Function at 0x17940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
call ebx
test al, al
je 0x17b86
mov esi, dword [ebp + 0x10]
push esi
call ebx
test al, al
je 0x17b86
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x1c]
push eax
call edi
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x1c]
push eax
mov dword [ebp - 0x44], ecx
push 0x20019
lea ecx, [ebp + 0xc]
xor ebx, ebx
push ecx
mov dword [ebp - 0x4c], 0x18
mov dword [ebp - 0x40], 0x240
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x48], edx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jl 0x17b8b
push esi
lea edx, [ebp - 0x14]
push edx
call edi
mov edx, dword [ebp + 0xc]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 2
lea ecx, [ebp - 0x14]
push ecx
push edx
call esi
cmp eax, 0xc0000034
je 0x17b6e
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x17b6e
add eax, 2
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ebx, eax
mov dword [ebp + 8], ebx
test ebx, ebx
jne 0x17a19
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop esi
mov eax, 0xc000009a
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
push ecx
push 0
push ebx
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 0xc]
push eax
push ebx
push 2
lea ecx, [ebp - 0x14]
push ecx
push edx
call esi
mov esi, eax
test esi, esi
jge 0x17a61
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 4], 1
jne 0x17b48
cmp dword [ebx + 8], 2
jbe 0x17b48
lea ecx, [ebx + 0xc]
push ecx
lea edx, [ebp - 0x24]
push edx
call edi
push 1
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
mov dword [ebp + 0x10], eax
test eax, eax
jl 0x17b4f
xor edx, edx
xor edi, edi
xor esi, esi
cmp dx, word [ebp - 0xc]
mov edx, dword [ebp - 8]
jae 0x17afd
mov ebx, dword [sym.imp.ntoskrnl.exe_strncpy]
nop
mov al, byte [edx + esi]
cmp al, 0x2c
je 0x17abb
cmp al, 0x20
jne 0x17af1
mov ecx, esi
sub ecx, edi
je 0x17af1
xor eax, eax
push ecx
add edx, edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
push edx
lea eax, [ebp - 0x34]
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x34]
push ecx
lea edi, [esi + 1]
call fcn.0001a870
push eax
call fcn.00017900
mov edx, dword [ebp - 8]
movzx eax, word [ebp - 0xc]
inc esi
cmp esi, eax
jb 0x17ab0
mov ebx, dword [ebp + 8]
lea eax, [edx + edi]
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x17b05
sub ecx, esi
je 0x17b3c
xor ecx, ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x17b23
lea ecx, [ebp - 0x34]
push ecx
call fcn.0001a870
push eax
call fcn.00017900
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
jmp 0x17b4f
mov dword [ebp + 0x10], 0xc000003e
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop esi
mov eax, 0xc0000034
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc