Function at 0x408d4a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 2
pop eax
xor esi, esi
mov word [ebp - 0x20], ax
push 4
pop eax
push esi
push esi
push esi
push dword [ebp + 8]
mov word [ebp - 0x1e], ax
mov ebx, esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x18], esi
mov edi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], 0x40a080
call fcn.00408c94
test eax, eax
js 0x408f01
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push 2
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryKey]
cmp eax, 0xc0000023
jne 0x408f01
cmp dword [ebp - 8], ebx
je 0x408f01
push 0x414e4d5a
push dword [ebp - 8]
push esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x408f01
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
push eax
push 2
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryKey]
test eax, eax
js 0x408f01
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x14]
jmp 0x408ee7
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push ecx
push esi
push esi
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, 0x8000001a
je 0x408ee4
cmp eax, 0xc0000023
jne 0x408f01
cmp dword [ebp - 0xc], esi
je 0x408f01
push 0x414e4d5a
push dword [ebp - 0xc]
push esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
je 0x408f01
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push ebx
push esi
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
js 0x408f01
movzx eax, word [ebx + 0xc]
push esi
push esi
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.004046ae
mov dword [ebp - 0x10], eax
test eax, eax
je 0x408f01
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 8]
shr eax, 1
push esi
inc eax
push eax
movzx eax, word [ecx]
push eax
push dword [ecx + 4]
call fcn.004046ae
mov edi, eax
test edi, edi
je 0x408f01
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
js 0x408f01
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
test eax, eax
js 0x408f01
push edi
call fcn.00408d4a
test eax, eax
je 0x408f01
push 0x414e4d5a
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push dword [ebp - 0x10]
mov ebx, esi
call fcn.00404832
push edi
mov dword [ebp - 0x10], esi
call fcn.00404832
mov edi, esi
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
jns 0x408dfb
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
test eax, eax
js 0x408f01
xor esi, esi
inc esi
cmp dword [ebp - 4], 0
je 0x408f10
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
je 0x408f20
push 0x414e4d5a
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x408f33
push 0x414e4d5a
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x408f40
push eax
call fcn.00404832
test edi, edi
je 0x408f4a
push edi
call fcn.00404832
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4