Function at 0x11bb0
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xcc
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
push 0x68
push 1
mov dword [esp + 0x40], 0xc0000001
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x30], esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, esi
je 0x11c0d
mov esi, 0x15384
or edi, 0xffffffff
mov ecx, eax
sub esi, eax
mov ebx, 0x1a
mov edx, dword [esi + ecx]
mov ebp, edx
xor ebp, edi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov edi, edx
jne 0x11bf4
mov dword [esp + 0x24], eax
xor esi, esi
push esi
push 0x88
push 1
mov dword [esp + 0x3c], esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, esi
je 0x11c4d
mov esi, 0x1542c
or edi, 0xffffffff
mov ecx, eax
sub esi, eax
mov ebx, 0x22
mov edx, dword [esi + ecx]
mov ebp, edx
xor ebp, edi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov edi, edx
jne 0x11c34
mov dword [esp + 0x30], eax
xor esi, esi
push esi
push 0x38
push 1
mov dword [esp + 0x2c], esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp eax, esi
je 0x11c8a
mov esi, 0x153f0
or edi, 0xffffffff
mov ecx, eax
sub esi, eax
mov ebx, 0xe
mov edx, dword [esi + ecx]
mov ebp, edx
xor ebp, edi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov edi, edx
jne 0x11c71
mov dword [esp + 0x20], eax
xor esi, esi
push str._Uninstall_
call fcn.00012660
cmp dword [0x16f10], esi
jne 0x1219d
cmp dword [esp + 0x24], 0
mov dword [0x16f10], 1
je 0x121ae
cmp dword [esp + 0x30], 0
je 0x1219d
cmp dword [esp + 0x20], 0
je 0x1219d
push 0
push 0
push 0
call fcn.00013f00
mov eax, 0x15d80
call fcn.00010a20
push str._Uninstall_Decode
mov edi, eax
call fcn.00012660
test edi, edi
je 0x11d65
movzx esi, word [0x15d80]
sub esi, 8
mov eax, 0
mov ebx, eax
je 0x11d2d
mov edx, 1
mov cl, byte [eax + edi]
inc eax
inc edx
test cl, cl
jns 0x11d28
cmp cl, 0xff
je 0x11d1e
cmp eax, esi
jae 0x11d61
inc eax
inc edx
jmp 0x11d28
cmp edx, esi
jae 0x11d61
add eax, 2
add edx, 2
inc ebx
cmp eax, esi
jb 0x11d08
mov eax, ebx
push 0
add eax, eax
push eax
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
mov dword [esp + 0x18], esi
test esi, esi
je 0x11d56
movzx ecx, word [0x15d80]
sub ecx, 8
push ecx
call fcn.000105d0
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x11d69
xor eax, eax
jmp 0x11d2f
mov esi, dword [esp + 0x18]
push str._Uninstall_Del_keys
xor ebx, ebx
mov edi, esi
call fcn.00012660
mov edx, dword [esp + 0x24]
mov ebp, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push edx
lea eax, [esp + 0x2c]
push eax
call ebp
xor eax, eax
push eax
push eax
push eax
push eax
lea edx, [esp + 0x4c]
push edx
mov dword [esp + 0x54], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
push 0xf003f
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x40]
push eax
mov dword [esp + 0x58], 0x18
mov dword [esp + 0x64], 0x40
mov dword [esp + 0x60], ecx
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jl 0x1219d
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x40], ecx
jmp 0x11de0
mov eax, edi
mov dword [esp + ebx*4 + 0x58], edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x11df0
sub eax, edx
sar eax, 1
inc ebx
lea edi, [edi + eax*2 + 2]
cmp ebx, 0xd
jb 0x11de0
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov edi, 0xb
mov esi, dword [esp + edi*4 + 0x58]
push esi
lea edx, [esp + 0x2c]
push edx
call ebp
lea eax, [esp + 0x3c]
push eax
push 0xf003f
lea ecx, [esp + 0x1c]
push ecx
call ebx
test eax, eax
jl 0x11e68
push esi
push str._Uninstall_Del:__S
call fcn.00012710
mov edx, dword [esp + 0x1c]
add esp, 8
push edx
call fcn.00010ad0
test eax, eax
jge 0x11e60
mov eax, dword [esp + 0x14]
test eax, eax
je 0x11e60
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [esp + 0x14], 0
inc edi
cmp edi, 0xd
jb 0x11e14
mov eax, dword [esp + 0x40]
xor esi, esi
cmp eax, esi
je 0x11e7f
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x40], esi
mov edx, eax
jmp 0x11e90
mov di, word [ecx + edx*2]
inc edx
test di, di
jne 0x11e9b
inc eax
cmp eax, 0xb
jb 0x11e90
lea eax, [edx + edx]
xor edx, edx
push str._Uninstall_Pending_del
mov dword [esp + 0x20], eax
mov word [eax + ecx], dx
call fcn.00012660
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
push ecx
call ebp
push esi
push esi
push esi
push esi
lea eax, [esp + 0x4c]
push eax
push 0xf003f
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x40]
push ecx
mov dword [esp + 0x58], 0x18
mov dword [esp + 0x5c], esi
