Function at 0x74019ce5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
and dword [eax], 0
push ebx
push esi
push edi
push 4
mov esi, edx
mov ebx, ecx
mov ecx, 0x740025f8
xor edx, edx
pop edi
mov eax, dword [ebx + edx*4]
mov dword [ebp - 4], 0x74002628
cmp eax, dword [ecx + edx*4]
jne 0x74019d23
inc edx
cmp edx, edi
jne 0x74019d04
mov dword [esi], 0x74049ec0
jmp 0x74019e03
mov edx, 0x74002618
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019d42
inc ecx
cmp ecx, edi
jne 0x74019d2a
mov dword [esi], 0x74049ec8
jmp 0x74019e03
mov edx, 0x740025e8
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019d61
inc ecx
cmp ecx, edi
jne 0x74019d49
mov dword [esi], 0x74049ed8
jmp 0x74019e03
mov edx, 0x740026a8
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019d80
inc ecx
cmp ecx, edi
jne 0x74019d68
mov dword [esi], 0x74049ed0
jmp 0x74019e03
mov edx, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019d9a
inc ecx
cmp ecx, edi
jne 0x74019d85
mov dword [esi], 0x74049ee0
jmp 0x74019e06
mov edx, 0x74002648
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019db0
inc ecx
cmp ecx, edi
jne 0x74019da1
jmp 0x74019dc8
mov edx, 0x74002638
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019ef4
inc ecx
cmp ecx, edi
jne 0x74019db7
push 0x74002a04
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x74019ef4
push 0x74002a10
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x74019ef4
push dword [ebp + 8]
mov ecx, edi
push esi
push ebx
call dword [0x74050130]
call edi
push 4
pop edi
mov edx, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019e1a
inc ecx
cmp ecx, edi
jne 0x74019e08
jmp 0x74019ef0
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x740024b4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x74019ef0
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x74002a24
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x74019ee7
cmp dword [ebp - 0xc], edi
jne 0x74019ee7
cmp dword [ebp - 4], edi
jne 0x74019ee7
mov eax, dword [ebp - 0x10]
sub eax, 1
je 0x74019ee1
sub eax, 1
je 0x74019ed9
sub eax, 1
je 0x74019ed1
sub eax, 1
je 0x74019e9f
sub eax, 1
je 0x74019e97
sub eax, 1
jne 0x74019ee7
mov dword [esi], 0x74049ed8
jmp 0x74019ee7
mov dword [esi], 0x74049ee4
jmp 0x74019ee7
push 0x74002a04
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x74019ef4
push 0x74002a10
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x74019ef4
push dword [ebp + 8]
mov ecx, edi
push esi
push ebx
call dword [0x74050130]
call edi
jmp 0x74019ee7
mov dword [esi], 0x74049ec8
jmp 0x74019ee7
mov dword [esi], 0x74049ed0
jmp 0x74019ee7
mov dword [esi], 0x74049ec0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x74019efc
and dword [esi], 0
mov eax, 0x80004002
pop edi
pop esi
pop ebx
leave
ret 4