pop eax
push 0x3ff
mov word [ebp - 0x41a], ax
lea eax, [ebp - 0x403]
push esi
push eax
mov dword [ebp - 0x418], 0x22900
mov byte [ebp - 0x404], 0
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
push esi
push esi
push 2
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x40c], esi
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
call esi
cmp eax, 0xc0000034
je 0x129b1
cmp dword [ebp - 0x40c], 0
je 0x129b1
cmp dword [ebp - 0x40c], 0x400
jae 0x129b1
and dword [ebp - 0x410], 0
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x40c]
lea eax, [ebp - 0x404]
push eax
push 2
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x408]
call esi
test eax, eax
jl 0x129b1
mov eax, dword [ebp - 0x410]
add eax, 0xfffffff4
cmp eax, 0x3d3
ja 0x129b1
mov eax, dword [ebp - 0x3fc]
cmp eax, 0x3e0
ja 0x129b1
cmp eax, 0x206
ja 0x129b1
push eax
mov ecx, eax
lea eax, [ebp - 0x3f8]
push eax
shr ecx, 1
push 0x1869f80
mov dword [0x1869f7c], ecx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push dword [ebp - 0x408]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [0x1869f7c]
xor eax, eax
test ecx, ecx
jbe 0x128e8
cmp word [eax*2 + 0x1869f80], 0x3a
je 0x128e8
inc eax
cmp eax, ecx
jb 0x128d8
cmp eax, ecx
je 0x129bd
dec eax
mov edx, ecx
xor esi, esi
sub edx, eax
je 0x12912
lea eax, [eax*2 + 0x1869f80]
mov di, word [eax]
mov word [esi*2 + 0x1869f80], di
inc esi
inc eax
inc eax
cmp esi, edx
jb 0x12900
cmp edx, ecx
jae 0x12934
xor eax, eax
movzx esi, ax
sub ecx, edx
mov eax, esi
shl esi, 0x10
or eax, esi
shr ecx, 1
lea edi, [edx*2 + 0x1869f80]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, edx
mov dword [0x1869f7c], eax
test eax, eax
jbe 0x1295d
lea ecx, [eax*2 + 0x1869f7e]
cmp word [ecx], 0x5c
je 0x1295d
xor edx, edx
dec eax
mov word [ecx], dx
dec ecx
dec ecx
mov dword [0x1869f7c], eax
test eax, eax
ja 0x12946
mov ecx, 0x186a188
mov dword [0x186a398], ecx
movzx eax, word [ebx]
shr eax, 1
dec eax
je 0x12983
mov edx, dword [ebx + 4]
lea edx, [edx + eax*2]
dec eax
cmp word [edx], 0x5c
je 0x12983
dec edx
dec edx
test eax, eax
ja 0x12976
lea eax, [eax + eax + 2]
mov word [0x186a394], ax
mov edx, dword [0x186a394]
movzx eax, ax
add edx, 2
push eax
mov word [0x186a396], dx
push dword [ebx + 4]
push ecx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov al, 1
jmp 0x129bf
push dword [ebp - 0x408]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.000223b6
leave
ret 4