Function at 0x28a40
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38c
mov eax, dword [0x30fa8]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
mov dword [ebp - 0x23c], 0
mov byte [ebp - 0xe5], 0
mov ecx, 8
mov esi, 0x2e020
lea edi, [ebp - 0xc0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [0x2e000]
mov dword [ebp - 0x38], eax
mov ecx, dword [0x2e004]
mov dword [ebp - 0x34], ecx
mov edx, dword [0x2e008]
mov dword [ebp - 0x30], edx
mov eax, dword [0x2e00c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x2e010]
mov dword [ebp - 0x28], ecx
mov edx, dword [0x2dff0]
mov dword [ebp - 0x58], edx
mov eax, dword [0x2dff4]
mov dword [ebp - 0x54], eax
mov ecx, dword [0x2dff8]
mov dword [ebp - 0x50], ecx
mov ecx, 0x28
mov esi, 0x2df40
lea edi, [ebp - 0x198]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edx, edx
mov word [ebp - 0x238], dx
push 0x7e
push 0
lea eax, [ebp - 0x236]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x2de70
lea ecx, [ebp - 0x1b0]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x2de50
lea edx, [ebp - 8]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x2de30
lea eax, [ebp - 0xe4]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x2de10
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0xdc], 0x18
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd0], 0x240
lea edx, [ebp - 0x1b0]
mov dword [ebp - 0xd4], edx
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 0
lea eax, [ebp - 0xdc]
push eax
push 0xf003f
lea ecx, [ebp - 0x90]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x28b98
jmp 0x29501
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x5c]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x90]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x8000001a
je 0x294a7
cmp dword [ebp - 0x94], 0
je 0x28bfb
cmp dword [ebp - 0x94], 0x80000005
je 0x28bfb
cmp dword [ebp - 0x94], 0xc0000023
je 0x28bfb
jmp 0x294f0
push 0x4641444b
mov edx, dword [ebp - 0x5c]
push edx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x28c2c
jmp 0x294f0
lea ecx, [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0x3c]
push eax
push 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x90]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
jge 0x28c59
jmp 0x294e4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0xc]
add ecx, 0x22
mov dword [ebp - 0x9c], ecx
push 0x4641444b
push 0x800
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x28c93
jmp 0x294e4
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x10
push ecx
mov edx, dword [ebp - 0x19c]
push edx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0xc]
shr ecx, 1
mov edx, dword [ebp - 0x19c]
lea edi, [edx + ecx*2]
mov ecx, 8
lea esi, [ebp - 0xc0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x78], 0x18
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x6c], 0x240
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x78]
push ecx
push 0xf003f
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x29474
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 2
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xc0000034
je 0x29474
cmp dword [ebp - 0x94], 0
je 0x28d86
cmp dword [ebp - 0x94], 0x80000005
je 0x28d86
cmp dword [ebp - 0x94], 0xc0000023
je 0x28d86
jmp 0x294c7
push 0x4641444b
mov eax, dword [ebp - 0x5c]
push eax
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jne 0x28db0
jmp 0x294c7
lea ecx, [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
mov eax, dword [ebp - 0xc4]
push eax
push 2
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jge 0x28ddd
jmp 0x294b8
push 0x12
mov eax, dword [ebp - 0xc4]
add eax, 0xc
push eax
push 0x2ddf0
call dword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp eax, 0x12
jne 0x29453
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x3c]
add eax, 0x10
push eax
mov ecx, dword [ebp - 0x19c]
push ecx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 0xc]
shr eax, 1
mov ecx, dword [ebp - 0x19c]
lea edx, [ecx + eax*2]
mov eax, dword [ebp - 0x38]
mov dword [edx], eax
mov ecx, dword [ebp - 0x34]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x30]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x2c]
mov dword [edx + 0xc], ecx
mov eax, dword [ebp - 0x28]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x19c]
push ecx
lea edx, [ebp - 0x1a8]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x78], 0x18
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], 0x240
lea ecx, [ebp - 0x1a8]
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea eax, [ebp - 0x78]
push eax
push 0xf003f
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x240], 0
push 0x4641444b
push 0x400
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
jne 0x28edd
jmp 0x2943b
lea edx, [ebp - 0x5c]
push edx
push 0x400
mov eax, dword [ebp - 0x240]
push eax
push 2
lea ecx, [ebp - 0xe4]
push ecx
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x28f14
jmp 0x2943b
cmp dword [ebp + 0x10], 0
je 0x28fbc
push 0x80
push 0
lea eax, [ebp - 0x238]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov ecx, dword [ebp - 0x240]
cmp dword [ecx + 8], 0x80
jae 0x28f54
mov edx, dword [ebp - 0x240]
mov eax, dword [edx + 8]
mov dword [ebp - 0x35c], eax
jmp 0x28f5e
mov dword [ebp - 0x35c], 0x80
mov ecx, dword [ebp - 0x35c]
push ecx
mov edx, dword [ebp - 0x240]
add edx, 0xc
push edx
lea eax, [ebp - 0x238]
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x238]
push eax
call fcn.000288a0
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jge 0x28fbc
push 0x2dd50
push 0x442
mov ecx, dword [ebp - 0x94]
push ecx
call fcn.00019350
jmp 0x2943b
mov ecx, 0x28
lea esi, [ebp - 0x198]
mov edi, dword [ebp - 0x19c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edx, [ebp - 0x198]
mov dword [ebp - 0x360], edx
mov eax, dword [ebp - 0x360]
add eax, 2
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x360]
mov dx, word [ecx]
mov word [ebp - 0x366], dx
add dword [ebp - 0x360], 2
cmp word [ebp - 0x366], 0
jne 0x28fec
mov eax, dword [ebp - 0x360]
sub eax, dword [ebp - 0x364]
sar eax, 1
mov dword [ebp - 0x36c], eax
mov ecx, dword [ebp - 0x240]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x240]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x36c]
mov edx, dword [ebp - 0x19c]
lea eax, [edx + ecx*2]
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x19c]
push ecx
lea edx, [ebp - 0x1a8]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x78], 0x18
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x6c], 0x240
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea edx, [ebp - 0x78]
push edx
push 0xf003f
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x244], 2
mov ecx, dword [ebp - 0x244]
sub ecx, 1
mov dword [ebp - 0x244], ecx
js 0x2926e
lea edx, [ebp - 0x5c]
push edx
push 0x400
mov eax, dword [ebp - 0x240]
push eax
push 2
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x60]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x2910f
push 0x2ddd0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jmp 0x290ba
mov dword [ebp - 0x2cc], 0
push 0x80
push 0
lea ecx, [ebp - 0x2c8]
push ecx
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 0x2d0], 0
jmp 0x2914a
mov edx, dword [ebp - 0x2d0]
add edx, 2
mov dword [ebp - 0x2d0], edx
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x2d0]
cmp ecx, dword [eax + 8]
jge 0x291e1
mov edx, dword [ebp - 0x240]
add edx, dword [ebp - 0x2d0]
movzx eax, byte [edx + 0xc]
test eax, eax
je 0x291da
mov ecx, dword [ebp - 0x240]
add ecx, dword [ebp - 0x2d0]
movzx dx, byte [ecx + 0xc]
movzx eax, dx
push eax
call fcn.00027d80
movzx ecx, al
test ecx, ecx
jne 0x291a9
mov edx, dword [ebp - 0x240]
