Function at 0x137ee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
inc eax
inc eax
push eax
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov edx, eax
test edx, edx
mov dword [ebp + 8], edx
jne 0x1381c
mov eax, 0xc000009a
jmp 0x13a50
movzx ecx, word [ebx]
push esi
mov esi, dword [ebx + 4]
push edi
mov eax, ecx
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx eax, word [ebx]
push 0x4d
xor ebx, ebx
mov word [eax + edx], bx
pop ecx
xor eax, eax
mov esi, 0x16978
lea edi, [ebp - 0x134]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x104], esi
mov esi, 0x16788
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0xe8], esi
mov esi, 0x16940
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xcc], esi
mov esi, 0x16950
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0xb0], esi
mov esi, 0x16948
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x94], esi
push 0x20
pop ecx
mov esi, 0x16944
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x78], esi
mov esi, section..data
push 4
pop eax
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x5c], esi
mov esi, 0x16934
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], 1
mov dword [ebp - 0x12c], 0x1365a
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], 0x13672
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xf8], ecx
mov dword [ebp - 0xf4], 0x13696
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], 0x136ba
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xbc], 0x136e6
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], 0x1370a
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], 0x1372a
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], 0x1374e
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], 0x1377e
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], esi
push ebx
push ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0x34], ecx
mov ecx, 0x16988
push edx
push ebx
mov dword [ebp - 0x30], 0x137a2
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], ecx
call dword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
push ebx
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [0x16788]
cmp eax, 0x100
pop edi
pop esi
ja 0x139eb
cmp eax, 8
jae 0x139f5
mov dword [0x16788], 0x40
mov eax, dword [0x16940]
cmp eax, 0x8000
mov ecx, 0x1000
ja 0x13a1b
cmp eax, ecx
jb 0x13a1b
add eax, 0xfff
and eax, 0xfffff000
mov dword [0x16940], eax
jmp 0x13a21
mov dword [0x16940], ecx
mov ecx, dword [0x16944]
mov eax, 0x101
cmp ecx, eax
ja 0x13a35
cmp ecx, 0x1f
jae 0x13a3a
mov dword [0x16944], eax
mov ecx, dword [0x16948]
cmp ecx, eax
ja 0x13a49
cmp ecx, 0x1f
jae 0x13a4e
mov dword [0x16948], eax
xor eax, eax
pop ebx
leave
ret 4