mov dword [esp + 0x64], 0x40
mov dword [esp + 0x60], edx
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jl 0x1219d
mov edx, dword [esp + 0x20]
push edx
lea eax, [esp + 0x2c]
push eax
call ebp
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push 2
lea edx, [esp + 0x38]
push edx
push eax
call esi
xor ebp, ebp
push ebp
cmp eax, 0xc0000023
jne 0x1208d
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x20]
lea eax, [ecx + edx + 0x70]
push eax
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x10], eax
test eax, eax
je 0x1219d
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x38]
push ecx
push edx
mov edx, dword [esp + 0x1c]
push eax
push 2
lea ecx, [esp + 0x38]
push ecx
push edx
call esi
test eax, eax
jl 0x1219d
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov esi, dword [esp + 0x18]
lea ebx, [ecx + eax + 0xa]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x11f95
sub eax, edx
sar eax, 1
lea edi, [eax + eax]
test edi, edi
je 0x11fdf
mov edx, dword [str.___]
add edi, 2
push edi
mov dword [ebx], edx
mov eax, dword [0x157c0]
lea ecx, [ebx + 8]
push esi
push ecx
mov dword [ebx + 4], eax
call fcn.00014c80
xor edx, edx
inc ebp
add esp, 0xc
add esi, edi
mov word [edi + ebx + 8], dx
lea ebx, [edi + ebx + 0xa]
cmp ebp, 0xb
jb 0x11f90
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x1c]
xor eax, eax
mov word [ebx], ax
mov ecx, dword [esi + 8]
push eax
lea edx, [ecx + ebp + 0x6e]
push edx
push 1
add ebx, 2
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
je 0x1207e
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
lea edx, [ecx + ebp + 0x6e]
push edx
add eax, 0xc
push eax
push edi
xor esi, esi
call fcn.00014c80
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 8]
lea edx, [ecx + ebp + 0x6c]
add esp, 0xc
test edx, 0xfffffffe
jbe 0x12052
cmp word [edi + esi*2], 0
jne 0x12044
mov ecx, 0x7c
mov word [edi + esi*2], cx
mov edx, dword [eax + 8]
lea ecx, [edx + ebp + 0x6c]
inc esi
shr ecx, 1
cmp esi, ecx
jb 0x12034
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 8]
push edi
lea ecx, [eax + ebp + 0x6e]
push ecx
push str.Uninstall
push str.__s_A:__d__S
call fcn.00012710
add esp, 0x10
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov esi, dword [esp + 0x10]
sub ebx, esi
sub ebx, 0xc
push ebx
add esi, 0xc
push esi
jmp 0x1217d
mov eax, dword [esp + 0x20]
add eax, 0x70
push eax
push 1
mov dword [esp + 0x60], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x10], eax
test eax, eax
je 0x1219d
mov esi, dword [esp + 0x18]
mov ebx, eax
mov eax, esi
lea edx, [eax + 2]
jmp 0x120c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x120c0
sub eax, edx
sar eax, 1
lea edi, [eax + eax]
test edi, edi
je 0x1210b
mov ecx, dword [str.___]
add edi, 2
push edi
mov dword [ebx], ecx
mov edx, dword [0x157c0]
lea eax, [ebx + 8]
push esi
push eax
mov dword [ebx + 4], edx
call fcn.00014c80
xor ecx, ecx
inc ebp
add esp, 0xc
add esi, edi
mov word [edi + ebx + 8], cx
lea ebx, [edi + ebx + 0xa]
cmp ebp, 0xb
jb 0x120b3
mov ebp, dword [esp + 0x54]
xor edx, edx
push edx
push ebp
mov word [ebx], dx
push 1
add ebx, 2
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
test edi, edi
je 0x12175
mov eax, dword [esp + 0x10]
push ebp
push eax
push edi
xor esi, esi
call fcn.00014c80
mov eax, dword [esp + 0x28]
add eax, 0x6e
add esp, 0xc
shr eax, 1
je 0x12158
cmp word [edi + esi*2], 0
jne 0x12153
mov ecx, 0x7c
mov word [edi + esi*2], cx
inc esi
cmp esi, eax
jb 0x12143
push edi
push ebp
push str.Uninstall
push str.__s_B:__d__S
call fcn.00012710
add esp, 0x10
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [esp + 0x10]
sub ebx, eax
push ebx
push eax
mov eax, dword [esp + 0x1c]
push 7
push 0
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
jl 0x1219d
mov dword [esp + 0x34], 0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x121ae
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [esp + 0x30]
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test eax, eax
je 0x121c1
push 0
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x121ce
push 0
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x121db
push 0
push eax
call esi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x121e8
push 0
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x121f7
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [esp + 0x40]
test eax, eax
je 0x12206
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret