Function at 0x4019d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0x200
xor ebx, ebx
push 1
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
cmp eax, ebx
jne 0x4019fb
mov eax, 0xc000009a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 0x2000000
call fcn.004012b0
mov esi, eax
cmp esi, ebx
jge 0x401a27
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push str.SoftwareBaofengStormPlayerReport
lea edx, [ebp - 0x28]
push edx
call esi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x38], edx
push 0xf003f
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], 0x40
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
cmp edi, ebx
jl 0x401b19
push str.CupidGuard
lea ecx, [ebp - 0x20]
push ecx
call esi
mov ecx, dword [ebp - 4]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea edx, [ebp - 8]
push edx
push ebx
push ebx
push 2
lea eax, [ebp - 0x20]
push eax
push ecx
mov dword [ebp - 8], ebx
call edi
mov esi, eax
cmp esi, 0xc0000034
jne 0x401aca
xor edx, edx
lea eax, [ebp - 0xc]
xchg dword [eax], edx
jmp 0x401b3f
cmp esi, 0xc0000023
jne 0x401b94
mov ecx, dword [ebp - 8]
push ecx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov esi, eax
cmp esi, ebx
je 0x4019ef
mov eax, dword [ebp - 8]
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push eax
push esi
push 2
lea ecx, [ebp - 0x20]
push ecx
push edx
call edi
mov edi, eax
cmp edi, ebx
jge 0x401b22
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
cmp dword [esi + 4], eax
jne 0x401b76
cmp dword [esi + 8], eax
jne 0x401b76
mov ecx, dword [esi + 0xc]
push ebx
push esi
mov dword [ebp - 0xc], ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea edx, [ebp - 0xc]
mov eax, 1
lock xadd dword [edx], eax
mov eax, dword [ebp - 4]
push 4
mov ecx, edx
push ecx
push 4
push ebx
lea edx, [ebp - 0x20]
push edx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ecx, dword [ebp - 4]
push ecx
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000004
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret