Function at 0x19af0
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1fb28]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x14
push 0xff
lea eax, [ebp - 0x18]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x18
push 0
lea eax, [ebp - 0x30]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x100
push 0xff
lea eax, [ebp - 0x130]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.ntoskrnl.exe_MmAddVerifierThunks]
and eax, 0xc00000ab
mov dword [ebp - 0x138], eax
mov eax, dword [0x1fb64]
mov dword [ebp - 0x13c], eax
xor eax, eax
mov word [ebp - 0x140], ax
jmp 0x19b94
movzx eax, word [ebp - 0x140]
add eax, 4
mov word [ebp - 0x140], ax
movzx eax, word [ebp - 0x140]
cmp eax, 0x1e8
jge 0x19c21
mov eax, dword [0x1c7c0]
mov ecx, dword [section..data]
sub ecx, dword [eax]
mov eax, dword [0x1c7c0]
mov edx, dword [section..data]
sub edx, dword [eax + 4]
shl edx, 0x10
or ecx, edx
mov dword [0x1fb30], ecx
push 0
push 0
push 1
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlSetDaclSecurityDescriptor]
xor eax, eax
cmp dword [ebp - 0x138], 0xc00000ab
setne al
dec eax
and eax, 0x2b2fbf7e
add eax, 0x9d36
add eax, dword [0x1fb30]
mov ecx, dword [ebp - 0x13c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x13c]
add eax, 4
mov dword [ebp - 0x13c], eax
mov eax, dword [0x1c7c0]
add eax, 8
mov dword [0x1c7c0], eax
jmp 0x19b83
mov eax, dword [0x1fb64]
add eax, 0x1e8
mov dword [ebp - 0x144], eax
mov dword [0x1e04c], 0xc
xor eax, eax
mov word [ebp - 0x140], ax
jmp 0x19c57
movzx eax, word [ebp - 0x140]
add eax, 4
mov word [ebp - 0x140], ax
movzx eax, word [ebp - 0x140]
cmp eax, 0x1e0
jge 0x19cdf
mov eax, dword [0x1c7c4]
mov ecx, dword [section..data]
sub ecx, dword [eax]
mov eax, dword [0x1c7c4]
mov edx, dword [section..data]
sub edx, dword [eax + 4]
shl edx, 0x10
or ecx, edx
mov dword [0x1fb30], ecx
xor eax, eax
cmp dword [ebp - 0x138], 0xc00000ab
setne al
dec eax
and eax, 0x53269c0
add eax, 0x137b
add eax, dword [0x1fb30]
mov ecx, dword [ebp - 0x144]
mov dword [ecx], eax
push 0xc0000033
call dword [sym.imp.ntoskrnl.exe_FsRtlIsTotalDeviceFailure]
mov eax, dword [ebp - 0x144]
add eax, 4
mov dword [ebp - 0x144], eax
mov eax, dword [0x1c7c4]
add eax, 8
mov dword [0x1c7c4], eax
jmp 0x19c46
mov eax, dword [0x1fb64]
add eax, 0x3c8
mov dword [ebp - 0x148], eax
xor eax, eax
mov word [ebp - 0x140], ax
jmp 0x19d0b
movzx eax, word [ebp - 0x140]
add eax, 4
mov word [ebp - 0x140], ax
movzx eax, word [ebp - 0x140]
cmp eax, 0x178
jge 0x19d92
mov eax, dword [ebx + 8]
mov ecx, dword [section..data]
sub ecx, dword [eax]
mov eax, dword [ebx + 8]
mov edx, dword [section..data]
sub edx, dword [eax + 4]
shl edx, 0x10
or ecx, edx
mov dword [0x1fb30], ecx
xor eax, eax
cmp dword [ebp - 0x138], 0xc00000ab
setne al
dec eax
and eax, 0x7e6302f5
add eax, 0x1129
add eax, dword [0x1fb30]
mov ecx, dword [ebp - 0x148]
mov dword [ecx], eax
mov eax, dword [ebp - 0x148]
add eax, 4
mov dword [ebp - 0x148], eax
push 0
push 0x26
push 0
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAcquireRemoveLockEx]
mov eax, dword [ebx + 8]
add eax, 8
mov dword [ebx + 8], eax
jmp 0x19cfa
mov eax, dword [0x1fb64]
add eax, 0x540
mov dword [ebp - 0x14c], eax
xor eax, eax
mov word [ebp - 0x140], ax
jmp 0x19dbe
movzx eax, word [ebp - 0x140]
add eax, 4
mov word [ebp - 0x140], ax
