Function at 0x133d0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x428], eax
mov edi, 0xc0000001
mov dword [ebp - 0x418], ebx
cmp dword [ebp + 0x10], ebx
jbe 0x136a9
push esi
mov esi, 0x62525249
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push ebx
push eax
call sub.ntoskrnl.exe_memset
xor eax, eax
push edi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0x18
lea eax, [ebp - 0x42c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x418]
mov dword [ebp - 0x42c], ebx
push dword [ebp - 0x434]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov edi, eax
cmp edi, ebx
jge 0x13495
cmp edi, 0xc0000023
je 0x13495
push edi
push dword [ebp - 0x428]
push 0x15ba0
push ebx
call fcn.00014eba
add esp, 0x10
jmp 0x13693
mov eax, dword [ebp - 0x42c]
push esi
push eax
push 1
mov dword [ebp - 0x438], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x41c], eax
cmp eax, ebx
jne 0x134ce
push dword [ebp - 0x428]
push 0x15b64
push ebx
call fcn.00014eba
add esp, 0xc
jmp 0x13693
lea ecx, [ebp - 0x42c]
push ecx
push dword [ebp - 0x438]
push eax
push ebx
push dword [ebp - 0x418]
push dword [ebp - 0x434]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov edi, eax
cmp edi, ebx
jge 0x13513
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push edi
push dword [ebp - 0x428]
push 0x15b1e
jmp 0x13487
push dword [ebp - 0x428]
xor eax, eax
mov word [ebp - 0x424], ax
mov eax, 0x208
mov word [ebp - 0x422], ax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
push 0x15b1a
lea eax, [ebp - 0x424]
push eax
call fcn.000104e0
mov edi, eax
cmp edi, ebx
jge 0x1357d
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push edi
lea eax, [ebp - 0x424]
push eax
push 0x15adc
jmp 0x13487
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp - 0x41c]
push dword [eax + 0xc]
add eax, 0x10
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.000104e0
mov edi, eax
cmp edi, ebx
jge 0x135f3
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x424]
push eax
push 0x15a9a
push ebx
call fcn.00014eba
add esp, 0x14
jmp 0x13693
lea eax, [ebp - 0x424]
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x450]
push eax
push 0xf003f
lea eax, [ebp - 0x430]
push eax
mov dword [ebp - 0x450], 0x18
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x444], 0x240
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov edi, eax
cmp edi, ebx
jl 0x13674
lea eax, [ebp - 0x424]
push eax
call fcn.00013d00
push dword [ebp - 0x430]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov edi, eax
push edi
lea eax, [ebp - 0x424]
push eax
push 0x15a5e
push ebx
call fcn.00014eba
add esp, 0x10
dec dword [ebp - 0x418]
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push dword [ebp - 0x430]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
inc dword [ebp - 0x418]
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp + 0x10]
jb 0x13415
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.00010593
leave
ret 0xc