Function at 0x4043dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
xor ebx, ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
cmp dword [0x408b7c], ebx
jne 0x4044b4
xor eax, eax
push 0x40
mov word [0x408b78], ax
mov ax, word [edi + 2]
pop ecx
add ax, cx
mov word [0x408b7a], ax
push 0x5075626c
movzx eax, ax
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ecx, eax
mov dword [0x408b7c], ecx
test ecx, ecx
jne 0x404440
xor al, al
jmp 0x404a89
movzx eax, word [0x408b7a]
push eax
push ebx
push ecx
call sub.ntoskrnl.exe_memset
movzx eax, word [edi]
push eax
push dword [edi + 4]
push dword [0x408b7c]
call sub.ntoskrnl.exe_memcpy
mov esi, dword [0x408b7c]
add esp, 0x18
mov ecx, esi
mov dword [ebp - 0x18], esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x404472
sub ecx, edx
sar ecx, 1
movzx ecx, cx
jmp 0x40449d
lea edx, [ecx - 1]
movzx eax, dx
movzx eax, word [esi + eax*2]
cmp eax, 0x5c
je 0x4044a4
cmp eax, 0x2f
je 0x4044a4
movzx ecx, dx
test cx, cx
jne 0x404486
jmp 0x4044b4
movzx eax, cx
mov word [0x408b78], cx
xor ecx, ecx
mov word [esi + eax*2], cx
push 0x40
pop eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
push eax
push 0xf003f
lea eax, [ebp - 0xc]
mov dword [ebp - 0x3c], 0x18
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x404a87
push dword [0x408830]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 2
pop edi
push edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
jne 0x404683
mov eax, dword [ebp - 4]
push 0x5075626c
add eax, 4
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x404683
mov eax, dword [ebp - 4]
add eax, 4
push eax
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push esi
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x40456b
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
push 0x5075626c
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0x10], 3
mov dword [ebp - 8], ebx
jne 0x404683
push ebx
push dword [0x408554]
push 0x408b70
call fcn.0040320e
test al, al
jne 0x404729
push dword [0x408768]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
jne 0x40463b
push 0x5075626c
push dword [ebp - 4]
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x40463b
push dword [ebp - 4]
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push esi
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x40462c
push 0x40
lfence
mov eax, dword [esi + 8]
pop ecx
cmp eax, ecx
jbe 0x404619
mov dword [esi + 8], ecx
mov eax, ecx
push eax
lea eax, [esi + 0xc]
push eax
push dword [0x408554]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push 0x5075626c
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [ebp - 8], ebx
mov ecx, dword [0x408554]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, edi
cmp ax, bx
jne 0x404644
sub ecx, edx
sar ecx, 1
jne 0x40466c
push 0x10
push dword [0x408554]
mov eax, 0x408a40
push eax
mov dword [0x408a40], eax
call fcn.00404bf4
push 1
push dword [0x408554]
push 0x408b70
call fcn.0040320e
jmp 0x404729
push dword [0x4087fc]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
jne 0x404729
mov eax, dword [ebp - 4]
push 0x5075626c
add eax, 4
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x404729
mov eax, dword [ebp - 4]
add eax, 4
push eax
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push esi
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x40471a
push 0x40
lfence
mov eax, dword [esi + 8]
pop ecx
cmp eax, ecx
jbe 0x404707
mov dword [esi + 8], ecx
mov eax, ecx
push eax
lea eax, [esi + 0xc]
push eax
push dword [0x408554]
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push 0x5075626c
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [ebp - 8], ebx
push dword [0x4087e0]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
jne 0x4047b5
mov eax, dword [ebp - 4]
push 0x5075626c
add eax, 0x100
push eax
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x4047b8
mov eax, dword [ebp - 4]
add eax, 0x100
push eax
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push esi
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jns 0x4047b8
push 0x5075626c
push esi
lfence
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov esi, ebx
mov dword [ebp - 8], esi
jmp 0x4047b8
mov esi, dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
test esi, esi
je 0x404a87
mov dword [0x408a40], 0x408b7c
jmp 0x4047d8
push 2
pop edi
movzx ecx, word [0x408b68]
xor edx, edx
mov eax, dword [0x408b6c]
inc dword [0x408a40]
push 0xa
mov word [eax + ecx*2], dx
push dword [0x4086cc]
push dword [0x408a40]
call fcn.00404bf4
mov edx, dword [0x4086cc]
mov esi, edx
mov ax, word [edx]
add edx, edi
cmp ax, bx
jne 0x40480b
mov edi, dword [0x408b6c]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x404820
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x408b6c]
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x404843
mov esi, 0x4068d2
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push dword [0x408b6c]
call fcn.004027c8
test al, al
je 0x40487a
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x3e8
jb 0x4047d5
movzx eax, word [0x408b78]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x18]
xor ecx, ecx
inc dword [0x408a40]
push 0xa
mov word [edi + eax*2], cx
push dword [0x4086cc]
push dword [0x408a40]
call fcn.00404bf4
mov edx, dword [0x4086cc]
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x4048b1
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4048c1
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00404b66
test al, al
je 0x4048f6
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x3e8
jb 0x404887
mov ecx, dword [0x408554]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4048ff
sub ecx, edx
sar ecx, 1
je 0x404a51
movzx ecx, word [0x408b70]
xor edx, edx
mov eax, dword [0x408b74]
mov word [eax + ecx*2], dx
mov edx, dword [0x408554]
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x40492e
mov edi, dword [0x408b74]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x404944
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
movzx ecx, word [0x408b78]
mov eax, dword [0x408b7c]
mov word [eax + ecx*2], dx
mov edx, dword [0x408578]
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x404978
mov edi, dword [0x408b7c]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x40498e
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [0x408554]
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x4049b0
mov edi, dword [0x40857c]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x4049c6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x40857c]
sub edi, 2
mov ax, word [edi + 2]
lea edi, [edi + 2]
cmp ax, bx
jne 0x4049e9
mov eax, dword [0x4068dc]
mov dword [edi], eax
mov edx, dword [0x408578]
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x404a04
mov edi, dword [0x40857c]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x404a1a
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [0x4086c8]
push dword [0x40857c]
push dword [0x408578]
push dword [0x408b7c]
call fcn.0040400a
mov eax, dword [ebp + 8]
push ebx
push dword [eax + 4]
call fcn.00403732
cmp dword [ebp - 0x10], 3
mov bl, al
mov esi, dword [ebp - 8]
jne 0x404a81
lea eax, [esi + 0xc]
push eax
call fcn.00401fc0
push 0x5075626c
push esi
mov bl, al
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x404a87
mov dword [0x408a44], esi
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4