Function at 0x16a3c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x294d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x418], ecx
mov ecx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x414], ecx
xor ecx, ecx
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0x10]
cmp esi, ecx
je 0x16a8b
mov edx, 0x208
cmp word [esi + 2], dx
jae 0x16a8b
xor al, al
jmp 0x16d1f
push ebx
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x430]
push eax
mov ebx, 0x20019
push ebx
lea eax, [ebp - 0x408]
push eax
mov dword [ebp - 0x408], ecx
mov dword [ebp - 0x430], 0x18
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x424], 0x240
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x41c], ecx
call edi
test eax, eax
jge 0x16b2c
mov ecx, dword [ebp - 0x434]
xor eax, eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x430]
push eax
push ebx
lea eax, [ebp - 0x408]
push eax
mov dword [ebp - 0x430], 0x18
mov dword [ebp - 0x424], 0x240
mov dword [ebp - 0x428], ecx
call edi
test eax, eax
jl 0x16d1b
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp - 0x40c]
push eax
xor ebx, ebx
push ebx
push ebx
push 2
push dword [ebp - 0x418]
mov dword [ebp - 0x40c], ebx
push dword [ebp - 0x408]
call edi
cmp eax, 0xc0000034
je 0x16d0f
cmp dword [ebp - 0x40c], ebx
je 0x16d0f
add dword [ebp - 0x40c], 4
mov eax, 0x400
cmp dword [ebp - 0x40c], eax
jae 0x16d0f
push 0x3ff
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x403]
push ebx
push eax
mov byte [ebp - 0x404], bl
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
push 0x3fc
lea eax, [ebp - 0x404]
push eax
push 2
push dword [ebp - 0x418]
mov dword [ebp - 0x410], ebx
push dword [ebp - 0x408]
call edi
test eax, eax
jl 0x16d0f
mov eax, dword [ebp - 0x410]
add eax, 0xfffffff4
cmp eax, 0x1fc
ja 0x16d0f
mov ebx, dword [ebp - 0x3fc]
cmp ebx, eax
ja 0x16d0f
test esi, esi
je 0x16d80
mov edx, dword [ebp - 0x414]
test edx, edx
je 0x16c20
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x16c0d
sub eax, edi
sar eax, 1
lea edi, [eax + eax]
jmp 0x16c23
push 2
pop edi
movzx ecx, word [esi + 2]
lea eax, [ebx + edi + 2]
cmp eax, ecx
ja 0x16d0f
mov eax, dword [esi + 4]
push 0x22
pop ecx
mov word [eax], cx
test edx, edx
je 0x16c5a
mov eax, dword [esi + 4]
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esi + 4]
movzx eax, word [edx]
inc edx
mov word [ecx], ax
inc edx
inc ecx
inc ecx
test ax, ax
jne 0x16c4b
push dword [ebp - 0x3fc]
lea eax, [ebp - 0x3f8]
push eax
mov eax, dword [esi + 4]
add eax, edi
push eax
call sub.ntoskrnl.exe_memcpy
mov eax, dword [esi + 4]
add eax, dword [ebp - 0x3fc]
xor ecx, ecx
add esp, 0xc
mov word [eax + edi], cx
cmp dword [ebp + 0x1c], ecx
je 0x16d67
mov edx, dword [esi + 4]
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x16c95
sub eax, edi
sar eax, 1
mov ecx, eax
mov eax, dword [ebp + 0x1c]
lea edi, [eax + 2]
mov bx, word [eax]
inc eax
inc eax
test bx, bx
jne 0x16cab
sub eax, edi
movzx edi, word [esi + 2]
sar eax, 1
shr edi, 1
lea eax, [eax + ecx + 2]
cmp eax, edi
jae 0x16d0f
mov ebx, dword [ebp + 0x1c]
movzx eax, word [ebx]
push 0x5c
pop edi
cmp ax, di
je 0x16d2e
cmp ax, 0x2f
je 0x16d2e
lea eax, [ecx + ecx]
lea ecx, [eax + edx]
movzx edx, word [ecx - 2]
cmp dx, di
je 0x16cfd
cmp dx, 0x2f
je 0x16cfd
mov word [ecx], di
mov ecx, dword [esi + 4]
xor edx, edx
mov word [ecx + eax + 2], dx
push ebx
movzx eax, word [esi + 2]
push eax
push dword [esi + 4]
call fcn.00014966
test eax, eax
jge 0x16d67
push dword [ebp - 0x408]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.000223b6
leave
ret 0x18
lea eax, [edx + ecx*2 - 2]
movzx ecx, word [eax]
cmp cx, di
je 0x16d40
cmp cx, 0x2f
jne 0x16d45
xor ecx, ecx
mov word [eax], cx
movzx eax, word [esi + 2]
push ebx
push eax
push dword [esi + 4]
call fcn.00014966
test eax, eax
jl 0x16d0f
cmp dword [ebp - 0x414], 0
jne 0x16d67
push 0x22870
jmp 0x16cfe
mov eax, dword [esi + 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x16d6d
sub eax, edx
sar eax, 1
add eax, eax
mov word [esi], ax
push dword [ebp - 0x408]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, 1
jmp 0x16d1d