Function at 0x17766
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x13fc4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x31
xor eax, eax
mov word [ebp - 0x80], ax
lea edi, [ebp - 0x7e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
xor eax, eax
lea edi, [ebp - 0x88]
mov dword [ebp - 0x8c], esi
stosd dword es:[edi], eax
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x70], esi
stosd dword es:[edi], eax
pop eax
push 0x30
mov word [ebp - 0x14], ax
pop eax
push 0x5c
mov ecx, eax
mov word [ebp - 0x12], cx
mov word [ebp - 0x10], cx
mov word [ebp - 0xe], cx
mov word [ebp - 0xc], cx
mov word [ebp - 0xa], cx
xor ecx, ecx
mov word [ebp - 8], cx
mov word [ebp - 6], cx
pop ecx
push 0x52
mov edx, ecx
mov word [ebp - 0x58], dx
pop edx
push 0x65
mov word [ebp - 0x56], dx
pop edx
push 0x67
mov word [ebp - 0x54], dx
pop edx
push 0x69
mov word [ebp - 0x52], dx
pop edx
push 0x73
mov word [ebp - 0x50], dx
pop edx
push 0x74
mov word [ebp - 0x4e], dx
pop edx
push 0x72
mov word [ebp - 0x4c], dx
pop edx
push 0x79
mov word [ebp - 0x4a], dx
pop edx
push 0x4d
mov word [ebp - 0x48], dx
mov edx, ecx
mov word [ebp - 0x46], dx
pop edx
push 0x61
mov word [ebp - 0x44], dx
pop edx
push 0x63
mov word [ebp - 0x42], dx
pop edx
push 0x68
mov word [ebp - 0x40], dx
pop edx
push 0x69
mov word [ebp - 0x3e], dx
pop edx
push 0x6e
mov word [ebp - 0x3c], dx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x60], esi
pop edx
push 0x65
mov word [ebp - 0x3a], dx
pop edx
push 0x53
mov word [ebp - 0x38], dx
mov edx, ecx
mov word [ebp - 0x36], dx
pop edx
push 0x59
mov word [ebp - 0x34], dx
pop edx
push 0x53
mov word [ebp - 0x32], dx
pop edx
push 0x54
mov word [ebp - 0x30], dx
pop edx
push 0x45
mov word [ebp - 0x2e], dx
pop edx
mov word [ebp - 0x28], cx
mov ecx, eax
mov word [ebp - 0x1e], ax
xor eax, eax
push 0x4d
mov word [ebp - 0x2c], dx
pop edx
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], ax
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x70]
push eax
mov word [ebp - 0x2a], dx
mov word [ebp - 0x26], cx
mov word [ebp - 0x24], cx
mov word [ebp - 0x22], cx
mov word [ebp - 0x20], cx
call dword [sym.imp.ntoskrnl.exe_KeQuerySystemTime]
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movsx eax, word [ebp - 0x74]
push 9
cdq
pop ecx
idiv ecx
movsx edi, word [ebp - 0x76]
mov ecx, edi
add word [ebp - 0x14], dx
and ecx, 0x80000007
mov dword [ebp - 0x84], edx
jns 0x178fb
dec ecx
or ecx, 0xfffffff8
inc ecx
movsx eax, word [ebp - 0x78]
cdq
push 7
pop ebx
idiv ebx
add word [ebp - 0x12], cx
add word [ebp - 0xa], cx
mov eax, edi
push 9
pop ecx
mov ebx, dword [ebp - 0x84]
add word [ebp - 0xc], bx
add word [ebp - 0xe], dx
cdq
idiv ecx
movsx eax, word [ebp - 0x74]
add word [ebp - 0x26], dx
and eax, 0x80000007
jns 0x17937
dec eax
or eax, 0xfffffff8
inc eax
add word [ebp - 0x24], ax
mov eax, edi
cdq
push 7
pop ecx
idiv ecx
movsx eax, word [ebp - 0x78]
add word [ebp - 0x20], bx
add word [ebp - 0x22], dx
and eax, 0x80000007
jns 0x1795b
dec eax
or eax, 0xfffffff8
inc eax
add word [ebp - 0x1e], ax
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xac]
push eax
call edi
push esi
push esi
push esi
lea eax, [ebp - 0xac]
mov dword [ebp - 0x9c], eax
push esi
lea eax, [ebp - 0xa4]
push eax
push 0xf003f
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0xa4], 0x18
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x98], 0x240
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jl 0x17a96
lea eax, [ebp - 0x14]
push eax
xor ebx, ebx
lea eax, [ebp - 0x68]
inc ebx
push eax
mov dword [0x13fc0], ebx
call edi
lea eax, [ebp - 0x14]
push 2
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
add eax, edi
cmp cx, si
jne 0x179e2
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push edi
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x5c]
mov dword [0x13fc0], esi
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push dword [ebp - 0x5c]
mov dword [0x13fc0], 5
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push esi
push dword [ebp - 0x5c]
mov dword [0x13fc0], 4
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x5c]
mov dword [0x13fc0], edi
call dword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
push dword [ebp - 0x5c]
mov dword [0x13fc0], 3
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov dword [0x13fc0], 6
cmp dword [ebp - 0x5c], esi
je 0x17a96
push dword [ebp - 0x5c]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.000106e4
leave
ret