Function at 0x40345a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x408a20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x10]
push ebx
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x20]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, ecx
mov dword [ebp - 0x30], edi
mov byte [ebp - 0x21], cl
mov dword [ebp - 0x10], 0x8f3d8f0a
mov dword [ebp - 0xc], 0x8f3c8f0f
mov dword [ebp - 8], 0x8f25
mov dword [ebp - 0x20], 0x8f0f8f0c
mov dword [ebp - 0x1c], 0x8f078f1e
mov dword [ebp - 0x18], 0x8f1c8f0a
mov dword [ebp - 0x14], 0x8f18
mov dword [ebp - 0x34], ecx
mov ebx, dword [ebp + eax*4 - 0x48]
xor esi, esi
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4034cb
sub ecx, edx
sar ecx, 1
push ecx
push 0x18f4e
push ebx
call fcn.00402a2a
movzx ecx, word [edi]
xor edx, edx
mov eax, dword [edi + 4]
mov esi, ebx
mov word [eax + ecx*2], dx
xor ecx, ecx
mov ax, word [ebx]
add ebx, 2
cmp ax, cx
jne 0x4034f6
mov edi, dword [edi + 4]
sub ebx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, cx
jne 0x403509
mov ecx, ebx
lea eax, [ebp - 0x68]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x30]
push dword [edi + 4]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x58], eax
xor ebx, ebx
lea eax, [ebp - 0x60]
mov dword [ebp - 0x5c], ebx
push eax
push 0xf003f
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x54], 0x40
push eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x40370c
push dword [0x408830]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push 2
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
jne 0x4036fa
push 0x5075626c
push dword [ebp - 0x28]
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
je 0x4036fa
push dword [ebp - 0x28]
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x3c]
push esi
push 2
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x4036ee
cmp dword [esi + 0xc], 2
jge 0x4036ee
push dword [0x4087e0]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push 2
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
jne 0x4036ee
push 0x5075626c
push esi
lfence
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 0x28]
push 0x5075626c
add eax, 4
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
je 0x4036fa
mov eax, dword [ebp - 0x28]
add eax, 4
push eax
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x3c]
push esi
push 2
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x4036ee
lea ebx, [esi + 0xc]
xor edx, edx
mov edi, ebx
lfence
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, dx
jne 0x403681
sub edi, ecx
sar edi, 1
movzx ecx, di
jmp 0x4036ac
lea edx, [ecx - 1]
movzx eax, dx
movzx eax, word [ebx + eax*2]
cmp eax, 0x5c
je 0x4036b3
cmp eax, 0x2f
je 0x4036b3
movzx ecx, dx
test cx, cx
jne 0x403695
jmp 0x4036eb
movzx eax, cx
sub edi, eax
add edi, edi
push edi
lea eax, [ebx + eax*2]
mov ebx, dword [ebp - 0x40]
push eax
lfence
movzx ecx, word [ebx]
mov eax, dword [ebx + 4]
lea eax, [eax + ecx*2]
push eax
call sub.ntoskrnl.exe_memcpy
movzx eax, word [ebx]
add esp, 0xc
shr edi, 1
add edi, eax
mov byte [ebp - 0x21], 1
mov eax, dword [ebx + 4]
xor ecx, ecx
mov word [eax + edi*2], cx
mov edi, dword [ebp - 0x30]
push 0x5075626c
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push dword [ebp - 0x2c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov cl, byte [ebp - 0x21]
test cl, cl
jne 0x40371f
jmp 0x40370f
mov cl, byte [ebp - 0x21]
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 2
jb 0x4034c0
mov al, cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406896
leave
ret 8