Function at 0x17c58
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x868
mov eax, dword [0x1abdc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push 0x21f
lea eax, [ebp - 0x633]
push esi
push eax
mov dword [ebp - 0x840], esi
mov byte [ebp - 0x634], 0
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1a1ae
lea eax, [ebp - 0x868]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x868]
mov dword [ebp - 0x858], eax
lea eax, [ebp - 0x860]
push eax
push 8
lea eax, [ebp - 0x844]
push eax
mov dword [ebp - 0x860], 0x18
mov dword [ebp - 0x85c], esi
mov dword [ebp - 0x854], 0x240
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x84c], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x17f74
lea eax, [ebp - 0x848]
push eax
push 0x220
lea eax, [ebp - 0x634]
push eax
push esi
push esi
push dword [ebp - 0x844]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
jl 0x17f68
push ebx
push edi
push 2
pop ebx
jmp 0x17d26
xor esi, esi
mov edi, 0x208
push edi
lea eax, [ebp - 0x83c]
push esi
push eax
call sub.ntoskrnl.exe_memset
push dword [ebp - 0x628]
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x83c]
push eax
call sub.ntoskrnl.exe_memcpy
push edi
lea eax, [ebp - 0x414]
push esi
push eax
call sub.ntoskrnl.exe_memset
add esp, 0x24
xor eax, eax
movzx ecx, word [eax + 0x1a1ae]
mov word [ebp + eax - 0x414], cx
add eax, ebx
cmp cx, si
jne 0x17d65
lea edi, [ebp - 0x414]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
cmp ax, si
jne 0x17d83
mov esi, 0x1a1aa
lea eax, [ebp - 0x83c]
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x17d9c
sub eax, edx
lea edi, [ebp - 0x414]
dec edi
dec edi
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x17db0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp byte [0x1cb29], 0
rep movsb byte es:[edi], byte [esi]
je 0x17ee4
xor eax, eax
movzx ecx, word [ebp + eax - 0x414]
mov word [ebp + eax - 0x20c], cx
add eax, ebx
test cx, cx
jne 0x17dda
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x17df9
push 0xc
pop ecx
mov esi, 0x1a444
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20c]
push eax
movsw word es:[edi], word [esi]
call fcn.00017508
xor eax, eax
movzx ecx, word [ebp + eax - 0x414]
mov word [ebp + eax - 0x20c], cx
add eax, ebx
test cx, cx
jne 0x17e1e
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x17e3d
push 0xe
pop ecx
lea eax, [ebp - 0x20c]
mov esi, 0x1a40c
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00017508
xor eax, eax
movzx ecx, word [ebp + eax - 0x414]
mov word [ebp + eax - 0x20c], cx
add eax, ebx
test cx, cx
jne 0x17e60
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x17e7f
push 0x13
pop ecx
lea eax, [ebp - 0x20c]
mov esi, 0x1a3c0
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00017508
xor eax, eax
movzx ecx, word [ebp + eax - 0x414]
mov word [ebp + eax - 0x20c], cx
add eax, ebx
test cx, cx
jne 0x17ea2
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x17ec1
push 0xe
pop ecx
mov esi, 0x1a386
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20c]
push eax
movsw word es:[edi], word [esi]
call fcn.00017508
cmp byte [0x1cb2a], 0
je 0x17f31
xor eax, eax
movzx ecx, word [ebp + eax - 0x414]
mov word [ebp + eax - 0x20c], cx
add eax, ebx
test cx, cx
jne 0x17eef
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x17f0e
push 0x12
pop ecx
mov esi, 0x1a33c
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20c]
push eax
movsw word es:[edi], word [esi]
call fcn.00017508
inc dword [ebp - 0x840]
lea eax, [ebp - 0x848]
push eax
push 0x220
lea eax, [ebp - 0x634]
push eax
push 0
push dword [ebp - 0x840]
push dword [ebp - 0x844]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
jge 0x17d24
pop edi
pop ebx
push dword [ebp - 0x844]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00019878
leave
ret