Function at 0x20392
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc0
xor eax, eax
mov word [ebp - 0x2c], ax
push ebx
push esi
push edi
lea edi, [ebp - 0x2a]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x3c], ax
lea edi, [ebp - 0x3a]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov word [ebp - 0x50], ax
lea edi, [ebp - 0x4e]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x10], ax
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x22ac6
lea eax, [ebp - 0x2c]
push eax
call esi
push 0x22b5e
lea eax, [ebp - 0x3c]
push eax
call esi
push 0x2578c
lea eax, [ebp - 0x50]
push eax
call esi
mov edi, 0x400
mov ebx, 0x4d746147
mov eax, edi
push ebx
push edi
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], ax
call fcn.0001457a
push eax
call fcn.000123d2
xor esi, esi
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x207ad
mov eax, edi
push ebx
push edi
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], ax
call fcn.0001457a
push eax
call fcn.000123d2
mov dword [ebp - 0x14], eax
cmp eax, esi
jne 0x20458
push ebx
push dword [ebp - 0xc]
jmp 0x207a8
mov edi, dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
call edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call edi
push 0x38
lea eax, [ebp - 0xc0]
push esi
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 4
lea eax, [ebp - 0x58]
mov dword [ebp - 0xb4], eax
pop eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0xac], eax
xor eax, eax
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x70]
push eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0xbc], 0x20
mov dword [ebp - 0xb8], 0x22ab4
mov dword [ebp - 0x70], 0x18
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x64], 0x240
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x2078f
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryKey]
lea eax, [ebp - 4]
push eax
push esi
push esi
push 2
push dword [ebp - 8]
mov dword [ebp - 4], esi
call edi
cmp eax, esi
jge 0x20552
cmp eax, 0x80000005
je 0x20552
cmp eax, 0xc0000023
je 0x20552
push ebx
push dword [ebp - 0xc]
call fcn.000124d0
push ebx
push dword [ebp - 0x14]
mov dword [ebp - 0xc], esi
call fcn.000124d0
push dword [ebp - 8]
mov dword [ebp - 0x14], esi
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x207ad
cmp dword [ebp - 4], esi
je 0x2052c
cmp dword [ebp - 4], 0x400
ja 0x2052c
push 0x504649
push dword [ebp - 4]
call fcn.0001457a
push eax
call fcn.000123d2
mov dword [ebp - 0x24], eax
cmp eax, esi
je 0x2052c
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push eax
push 2
push dword [ebp - 8]
call edi
test eax, eax
jl 0x207b4
cmp dword [ebp - 4], esi
je 0x207b4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], esi
cmp dword [eax + 0x14], esi
jbe 0x20775
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp - 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, esi
jge 0x205d2
cmp eax, 0x80000005
je 0x205d2
cmp eax, 0xc0000023
jne 0x20775
cmp dword [ebp - 4], esi
je 0x20775
cmp dword [ebp - 4], 0x400
ja 0x20775
push 0x504249
push dword [ebp - 4]
call fcn.0001457a
push eax
call fcn.000123d2
mov edi, eax
mov dword [ebp - 0x54], edi
cmp edi, esi
je 0x20775
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push esi
push dword [ebp - 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
jl 0x2076a
cmp dword [ebp - 4], esi
je 0x2076a
mov ax, word [edi + 0xc]
mov word [ebp - 0x44], ax
mov cx, word [edi + 0xc]
add edi, 0x10
mov word [ebp - 0x42], cx
mov dword [ebp - 0x40], edi
cmp ax, 0x14
jbe 0x2072f
mov edi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x10]
push eax
call edi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x18]
push eax
call edi
push esi
push esi
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0x14]
push esi
call dword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp word [ebp - 0x18], si
je 0x2072f
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x10]
push eax
call edi
xor eax, eax
lea edi, [ebp - 0x84]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x88]
push eax
push 0x20006
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x88], 0x18
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x7c], 0x240
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x2072f
xor eax, eax
mov word [ebp - 0x34], ax
lea edi, [ebp - 0x32]
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x25776
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, dword [ebp + 8]
cmp word [eax], si
jbe 0x20721
cmp dword [ebp - 0x20], esi
je 0x2072f
cmp dword [ebp - 0x30], esi
je 0x20721
movzx ecx, word [eax + 2]
push ecx
push dword [eax + 4]
lea eax, [ebp - 0x34]
push 1
push esi
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
cmp dword [ebp - 0x20], esi
je 0x2072f
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov edi, dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
call edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
call edi
push 0x504249
push dword [ebp - 0x54]
call fcn.000124d0
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x14]
jb 0x205a9
jmp 0x20775
push 0x504249
push edi
call fcn.000124d0
push 0x504649
push dword [ebp - 0x24]
call fcn.000124d0
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
or dword [ebp - 8], 0xffffffff
cmp word [ebp - 0x10], si
jbe 0x207ad
push ebx
push dword [ebp - 0xc]
call fcn.000124d0
cmp word [ebp - 0x10], si
jbe 0x207ad
push ebx
push dword [ebp - 0x14]
call fcn.000124d0
pop edi
pop esi
pop ebx
leave
ret 4
push 0x504649
push dword [ebp - 0x24]
call fcn.000124d0
jmp 0x2052c