Function at 0x13730
Capabilities:
Complete processing asynchronous io request
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x11188]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 0x28]
push edi
mov edi, dword [ebx + 0x60]
lea ecx, [esi + 0x134]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
call dword [sym.imp.HAL.dll_ExAcquireFastMutex]
cmp byte [esi + 0xe], 0
je 0x1378a
cmp dword [edi + 0xc], 0x32c000
je 0x1378a
push ebx
push esi
call fcn.000106a4
mov ecx, dword [ebp - 0x28]
mov esi, eax
call dword [sym.imp.HAL.dll_ExReleaseFastMutex]
jmp 0x13c12
cmp byte [esi + 0xd], 0
je 0x137aa
mov ecx, dword [ebp - 0x28]
call dword [sym.imp.HAL.dll_ExReleaseFastMutex]
and dword [ebx + 0x1c], 0
mov esi, 0xc0000056
mov dword [ebx + 0x18], esi
jmp 0x13c08
cmp byte [esi + 0xc], 0
je 0x13a31
mov ecx, dword [edi + 0xc]
mov eax, 0x7c02c
cmp ecx, eax
mov dword [ebp - 0x20], ecx
ja 0x13877
je 0x1380a
sub ecx, 0x70000
je 0x13868
sub ecx, 0x24
je 0x13868
sub ecx, 0x3bc
je 0x13a12
sub ecx, 0x820
je 0x13ae9
sub ecx, 0x3c00
je 0x13868
sub ecx, 0x7818
jne 0x13a31
mov edi, dword [edi + 8]
cmp edi, 0x14
mov dword [ebp - 0x24], edi
jb 0x13a25
mov edi, dword [ebx + 0xc]
push edi
push esi
call fcn.00011818
test al, al
je 0x13a25
cmp dword [ebp - 0x20], 0x7c02c
jne 0x13868
cmp dword [ebp - 0x24], 0x1c
jb 0x13a25
mov ax, word [edi + 0x16]
movzx ecx, ax
lea ecx, [ecx + ecx + 0x18]
cmp dword [ebp - 0x24], ecx
jb 0x13a25
cmp word [edi + 0x14], 0x100
jae 0x13a25
cmp ax, 0x100
jae 0x13a25
push esi
push ebx
call fcn.0001078e
mov dword [ebp - 0x1c], eax
jmp 0x13bab
sub ecx, 0x2d0c00
je 0x13ae9
sub ecx, 0x3c00
je 0x13868
sub ecx, 0x1fb800
je 0x13a7f
sub ecx, 8
je 0x13a51
sub ecx, 4
jne 0x13a31
cmp dword [0xffdf02c0], 1
jne 0x13a31
mov eax, dword [ebp - 0x34]
test byte [eax + 0x20], 1
jne 0x138cb
mov dword [ebp - 0x1c], 0xc0000225
jmp 0x13bab
cmp dword [edi + 4], 6
jb 0x13a25
push 0x706f6c46
push 0x80
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edx, eax
test edx, edx
mov dword [ebp - 0x20], edx
jne 0x138fc
mov dword [ebp - 0x1c], 0xc000009a
jmp 0x13bab
push 0x20
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
movzx ecx, word [esi + 0xe4]
mov esi, dword [esi + 0xe8]
mov eax, ecx
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xe
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x2c], eax
xor eax, eax
xor esi, esi
lea edi, [ebp - 0x70]
rep stosd dword es:[edi], eax
push esi
lea eax, [ebp - 0x30]
push esi
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x70]
push eax
push 0x13698
push esi
mov word [ebp - 0x2e], 0x14
mov word [ebp - 0x30], si
mov dword [ebp - 0x6c], 0x24
mov dword [ebp - 0x68], edx
call dword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x1c], eax
jl 0x139bc
cmp word [ebp - 0x30], 4
jne 0x13a09
mov eax, dword [ebp - 0x2c]
mov cx, word [eax]
cmp cx, 0x41
jb 0x13a09
cmp cx, 0x5a
ja 0x13a09
cmp word [eax + 2], 0x3a
jne 0x13a09
mov esi, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x24]
push 0x20
pop eax
mov byte [esi], 1
mov word [esi + 2], 0x1c
mov dword [ebx + 0x1c], eax
cmp dword [ecx + 4], eax
mov dword [ebp - 0x38], esi
jae 0x139cb
mov dword [ebx + 0x1c], 6
mov dword [ebp - 0x1c], 0x80000005
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x13bab
push dword [ebp - 0x20]
push 0x136d4
push edi