add edx, dword [ebp - 0x2d0]
movzx eax, byte [edx + 0xc]
cmp eax, 0x2e
jne 0x291d6
mov ecx, dword [ebp - 0x240]
add ecx, dword [ebp - 0x2d0]
mov edx, dword [ebp - 0x2cc]
mov al, byte [ecx + 0xc]
mov byte [ebp + edx - 0x2c8], al
mov ecx, dword [ebp - 0x2cc]
add ecx, 1
mov dword [ebp - 0x2cc], ecx
jmp 0x291d8
jmp 0x291e1
jmp 0x291dc
jmp 0x291e1
jmp 0x2913b
lea edx, [ebp - 0x2c8]
mov dword [ebp - 0x370], edx
mov eax, dword [ebp - 0x370]
add eax, 1
mov dword [ebp - 0x374], eax
mov ecx, dword [ebp - 0x370]
mov dl, byte [ecx]
mov byte [ebp - 0x375], dl
add dword [ebp - 0x370], 1
cmp byte [ebp - 0x375], 0
jne 0x291fc
mov eax, dword [ebp - 0x370]
sub eax, dword [ebp - 0x374]
mov dword [ebp - 0x37c], eax
je 0x2925a
lea ecx, [ebp - 0x2c8]
push ecx
call fcn.00027f60
mov dword [0x31228], eax
cmp dword [ebp + 8], 0
je 0x2924f
mov edx, dword [ebp + 8]
mov eax, dword [0x31228]
mov dword [edx], eax
cmp dword [0x31228], 0
jbe 0x2925a
jmp 0x2926e
push 0x2ddd0
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jmp 0x290ba
mov dword [ebp - 0x244], 2
push 0x2ddb0
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, dword [ebp - 0x244]
sub eax, 1
mov dword [ebp - 0x244], eax
js 0x29433
lea ecx, [ebp - 0x5c]
push ecx
push 0x400
mov edx, dword [ebp - 0x240]
push edx
push 2
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x292dc
push 0x2dd80
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jmp 0x29287
mov dword [ebp - 0x354], 0
push 0x80
push 0
lea eax, [ebp - 0x350]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 0x358], 0
jmp 0x29317
mov ecx, dword [ebp - 0x358]
add ecx, 2
mov dword [ebp - 0x358], ecx
mov edx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x358]
cmp eax, dword [edx + 8]
jge 0x293ae
mov ecx, dword [ebp - 0x240]
add ecx, dword [ebp - 0x358]
movzx edx, byte [ecx + 0xc]
test edx, edx
je 0x293a7
mov eax, dword [ebp - 0x240]
add eax, dword [ebp - 0x358]
movzx cx, byte [eax + 0xc]
movzx edx, cx
push edx
call fcn.00027d80
movzx eax, al
test eax, eax
jne 0x29376
mov ecx, dword [ebp - 0x240]
add ecx, dword [ebp - 0x358]
movzx edx, byte [ecx + 0xc]
cmp edx, 0x2e
jne 0x293a3
mov eax, dword [ebp - 0x240]
add eax, dword [ebp - 0x358]
mov ecx, dword [ebp - 0x354]
mov dl, byte [eax + 0xc]
mov byte [ebp + ecx - 0x350], dl
mov eax, dword [ebp - 0x354]
add eax, 1
mov dword [ebp - 0x354], eax
jmp 0x293a5
jmp 0x293ae
jmp 0x293a9
jmp 0x293ae
jmp 0x29308
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x380], ecx
mov edx, dword [ebp - 0x380]
add edx, 1
mov dword [ebp - 0x384], edx
mov eax, dword [ebp - 0x380]
mov cl, byte [eax]
mov byte [ebp - 0x385], cl
add dword [ebp - 0x380], 1
cmp byte [ebp - 0x385], 0
jne 0x293c9
mov edx, dword [ebp - 0x380]
sub edx, dword [ebp - 0x384]
mov dword [ebp - 0x38c], edx
je 0x2941f
lea eax, [ebp - 0x350]
push eax
call fcn.00027f60
mov dword [0x3122c], eax
cmp dword [ebp + 0xc], 0
je 0x2941d
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x3122c]
mov dword [ecx], edx
jmp 0x29433
push 0x2dd80
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jmp 0x29287
xor ecx, ecx
jne 0x28eb7
cmp dword [ebp - 0x240], 0
je 0x29453
push 0
mov edx, dword [ebp - 0x240]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
test eax, eax
jge 0x29474
jmp 0x294d5
push 0
mov edx, dword [ebp - 0x19c]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x19c], 0
jmp 0x28b9f
mov edx, dword [ebp - 0x90]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
jmp 0x29507
push 0
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
test eax, eax
jge 0x294e4
push 0
mov edx, dword [ebp - 0x19c]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0x90]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
test eax, eax
jge 0x29505
xor al, al
jmp 0x29507
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0002bd11
mov esp, ebp
pop ebp
ret 0x10