Function at 0x402290
Capabilities:
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x40
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call esi
cmp al, 1
jbe 0x4022d9
call esi
movzx eax, al
push eax
push str.EX:_Pageable_code_called_at_IRQL__d_n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
push ebx
push 0x290
push str..RegProtect.cpp
push 0x40c8f4
call dword [sym.imp.ntoskrnl.exe_RtlAssert]
cmp edi, ebx
je 0x40257c
mov eax, dword [edi + 8]
cmp eax, ebx
je 0x40257c
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push eax
lea ecx, [esp + 0x2c]
push ecx
call esi
mov edx, dword [edi + 0xc]
push edx
lea eax, [esp + 0x24]
push eax
call esi
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
push ebx
lea eax, [esp + 0x40]
lea ecx, [esp + 0x38]
push eax
mov dword [esp + 0x4c], ecx
push 0x1f01ff
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x4c], 0x18
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], 0x40
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov esi, eax
cmp esi, ebx
jl 0x40254d
mov ebx, 1
cmp dword [0x410048], ebx
jg 0x40236f
mov edx, dword [esp + 0x10]
push edx
push str.create_or_open_the_key_successfully__and_the_system_return_the_value__0x_08x._n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov eax, dword [edi + 0x10]
cmp eax, 4
jne 0x402388
mov ecx, dword [edi + 0x14]
lea ebp, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebp
jmp 0x402391
mov edx, dword [edi + 0x14]
mov dword [esp + 0x18], edx
mov ebp, edx
cmp dword [esp + 0x10], 2
jne 0x40250b
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 2
lea ecx, [esp + 0x30]
push ecx
push edx
call ebx
mov esi, eax
cmp esi, 0xc0000034
je 0x4024ab
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4024ab
push 0x50474552
push eax
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebp, eax
test ebp, ebp
je 0x402564
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push ecx
push ebp
push 2
lea edx, [esp + 0x30]
push edx
push eax
call ebx
mov esi, eax
test esi, esi
jl 0x40249a
mov eax, dword [ebp + 4]
mov ebx, 4
cmp eax, ebx
jne 0x402433
cmp dword [ebp + 8], ebx
jne 0x402433
cmp dword [0x410048], 2
jg 0x402452
mov ecx, dword [ebp + 0xc]
push ecx
push str.Query_the_REG_DWORD_registry_value_successfully__value_d
jmp 0x40244a
cmp eax, 1
jne 0x402452
cmp dword [0x410048], 2
jg 0x402452
lea edx, [ebp + 0xc]
push edx
push str.Query_the_REG_SZ_register_value_successfully__value_S._n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov eax, ebp
mov ecx, edi
call fcn.00402980
test eax, eax
jne 0x40249a
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + 0x10]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov esi, eax
test esi, esi
jge 0x40249a
cmp dword [0x410048], ebx
jg 0x40249a
push esi
push str.Failed_to_add_the_new_register_value_to_the_HKEY__exceptionCode0x_08x._n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
push 0x50474552
push ebp
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x402564
mov ebx, 4
cmp dword [0x410048], ebx
jg 0x4024c6
push esi
push str.Failed_to_query_the_key_value_size_exceptionCode0x_08x._n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov edx, dword [edi + 0x18]
mov eax, dword [edi + 0x10]
push edx
mov edx, dword [esp + 0x18]
push ebp
push eax
push 0
lea ecx, [esp + 0x30]
push ecx
push edx
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov esi, eax
test esi, esi
jge 0x4024f7
cmp dword [0x410048], ebx
jg 0x402564
push esi
push str.Failed_to_add_the_new_key_value__status__0x_08x._n
jmp 0x40255c
cmp dword [0x410048], 1
jg 0x402564
mov eax, dword [edi + 0xc]
push eax
push str.Add_or_change_the_registry_successfully__registry_KeyName___ws__n
jmp 0x40255c
mov ecx, dword [edi + 0x18]
push ecx
push ebp
push eax
mov eax, dword [esp + 0x20]
push 0
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov esi, eax
test esi, esi
jge 0x40253a
cmp dword [0x410048], 4
jg 0x402564
push esi
push str.Failed_to_add_the_new_key_value__status__0x_08x._n
jmp 0x40255c
cmp dword [0x410048], ebx
jg 0x402564
mov ecx, dword [edi + 0xc]
push ecx
push str.Add_or_change_the_registry_successfully__registry_KeyName___ws_n
jmp 0x40255c
cmp dword [0x410048], 4
jg 0x402564
push esi
push str.Failed_to_open_or_create_the_registry_key__status__0x_08x._n
call sub.ntoskrnl.exe_DbgPrint
add esp, 8
mov eax, dword [esp + 0x14]
test eax, eax
je 0x402573
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
cmp dword [0x410048], 4
jg 0x402592
push str.Give_the_error_parmater._n
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x40
ret