call dword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea edi, [esi + 4]
push 6
pop ecx
mov esi, 0x13710
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x2c]
mov cx, word [eax]
mov eax, dword [ebp - 0x38]
mov word [eax + 0x1c], cx
mov word [eax + 0x1e], 0x3a
jmp 0x13bab
mov dword [ebp - 0x1c], 0xc0000225
jmp 0x139bc
cmp dword [0xffdf02c0], 1
jne 0x13a31
cmp dword [edi + 4], 1
jae 0x13868
mov dword [ebp - 0x1c], 0xc000000d
jmp 0x13bab
mov ecx, dword [ebp - 0x28]
call dword [sym.imp.HAL.dll_ExReleaseFastMutex]
inc byte [ebx + 0x23]
add dword [ebx + 0x60], 0x24
mov ecx, dword [esi + 8]
mov edx, ebx
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
jmp 0x13c14
cmp dword [edi + 4], 4
jb 0x13a25
mov edx, dword [ebx + 0xc]
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
mov ax, word [esi + 0xe4]
mov edi, dword [ebp - 0x24]
mov word [edx], ax
movzx eax, ax
lea ecx, [eax + 2]
cmp dword [edi + 4], ecx
jb 0x13aae
mov esi, dword [esi + 0xe8]
jmp 0x13ac7
cmp dword [esi + 0xf0], 0
je 0x13a25
cmp dword [edi + 4], 4
jb 0x13a25
mov edx, dword [ebx + 0xc]
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
mov ax, word [esi + 0xec]
mov edi, dword [ebp - 0x24]
mov word [edx], ax
movzx eax, ax
lea ecx, [eax + 2]
cmp dword [edi + 4], ecx
jae 0x13ac1
mov dword [ebp - 0x1c], 0x80000005
mov dword [ebx + 0x1c], 4
jmp 0x13bab
mov esi, dword [esi + 0xf0]
and dword [ebp - 0x1c], 0
mov ecx, eax
shr ecx, 2
lea edi, [edx + 2]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx eax, word [edx]
inc eax
inc eax
mov dword [ebx + 0x1c], eax
jmp 0x13bab
movzx eax, byte [esi + 0x92]
mov ecx, dword [0x1119c]
mov edi, dword [edi + 4]
cmp edi, 0x18
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x20], ecx
jae 0x13b15
mov dword [ebp - 0x1c], 0xc0000023
jmp 0x13bab
and dword [ebp - 0x1c], 0
mov edx, eax
sub edx, ecx
inc edx
lea ecx, [edx + edx*2]
shl ecx, 3
cmp edi, ecx
jae 0x13b3f
push 0x18
pop ecx
mov eax, edi
xor edx, edx
div ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0x80000005
lea eax, [eax + ecx - 1]
cmp byte [ebp - 0x20], al
mov edi, dword [ebx + 0xc]
ja 0x13bab
movzx esi, byte [ebp - 0x20]
sub al, byte [ebp - 0x20]
imul esi, esi, 0x1c
inc al
movzx eax, al
mov ecx, dword [0x11198]
mov ecx, dword [esi + ecx]
mov dword [edi + 8], ecx
mov ecx, dword [0x11198]
movzx ecx, byte [esi + ecx + 0x14]
and dword [edi + 4], 0
inc ecx
mov dword [edi], ecx
mov ecx, dword [0x11198]
movzx ecx, byte [esi + ecx + 0x17]
mov dword [edi + 0xc], ecx
mov ecx, dword [0x11198]
movzx ecx, byte [esi + ecx + 0xa]
mov dword [edi + 0x10], ecx
mov ecx, dword [0x11198]
movzx ecx, word [esi + ecx + 8]
mov dword [edi + 0x14], ecx
add dword [ebx + 0x1c], 0x18
add edi, 0x18
add esi, 0x1c
dec eax
jne 0x13b56
mov ecx, dword [ebp - 0x28]
call dword [sym.imp.HAL.dll_ExReleaseFastMutex]
mov esi, dword [ebp - 0x1c]
cmp esi, 0x103
je 0x13c12
test esi, esi
mov dword [ebx + 0x18], esi
jge 0x13c08
cmp esi, 0xc00000a3
je 0x13bfe
cmp esi, 0xc00000b5
je 0x13bfe
cmp esi, 0xc00000a2
je 0x13bfe
cmp esi, 0xc0000013
je 0x13bfe
cmp esi, 0x80000016
je 0x13bfe
cmp esi, 0xc0000014
je 0x13bfe
cmp esi, 0xc0000012
jne 0x13c08
push dword [ebp - 0x34]
push ebx
call dword [sym.imp.ntoskrnl.exe_IoSetHardErrorOrVerifyDevice]
mov ecx, ebx
xor dl, dl
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00010a23
leave
ret 8