Function at 0x13fe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
call ebx
test al, al
je 0x14226
mov esi, dword [ebp + 0x10]
push esi
call ebx
test al, al
je 0x14226
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x1c]
push eax
call edi
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x1c]
push eax
mov dword [ebp - 0x44], ecx
push 0x20019
lea ecx, [ebp + 0xc]
xor ebx, ebx
push ecx
mov dword [ebp - 0x4c], 0x18
mov dword [ebp - 0x40], 0x240
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x48], edx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
jl 0x1422b
push esi
lea edx, [ebp - 0x14]
push edx
call edi
mov edx, dword [ebp + 0xc]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 2
lea ecx, [ebp - 0x14]
push ecx
push edx
call esi
cmp eax, 0xc0000034
je 0x1420e
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x1420e
add eax, 2
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ebx, eax
mov dword [ebp + 8], ebx
test ebx, ebx
jne 0x140b9
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop esi
mov eax, 0xc000009a
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
push ecx
push 0
push ebx
call sub.ntoskrnl.exe_memset
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 0xc]
push eax
push ebx
push 2
lea ecx, [ebp - 0x14]
push ecx
push edx
call esi
mov esi, eax
test esi, esi
jge 0x14101
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 4], 1
jne 0x141e8
cmp dword [ebx + 8], 2
jbe 0x141e8
lea ecx, [ebx + 0xc]
push ecx
lea edx, [ebp - 0x24]
push edx
call edi
push 1
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
mov dword [ebp + 0x10], eax
test eax, eax
jl 0x141ef
xor edx, edx
xor edi, edi
xor esi, esi
cmp dx, word [ebp - 0xc]
mov edx, dword [ebp - 8]
jae 0x1419d
mov ebx, dword [sym.imp.ntoskrnl.exe_strncpy]
nop
mov al, byte [edx + esi]
cmp al, 0x2c
je 0x1415b
cmp al, 0x20
jne 0x14191
mov ecx, esi
sub ecx, edi
je 0x14191
xor eax, eax
push ecx
add edx, edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
push edx
lea eax, [ebp - 0x34]
push eax
call ebx
add esp, 0xc
lea ecx, [ebp - 0x34]
push ecx
lea edi, [esi + 1]
call fcn.00015a00
push eax
call fcn.00013fa0
mov edx, dword [ebp - 8]
movzx eax, word [ebp - 0xc]
inc esi
cmp esi, eax
jb 0x14150
mov ebx, dword [ebp + 8]
lea eax, [edx + edi]
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x141a5
sub ecx, esi
je 0x141dc
xor ecx, ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x141c3
lea ecx, [ebp - 0x34]
push ecx
call fcn.00015a00
push eax
call fcn.00013fa0
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
jmp 0x141ef
mov dword [ebp + 0x10], 0xc000003e
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
pop esi
mov eax, 0xc0000034
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc