Function at 0x13092
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x48
push 0x112a8
call fcn.000105f8
mov dword [ebp - 0x1c], 0xc0000001
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x158c2
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x58], 0x18
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], 0x240
lea eax, [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x58]
push eax
push 0xf003f
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jge 0x13108
push eax
lea eax, [ebp - 0x38]
push eax
push 0x1588a
push ebx
call fcn.00014eba
add esp, 0x10
jmp 0x132ad
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, ebx
jge 0x1313f
cmp esi, 0xc0000023
je 0x1313f
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push esi
lea eax, [ebp - 0x38]
push eax
push 0x1584a
jmp 0x130fa
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov edi, 0x62525249
push edi
push eax
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
cmp esi, ebx
jne 0x1317a
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea eax, [ebp - 0x38]
push eax
push 0x157fe
push ebx
call fcn.00014eba
add esp, 0xc
jmp 0x132ad
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x2c]
push esi
push 2
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jge 0x131ae
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push dword [ebp - 0x1c]
lea eax, [ebp - 0x38]
push eax
push 0x157be
jmp 0x130fa
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x28], eax
jae 0x132a4
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jge 0x131ff
cmp eax, 0xc0000023
je 0x131ff
push eax
lea eax, [ebp - 0x38]
push eax
push 0x15780
push ebx
call fcn.00014eba
add esp, 0x10
jmp 0x1329c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
push edi
push eax
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
cmp esi, ebx
jne 0x13229
lea eax, [ebp - 0x38]
push eax
push 0x15742
push ebx
call fcn.00014eba
add esp, 0xc
jmp 0x1329c
push dword [ebp - 0x2c]
push ebx
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x2c]
push esi
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jge 0x13268
push edi
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push dword [ebp - 0x1c]
lea eax, [ebp - 0x38]
push eax
push 0x15700
jmp 0x131f1
lea eax, [esi + 0x10]
cmp eax, ebx
je 0x13294
cmp dword [esi + 0xc], ebx
je 0x13294
mov cx, word [esi + 0xc]
mov word [ebp - 0x40], cx
mov cx, word [esi + 0xc]
mov word [ebp - 0x3e], cx
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x30]
call dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push edi
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
inc dword [ebp - 0x28]
jmp 0x131b7
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [ebp - 4], 0xfffffffe
call fcn.000132c4
mov eax, dword [ebp - 0x1c]
call fcn.0001063d
ret 4