Function at 0x719ca9f9
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [esi + 0x1c]
mov eax, dword [ebx]
cmp eax, 1
push edi
mov dword [ebp - 8], 0xc0000010
mov byte [ebp - 1], 0
jne 0x719cad0c
call fcn.719cb1f3
test al, al
je 0x719caacf
cmp dword [0x719f743c], 0
je 0x719caacf
mov edi, 0x719f7420
push edi
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
xor eax, eax
push eax
push eax
mov dword [ebp + 8], eax
push 4
lea eax, [ebp + 8]
push eax
mov eax, dword [esi + 0x48]
push dword [eax + 8]
push dword [0x719f743c]
call dword [sym.imp._CKERNEL.DLL_GetCurrentProcess]
push eax
call dword [sym.imp._Cntl.DLL_NtDuplicateObject]
test eax, eax
mov dword [ebp - 8], eax
jl 0x719d4af2
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
push 0x719f7420
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
push esi
mov word [esi + 2], 0x48
mov word [esi], 0x30
push dword [0x719f7400]
call dword [sym.imp._Cntl.DLL_NtReplyPort]
push esi
push 0
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapFree]
cmp byte [ebp - 1], 0
jne 0x719d4b1a
pop edi
pop esi
pop ebx
leave
ret 4
push 0x719f7488
jmp 0x719d4a28
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x719d4b01
jle 0x719d4b08
cmp eax, 3
jle 0x719d4abc
cmp eax, 5
jg 0x719d48bd
cmp dword [esi + 0x24], 0
je 0x719d4b08
mov edi, 0x719f7488
push edi
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
mov eax, dword [0x719f74a8]
mov ecx, 0x719f74a8
cmp eax, ecx
je 0x719cad5a
mov edx, dword [esi + 0x44]
cmp dword [eax + 0x30], edx
je 0x719d492f
mov eax, dword [eax]
cmp eax, ecx
jne 0x719cad4b
push 0x3c
push 8
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x719d493d
mov eax, dword [esi + 0x48]
add esi, 0x20
push 0xa
mov dword [ebx + 8], eax
lea edi, [ebx + 0xc]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x24]
dec eax
mov edi, dword [sym.imp._Cntl.DLL_NtDuplicateObject]
je 0x719caddb
dec eax
jne 0x719d4963
push 0
push 0
lea eax, [ebx + 0x14]
push 0x40000000
push eax
call dword [sym.imp._CKERNEL.DLL_GetCurrentProcess]
push eax
push dword [esi + 0x28]
mov eax, dword [esi + 0x48]
push dword [eax + 8]
call edi
test eax, eax
mov dword [ebp - 8], eax
jl 0x719caac5
push 0
push dword [ebx + 0x14]
call dword [sym.imp._Cntl.DLL_NtResetEvent]
test eax, eax
mov dword [ebp - 8], eax
jl 0x719caac5
xor eax, eax
cmp dword [esi + 0x38], eax
je 0x719cae0a
push eax
push eax
push 0x20019
lea eax, [ebx + 0x24]
push eax
call dword [sym.imp._CKERNEL.DLL_GetCurrentProcess]
push eax
push dword [esi + 0x38]
mov eax, dword [esi + 0x48]
push dword [eax + 8]
call edi
test eax, eax
mov dword [ebp - 8], eax
jl 0x719d4a09
mov eax, dword [0x719f745c]
lea edi, [esi + 0x1c]
cmp dword [edi], 5
sete byte [ebp - 2]
cmp byte [ebp - 2], 0
jne 0x719cae24
mov eax, dword [0x719f7438]
cmp dword [esi + 0x20], eax
jne 0x719d4a5d
xor eax, eax
cmp dword [esi + 0x38], eax
je 0x719cae80
push 1
push dword [0x719f7418]
mov dword [ebp - 0xc], eax
push 5
push 1
push dword [ebx + 0x24]
mov dword [ebp - 8], eax
call dword [sym.imp._CADVAPI.DLL_RegNotifyChangeKeyValue]
test eax, eax
jne 0x719d4a88
lea eax, [ebp - 0xc]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebx + 0x24]
call dword [sym.imp._CADVAPI.DLL_RegQueryInfoKeyA]
test eax, eax
jne 0x719cae80
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebp - 0xc]
jne 0x719d4aa7
movzx eax, byte [ebp - 2]
mov dword [ebx + 0x38], eax
mov eax, dword [0x719f74a8]
mov dword [ebx], eax
mov dword [ebx + 4], 0x719f74a8
mov dword [eax + 4], ebx
push 0x719f7488
mov dword [0x719f74a8], ebx
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esi + 0x20]
mov dword [eax], 0x103
