Function at 0x1787a
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6a8
mov eax, dword [0x1abdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push 0x21f
mov dword [ebp - 0x650], eax
lea eax, [ebp - 0x637]
push ebx
push eax
mov dword [ebp - 0x63c], ebx
mov byte [ebp - 0x638], bl
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1a1ae
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x670]
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x668]
push eax
push 8
lea eax, [ebp - 0x640]
push eax
mov dword [ebp - 0x668], 0x18
mov dword [ebp - 0x664], ebx
mov dword [ebp - 0x65c], 0x240
mov dword [ebp - 0x658], ebx
mov dword [ebp - 0x654], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x17921
xor al, al
jmp 0x17b32
push esi
push edi
lea eax, [ebp - 0x64c]
push eax
push 0x220
lea eax, [ebp - 0x638]
push eax
push ebx
push ebx
jmp 0x17a31
mov esi, 0x208
push esi
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.ntoskrnl.exe_memset
push dword [ebp - 0x62c]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.ntoskrnl.exe_memcpy
push esi
lea eax, [ebp - 0x418]
push ebx
push eax
call sub.ntoskrnl.exe_memset
add esp, 0x24
xor eax, eax
movzx ecx, word [eax + 0x1a1ae]
mov word [ebp + eax - 0x418], cx
inc eax
inc eax
cmp cx, bx
jne 0x1797c
lea edi, [ebp - 0x418]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x1799a
mov esi, 0x1a1aa
lea eax, [ebp - 0x210]
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x179b3
sub eax, edx
lea edi, [ebp - 0x418]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
cmp cx, bx
jne 0x179c7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x418]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x179ea
push 0x1e
pop ecx
lea eax, [ebp - 0x418]
push eax
mov esi, 0x1a226
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
test eax, eax
jge 0x17a4a
inc dword [ebp - 0x63c]
lea eax, [ebp - 0x64c]
push eax
push 0x220
lea eax, [ebp - 0x638]
push eax
push ebx
push dword [ebp - 0x63c]
push dword [ebp - 0x640]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
jge 0x1793d
jmp 0x17b22
push 0x34
lea eax, [ebp - 0x6a4]
push ebx
push eax
mov dword [ebp - 0x63c], ebx
mov dword [ebp - 0x6a8], ebx
call sub.ntoskrnl.exe_memset
xor eax, eax
push 0x208
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call sub.ntoskrnl.exe_memset
xor eax, eax
mov word [ebp - 0x648], ax
mov eax, 0x20a
mov word [ebp - 0x646], ax
add esp, 0x18
lea eax, [ebp - 0x210]
mov dword [ebp - 0x644], eax
push ebx
lea eax, [ebp - 0x648]
mov dword [ebp - 0x69c], eax
push ebx
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x418]
xor esi, esi
push eax
inc esi
push ebx
mov dword [ebp - 0x6a4], 0x20
mov dword [ebp - 0x6a0], 0x1a0bc
mov dword [ebp - 0x698], esi
mov dword [ebp - 0x694], 0x19eb6
mov dword [ebp - 0x690], ebx
call dword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
test eax, eax
jl 0x17b1c
mov edx, dword [ebp - 0x650]
lea eax, [ebp - 0x210]
mov ecx, eax
mov dword [ebp - 0x63c], esi
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, bx
jne 0x17b0e
mov bl, byte [ebp - 0x63c]
push dword [ebp - 0x640]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
mov al, bl
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00019878
leave
ret 4