Function at 0x1141e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push edi
lea eax, [ebp - 0x30]
push eax
xor edi, edi
push 0x20019
lea eax, [ebp - 8]
push eax
xor ebx, ebx
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 0x240
mov dword [ebp - 0x28], 0x14048
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x11811
push esi
push 0x15014
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp - 4]
push eax
push edi
push edi
push 1
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call esi
cmp eax, 0x80000005
je 0x1149e
cmp eax, 0xc0000023
jne 0x11807
push 0x5f49415f
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x11807
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call esi
test eax, eax
jl 0x117f9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 8]
add eax, ecx
push 5
pop edx
mov ecx, edx
mov edi, 0x1501c
mov esi, eax
xor ebx, ebx
repe cmpsw word [esi], word es:[edi]
jne 0x114f8
mov ebx, 0x151f0
jmp 0x117f9
push 7
pop ecx
mov edi, 0x15028
mov esi, eax
xor ebx, ebx
repe cmpsw word [esi], word es:[edi]
jne 0x11513
mov ebx, 0x15368
jmp 0x117f9
mov ecx, edx
mov edi, 0x15038
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x1152c
mov ebx, 0x154e0
jmp 0x117f9
mov ecx, edx
mov edi, 0x1504c
mov esi, eax
xor ebx, ebx
repe cmpsw word [esi], word es:[edi]
jne 0x11546
mov ebx, 0x15658
jmp 0x117f9
mov ecx, edx
mov edi, 0x15058
mov esi, eax
xor ebx, ebx
repe cmpsw word [esi], word es:[edi]
jne 0x11560
mov ebx, 0x157d0
jmp 0x117f9
mov ecx, edx
mov edi, 0x15064
mov esi, eax
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x1157a
mov ebx, 0x15948
jmp 0x117f9
push 4
pop ecx
mov edi, 0x15070
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x11594
mov ebx, 0x15ac0
jmp 0x117f9
push 2
pop ecx
mov edi, 0x15080
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x115ae
mov ebx, 0x15c38
jmp 0x117f9
push 4
pop ecx
mov edi, 0x15088
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x115c8
mov ebx, 0x15db0
jmp 0x117f9
push 9
pop ecx
mov edi, 0x15098
mov esi, eax
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x115e3
mov ebx, 0x15f28
jmp 0x117f9
push 3
pop edx
mov ecx, edx
mov edi, 0x150ac
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x115ff
mov ebx, 0x160a0
jmp 0x117f9
mov ecx, edx
mov edi, 0x150b8
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x11618
mov ebx, 0x16218
jmp 0x117f9
push 2
pop ecx
mov edi, 0x150c4
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x11632
mov ebx, 0x16390
jmp 0x117f9
mov ecx, edx
mov edi, 0x150cc
mov esi, eax
xor ebx, ebx
repe cmpsw word [esi], word es:[edi]
jne 0x1164c
mov ebx, 0x16508
jmp 0x117f9
push 7
pop ecx
mov edi, 0x150d4
mov esi, eax
xor ebx, ebx
repe cmpsw word [esi], word es:[edi]
jne 0x11667
mov ebx, 0x16680
jmp 0x117f9
push 7
pop ecx
mov edi, 0x150e4
mov esi, eax
xor ebx, ebx
repe cmpsw word [esi], word es:[edi]
jne 0x11682
mov ebx, 0x167f8
jmp 0x117f9
mov ecx, edx
mov edi, 0x150f4
mov esi, eax
xor ebx, ebx
repe cmpsw word [esi], word es:[edi]
jne 0x1169c
mov ebx, 0x16970
jmp 0x117f9
push 7
pop ecx
mov edi, 0x150fc
mov esi, eax
xor ebx, ebx
repe cmpsw word [esi], word es:[edi]
jne 0x116b7
mov ebx, 0x16ae8
jmp 0x117f9
push 2
pop ecx
mov edi, 0x1510c
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x116d1
mov ebx, 0x16c60
jmp 0x117f9
push 2
pop ecx
mov edi, 0x15114
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x116eb
mov ebx, 0x16dd8
jmp 0x117f9
mov ecx, edx
mov edi, 0x1511c
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x11704
mov ebx, 0x16f50
jmp 0x117f9
push 4
pop ecx
mov edi, 0x15128
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x1171e
mov ebx, 0x170c8
jmp 0x117f9
push 4
pop ecx
mov edi, 0x15138
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x11738
mov ebx, 0x17240
jmp 0x117f9
push 5
pop ecx
mov edi, 0x15148
mov esi, eax
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x11753
mov ebx, 0x173b8
jmp 0x117f9
push 9
pop ecx
mov edi, 0x15154
mov esi, eax
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x1176e
mov ebx, 0x17530
jmp 0x117f9
push 6
pop edx
mov ecx, edx
mov edi, 0x15168
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x11787
mov ebx, 0x176a8
jmp 0x117f9
mov ecx, edx
mov edi, 0x15180
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x1179d
mov ebx, 0x17820
jmp 0x117f9
mov ecx, edx
mov edi, 0x15198
mov esi, eax
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
jne 0x117b3
mov ebx, 0x17998
jmp 0x117f9
mov ecx, edx
mov edi, 0x151b0
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x117c9
mov ebx, 0x17b10
jmp 0x117f9
push 7
pop ecx
mov edi, 0x151c8
mov esi, eax
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x117e1
mov ebx, 0x17c88
jmp 0x117f9
push 0xb
mov esi, eax
pop ecx
mov edi, 0x151d8
xor eax, eax
repe cmpsw word [esi], word es:[edi]
mov ebx, 0x17e00
je 0x117f9
mov ebx, eax
push 0x5f49415f
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret