Function at 0x1b130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0xc], ebx
cmp eax, ebx
je 0x1b146
mov byte [eax], bl
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov eax, 0x400
push eax
xor ecx, ecx
push 1
mov word [ebp - 0x12], ax
mov word [ebp - 0x14], cx
call esi
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x1b3bb
movzx edx, word [ebp - 0x12]
push edi
push edx
push ebx
push eax
call sub.ntoskrnl.exe_memset
mov edi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
add esp, 0xc
push str.REGISTRYMACHINESOFTWAREClassesCLSID_
lea eax, [ebp - 0x14]
push eax
call edi
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x14]
push edx
call edi
push str.InprocServer32
lea eax, [ebp - 0x14]
push eax
call edi
lea edx, [ebp - 0x34]
push edx
push 0x20019
lea eax, [ebp - 4]
lea ecx, [ebp - 0x14]
push eax
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], 0x240
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov edi, eax
cmp edi, ebx
push ebx
jge 0x1b1ed
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, dword [ebp - 4]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 2
lea ecx, [ebp - 0x1c]
push ecx
push edx
call edi
cmp eax, 0xc0000034
je 0x1b398
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x1b398
add eax, 2
push eax
push ebx
mov dword [ebp - 8], eax
call esi
mov ebx, eax
test ebx, ebx
jne 0x1b258
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 0x10]
push ebx
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
pop esi
mov eax, 0xc000009a
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 8]
push edx
push 0
push ebx
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 8]
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push ecx
push ebx
push 2
lea edx, [ebp - 0x1c]
push edx
push eax
call edi
mov dword [ebp + 8], eax
test eax, eax
jge 0x1b2ac
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
push ebx
call edi
mov edx, dword [ebp - 0x10]
push 0
push edx
call edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 4], 1
jne 0x1b347
mov eax, dword [ebx + 8]
cmp eax, 2
jbe 0x1b347
add eax, 8
push eax
push 0
call esi
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x1b33e
mov eax, dword [ebx + 8]
add eax, 8
push eax
push 0
push edi
call sub.ntoskrnl.exe_memset
lea eax, [ebx + 0xc]
add esp, 0xc
cmp byte [eax], 0x5c
jne 0x1b2fd
mov ecx, dword [ebx + 8]
push ecx
push eax
push edi
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
jmp 0x1b34e
mov edx, dword [0x20788]
mov dword [edi], edx
mov ecx, dword [0x2078c]
mov dword [edi + 4], ecx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1b310
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1b320
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x1b34e
mov dword [ebp + 8], 0xc000009a
jmp 0x1b34e
mov dword [ebp + 8], 0xc000003e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov edi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
push ebx
call edi
cmp dword [ebp + 8], 0
mov esi, dword [ebp - 0xc]
jl 0x1b37b
mov eax, dword [ebp + 0xc]
push 0
push eax
push esi
call fcn.0001aff0
mov dword [ebp + 8], eax
test esi, esi
je 0x1b384
push 0
push esi
call edi
mov ecx, dword [ebp - 0x10]
push 0
push ecx
call edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 0x10]
push ebx
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
pop edi
pop esi
mov eax, 0xc0000034
pop ebx
mov esp, ebp
pop ebp
ret 8
pop esi
mov eax, 0xc000009a
pop ebx
mov esp, ebp
pop ebp
ret 8