mov esi, dword [ebp + 8]
jmp 0x719caa8d
cmp eax, 6
jne 0x719d4b08
push 0x719f7488
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
mov edi, dword [0x719f74a8]
mov eax, 0x719f74a8
cmp edi, eax
je 0x719d491e
mov edx, dword [esi + 0x44]
cmp dword [edi + 0x30], edx
mov ecx, dword [edi]
jne 0x719d48f2
mov ebx, dword [edi + 8]
cmp ebx, dword [esi + 0x48]
je 0x719d48fa
cmp ecx, eax
mov edi, ecx
je 0x719d491e
jmp 0x719d48e3
push 0xc0000120
push edi
call fcn.719c8f74
mov eax, dword [edi]
mov ecx, dword [edi + 4]
push edi
mov dword [ecx], eax
push 0
mov dword [eax + 4], ecx
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapFree]
xor eax, eax
lea edi, [esi + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x719f7488
jmp 0x719caa87
mov ebx, dword [eax + 8]
cmp ebx, dword [esi + 0x48]
jne 0x719cad54
jmp 0x719d4950
push edi
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
mov dword [ebp - 8], 0xc0000017
jmp 0x719d4b08
push edi
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
mov dword [ebp - 8], 0xc000020a
jmp 0x719d4b08
dec eax
je 0x719d49af
dec eax
je 0x719d498b
push 0x719f7488
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
push ebx
push 0
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapFree]
mov esi, dword [ebp + 8]
jmp 0x719d4b08
push 0
push 0
push 0x40000000
lea eax, [ebx + 0x14]
push eax
call dword [sym.imp._CKERNEL.DLL_GetCurrentProcess]
push eax
push dword [esi + 0x28]
mov eax, dword [esi + 0x48]
push dword [eax + 8]
call edi
jmp 0x719cadd0
push 0
push 0
push 0x40000000
lea eax, [ebx + 0x1c]
push eax
call dword [sym.imp._CKERNEL.DLL_GetCurrentProcess]
push eax
push dword [esi + 0x30]
mov eax, dword [esi + 0x48]
push dword [eax + 8]
call edi
test eax, eax
mov dword [ebp - 8], eax
jl 0x719caac5
mov eax, dword [esi + 0x28]
test eax, eax
je 0x719caddb
cmp eax, 0xffffffff
je 0x719caddb
push 0
push 0
lea eax, [ebx + 0x14]
push 0x40000000
push eax
call dword [sym.imp._CKERNEL.DLL_GetCurrentProcess]
push eax
push dword [esi + 0x28]
jmp 0x719cadb2
mov eax, dword [ebx + 0x10]
dec eax
dec eax
je 0x719d4a1a
dec eax
je 0x719d4a48
dec eax
jne 0x719caac5
push dword [ebx + 0x14]
call dword [sym.imp._CKERNEL.DLL_CloseHandle]
jmp 0x719caac5
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
push ebx
push 0
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapFree]
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0x719d4983
push dword [ebx + 0x1c]
mov esi, dword [sym.imp._CKERNEL.DLL_CloseHandle]
call esi
push dword [ebx + 0x14]
call esi
jmp 0x719caac5
push 0x719f7488
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
push 0
push ebx
call fcn.719c8f74
push ebx
push 0
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapFree]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x719caeb6
push 0x719f7488
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
push ebx
push 0
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapFree]
jmp 0x719caeb6
push 0
push ebx
call fcn.719c8f74
push 0x719f7488
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
jmp 0x719d4a70
push 0x719f73fc
call dword [sym.imp._CKERNEL.DLL_InterlockedIncrement]
cmp dword [0x719f73f0], 0
je 0x719d4ad6
mov byte [ebp - 1], 1
jmp 0x719d4b08
push 0x10
push esi
push 0x719e6009
call dword [sym.imp._Cntl.DLL_RtlQueueWorkItem]
test eax, eax
je 0x719caabe
mov byte [ebp - 1], 1
jmp 0x719d4b01
push edi
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0x719d4b08
mov dword [ebp - 8], 0xc00000a3
xor eax, eax
lea edi, [esi + 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x20], eax
jmp 0x719caa8d
call fcn.719c9be9
jmp 0x719caabe