Function at 0x76aa3173
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x76aae004]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xe9], bl
cmp byte [ebp - 0xe9], bl
lea eax, [ebp - 0x10c]
je 0x76aa31d1
push str.RegistryMachineSystemCurrentControlSetControlSecurePipeServerswinregAllowedExactPaths
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
mov dword [ebp - 0x104], 0x76aae0b8
mov esi, 0x76aae578
mov edi, 0x76aae574
mov dword [ebp - 0x110], 0x76aae57c
jmp 0x76aa31fb
push str.RegistryMachineSystemCurrentControlSetControlSecurePipeServerswinregAllowedPaths
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
mov dword [ebp - 0x104], 0x76aae060
mov esi, 0x76aae570
mov edi, 0x76aae56c
mov dword [ebp - 0x110], 0x76aae584
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0xf0]
push eax
push 1
push 0x2000000
push 0xfffffffffffffffe
mov dword [ebp - 0x128], 0x18
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x11c], 0x40
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
call dword [sym.imp.ntdll.dll_NtOpenThreadToken]
cmp eax, 0xc000005c
je 0x76aa3274
cmp eax, 0xc000007c
je 0x76aa3274
cmp eax, ebx
jne 0x76aa3488
push 4
lea eax, [ebp - 0xf8]
push eax
push 5
push 0xfffffffffffffffe
mov dword [ebp - 0xf8], ebx
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
jmp 0x76aa327a
mov dword [ebp - 0xf0], ebx
lea eax, [ebp - 0x128]
push eax
push 0x20019
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
cmp dword [ebp - 0xf0], ebx
mov dword [ebp - 0xfc], eax
je 0x76aa32d6
push 4
lea eax, [ebp - 0xf0]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
push dword [ebp - 0xf0]
mov dword [ebp - 0x12c], eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 0x12c]
cmp eax, ebx
jge 0x76aa32d6
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], ebx
jge 0x76aa3384
cmp dword [ebp - 0xfc], 0xc000003a
je 0x76aa32fe
cmp dword [ebp - 0xfc], 0xc0000034
jne 0x76aa347e
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x76aa336d
push 1
push 0x76aae080
call dword [sym.imp.ntdll.dll_RtlAcquireResourceExclusive]
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x76aa3362
cmp dword [esi], ebx
je 0x76aa335d
mov eax, dword fs:[0x18]
push dword [esi]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [edi]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x104]
mov dword [esi], ebx
mov dword [edi], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
push 0x76aae080
call dword [sym.imp.ntdll.dll_RtlReleaseResource]
cmp byte [ebp - 0xe9], bl
mov dword [ebp - 0xfc], ebx
je 0x76aa3466
jmp 0x76aa347e
lea eax, [ebp - 0x100]
push eax
push 0xe4
lea eax, [ebp - 0xe8]
push eax
push ebx
push dword [ebp - 0xf4]
call dword [sym.imp.ntdll.dll_NtQueryKey]
cmp eax, ebx
mov dword [ebp - 0xfc], eax
jl 0x76aa3472
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x104]
cmp ecx, dword [eax + 4]
jl 0x76aa3452
jg 0x76aa33d3
mov ecx, dword [ebp - 0xe8]
cmp ecx, dword [eax]
jbe 0x76aa3452
push 1
push 0x76aae080
call dword [sym.imp.ntdll.dll_RtlAcquireResourceExclusive]
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x104]
cmp ecx, dword [eax + 4]
jl 0x76aa3447
jg 0x76aa33fd
mov ecx, dword [ebp - 0xe8]
cmp ecx, dword [eax]
jbe 0x76aa3447
cmp dword [esi], ebx
je 0x76aa342f
mov eax, dword fs:[0x18]
push dword [esi]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [edi]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esi], ebx
mov dword [edi], ebx
push dword [ebp - 0x110]
push edi
push esi
push str.Machine
push dword [ebp - 0xf4]
call fcn.76aa2ff2
push 0x76aae080
call dword [sym.imp.ntdll.dll_RtlReleaseResource]
push dword [ebp - 0xf4]
call dword [sym.imp.ntdll.dll_NtClose]
cmp byte [ebp - 0xe9], bl
jne 0x76aa3486
mov byte [ebp - 0xe9], 1
jmp 0x76aa3197
push dword [ebp - 0xf4]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 0xfc]
jmp 0x76aa3488
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.76aac8aa
leave
ret