Function at 0x15f34
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x40]
push eax
xor edi, edi
push 0x20019
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 0x240
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, edi
jl 0x16003
push ebx
push esi
push 0x19eb8
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp + 8]
push eax
push edi
push edi
push 2
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call esi
cmp eax, 0x80000005
je 0x15fba
cmp eax, 0xc0000023
je 0x15fba
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x15fff
push dword [ebp + 8]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, edi
jne 0x15fd5
mov esi, 0xc000009a
jmp 0x15faf
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20]
push ebx
push 2
push eax
push dword [ebp - 4]
call esi
cmp eax, edi
jge 0x16008
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push edi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret 4
cmp dword [ebx + 4], 2
je 0x16015
mov esi, 0xc000000d
jmp 0x15fee
mov si, word [ebx + 8]
mov eax, 0xfffe
mov word [ebp - 0x16], si
add si, ax
add ebx, 0xc
mov edi, 0x1b728
mov word [ebp - 0x18], si
mov dword [ebp - 0x14], ebx
mov ecx, 0x19eb6
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x16061
test dx, dx
je 0x1605d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x16061
add eax, 4
add ecx, 4
test dx, dx
jne 0x1603b
xor eax, eax
jmp 0x16066
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x16094
movzx eax, si
sub eax, 8
push eax
lea eax, [ebx + 8]
push eax
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x16080
mov esi, 0x19eac
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0x1c728
mov ecx, 0x19eb6
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x160c6
test dx, dx
je 0x160c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x160c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x160a0
xor eax, eax
jmp 0x160cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x160f8
movzx eax, word [ebp - 0x18]
sub eax, 8
push eax
lea eax, [ebx + 8]
push eax
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x160e6
mov esi, 0x19ea4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, 0x1df38
mov ecx, 0x19eb6
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1612a
test dx, dx
je 0x16126
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1612a
add eax, 4
add ecx, 4
test dx, dx
jne 0x16104
xor eax, eax
jmp 0x1612f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1615f
movzx eax, word [ebp - 0x18]
sub eax, 8
push eax
lea eax, [ebx + 8]
push eax
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x1614a
mov esi, 0x19e96
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0x1e738
mov ecx, 0x19eb6
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x16191
test dx, dx
je 0x1618d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x16191
add eax, 4
add ecx, 4
test dx, dx
jne 0x1616b
xor eax, eax
jmp 0x16196
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x161c8
movzx eax, word [ebp - 0x18]
sub eax, 8
push eax
lea eax, [ebx + 8]
push eax
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x161b1
push 5
pop ecx
mov esi, 0x19e80
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0x1bf28
mov ecx, 0x19eb6
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x161fa
test dx, dx
je 0x161f6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x161fa
add eax, 4
add ecx, 4
test dx, dx
jne 0x161d4
xor eax, eax
jmp 0x161ff
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1622e
movzx eax, word [ebp - 0x18]
sub eax, 8
push eax
lea eax, [ebx + 8]
push eax
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x1621a
mov esi, 0x19e76
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x1bb28
mov ecx, 0x19eb6
mov eax, esi
xor edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x16262
cmp dx, di
je 0x1625e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x16262
add eax, 4
add ecx, 4
cmp dx, di
jne 0x1623c
xor eax, eax
jmp 0x16267
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x16280
movzx eax, word [ebp - 0x18]
sub eax, 8
push eax
add ebx, 8
push ebx
push esi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push 0x19e70
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp + 8]
push eax
push edi
push edi
push 2
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0x80000005
je 0x162b2
cmp eax, 0xc0000023
jne 0x1631d
push dword [ebp + 8]
push edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov esi, eax
cmp esi, edi
je 0x1631d
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20]
push esi
push 2
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
push 0x19e6e
mov edi, 0x1c328
push edi
call dword [sym.imp.ntoskrnl.exe__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x16312
mov eax, dword [esi + 8]
mov ecx, eax
and ecx, 0xfffffffe
cmp ecx, 0x800
jae 0x16312
push eax
lea eax, [esi + 0xc]
push eax
push 0
push 0x400
push edi
call sub.ntoskrnl.exe_RtlUnicodeToMultiByteN
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edi, edi
push 0x20
lea eax, [ebp - 0x18]
mov dword [ebp - 0x38], eax
push 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x10000000
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 0x240
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
mov eax, dword [ebp - 0xc]
jl 0x16361
mov dword [0x1b724], eax
push edi
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [sym.imp.ntoskrnl.exe_IoFileObjectType]
push edi
push dword [ecx]
push 0x80000000
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
cmp eax, edi
jl 0x16388
mov ecx, dword [ebp - 0x10]
mov dword [0x1b720], ecx
mov ebx, dword [ebp - 8]
xor edi, edi
jmp 0x15fec