movzx eax, word [ebp - 0x140]
cmp eax, 0x1b0
jge 0x19e3b
mov eax, dword [0x1c7c8]
mov ecx, dword [section..data]
sub ecx, dword [eax]
mov eax, dword [0x1c7c8]
mov edx, dword [section..data]
sub edx, dword [eax + 4]
shl edx, 0x10
or ecx, edx
mov dword [0x1fb30], ecx
xor eax, eax
cmp dword [ebp - 0x138], 0xc00000ab
setne al
dec eax
and eax, 0x20814406
add eax, 0xcb35
add eax, dword [0x1fb30]
mov ecx, dword [ebp - 0x14c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14c]
add eax, 4
mov dword [ebp - 0x14c], eax
mov eax, dword [0x1c7c8]
add eax, 8
mov dword [0x1c7c8], eax
jmp 0x19dad
push 0
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.ntoskrnl.exe_MmProtectMdlSystemAddress]
mov eax, dword [0x1fb64]
add eax, 0x6f0
mov dword [ebp - 0x150], eax
xor eax, eax
mov word [ebp - 0x140], ax
jmp 0x19e76
movzx eax, word [ebp - 0x140]
add eax, 4
mov word [ebp - 0x140], ax
movzx eax, word [ebp - 0x140]
cmp eax, 0x1b8
jge 0x19ee1
mov eax, dword [0x1c7cc]
mov ecx, dword [section..data]
sub ecx, dword [eax]
mov eax, dword [0x1c7cc]
mov edx, dword [section..data]
sub edx, dword [eax + 4]
shl edx, 0x10
or ecx, edx
mov dword [0x1fb30], ecx
mov eax, dword [ebp - 0x138]
xor eax, 0xa82b8091
add eax, dword [0x1fb30]
mov ecx, dword [ebp - 0x150]
mov dword [ecx], eax
mov eax, dword [ebp - 0x150]
add eax, 4
mov dword [ebp - 0x150], eax
mov eax, dword [0x1c7cc]
add eax, 8
mov dword [0x1c7cc], eax
jmp 0x19e65
mov eax, dword [0x1ce04]
mov dword [0x1d77c], eax
push 0xc0000013
call dword [sym.imp.ntoskrnl.exe_FsRtlIsTotalDeviceFailure]
mov eax, dword [0x1fb64]
add eax, 0x8a8
mov dword [ebp - 0x154], eax
xor eax, eax
mov word [ebp - 0x140], ax
jmp 0x19f22
movzx eax, word [ebp - 0x140]
add eax, 4
mov word [ebp - 0x140], ax
movzx eax, word [ebp - 0x140]
cmp eax, 0x10c
jge 0x19fa7
push 0xa950
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
mov eax, dword [str.q7N]
mov eax, dword [eax]
mov dword [0x1fb30], eax
push 0x1b4cc
push 0xb514
call dword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
xor eax, eax
cmp dword [ebp - 0x138], 0xc00000ab
setne al
dec eax
and eax, 0x95d93ed4
add eax, 0x87b6
add eax, dword [0x1fb30]
mov ecx, dword [ebp - 0x154]
mov dword [ecx], eax
mov eax, dword [ebp - 0x154]
add eax, 4
mov dword [ebp - 0x154], eax
mov eax, dword [str.q7N]
add eax, 4
mov dword [str.q7N], eax
jmp 0x19f11
mov eax, dword [0x1fb64]
add eax, 0x9b4
mov dword [ebp - 0x214], eax
xor eax, eax
mov word [ebp - 0x140], ax
jmp 0x19fd3
movzx eax, word [ebp - 0x140]
add eax, 4
mov word [ebp - 0x140], ax
movzx eax, word [ebp - 0x140]
cmp eax, 0x124
jge 0x1a04b
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov dword [0x1fb30], eax
push 0x1b4cc
push 0xf705
call dword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
xor eax, eax
cmp dword [ebp - 0x138], 0xc00000ab
setne al
dec eax
and eax, 0xda01cd8b
add eax, 0x561c
add eax, dword [0x1fb30]
mov ecx, dword [ebp - 0x214]
mov dword [ecx], eax
mov eax, dword [ebp - 0x214]
add eax, 4
mov dword [ebp - 0x214], eax
push 0xc0000025
call dword [sym.imp.ntoskrnl.exe_FsRtlIsTotalDeviceFailure]
mov eax, dword [ebx + 0xc]
add eax, 4
mov dword [ebx + 0xc], eax
jmp 0x19fc2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0001b452
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8