Function at 0x719e33d6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x719f7264]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x414], eax
mov eax, dword [ebp + 0xc]
cmp eax, edx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x420], edi
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x410], edx
jne 0x719e3427
xor ebx, ebx
inc ebx
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 0x410], ebx
jmp 0x719e346f
mov ecx, dword [eax]
cmp ecx, edx
je 0x719e35f0
cmp ecx, 6
jne 0x719e3440
mov dword [ebp - 0x40c], 1
cmp ecx, 0x11
jne 0x719e344f
mov dword [ebp - 0x410], 1
add eax, 4
mov ecx, dword [eax]
cmp ecx, edx
jne 0x719e3431
cmp dword [ebp - 0x40c], edx
jne 0x719e346c
cmp dword [ebp - 0x410], edx
je 0x719e35f0
xor ebx, ebx
inc ebx
push 0x719f7348
push esi
call fcn.719e4c7a
test eax, eax
je 0x719e348f
mov eax, dword [ebp - 0x414]
and word [edi], 0
mov dword [eax], ebx
jmp 0x719e36a8
mov eax, dword [esi]
and dword [ebp - 0x418], 0
mov edi, 0xffff0000
and eax, edi
cmp eax, 0x90000
jne 0x719e34fd
cmp word [esi + 4], 0
jne 0x719e34fd
cmp byte [esi + 8], 0xc0
jne 0x719e34fd
cmp byte [esi + 9], 0
jne 0x719e34fd
cmp byte [esi + 0xa], 0
jne 0x719e34fd
cmp byte [esi + 0xb], 0
jne 0x719e34fd
cmp byte [esi + 0xc], 0
jne 0x719e34fd
cmp byte [esi + 0xd], 0
jne 0x719e34fd
cmp byte [esi + 0xe], 0
jne 0x719e34fd
cmp byte [esi + 0xf], 0x46
jne 0x719e34fd
xor eax, eax
mov ax, word [esi]
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x418], ebx
push eax
call sub.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_9
mov ecx, dword [ebp - 0x420]
mov word [ecx], ax
mov eax, dword [esi]
and eax, edi
cmp eax, 0xa0000
jne 0x719e355c
xor edi, edi
cmp word [esi + 4], di
jne 0x719e355c
cmp byte [esi + 8], 0xc0
jne 0x719e355c
cmp byte [esi + 9], 0
jne 0x719e355c
cmp byte [esi + 0xa], 0
jne 0x719e355c
cmp byte [esi + 0xb], 0
jne 0x719e355c
cmp byte [esi + 0xc], 0
jne 0x719e355c
cmp byte [esi + 0xd], 0
jne 0x719e355c
cmp byte [esi + 0xe], 0
jne 0x719e355c
cmp byte [esi + 0xf], 0x46
jne 0x719e355c
xor eax, eax
mov ax, word [esi]
mov dword [ebp - 0x418], ebx
push eax
call sub.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_9
mov ecx, dword [ebp - 0x420]
mov word [ecx], ax
jmp 0x719e3562
mov edi, dword [ebp - 0x428]
xor eax, eax
cmp dword [ebp - 0x418], eax
je 0x719e358d
cmp edi, eax
je 0x719e3578
cmp dword [ebp - 0x40c], eax
jmp 0x719e357e
cmp dword [ebp - 0x410], eax
je 0x719e35f0
mov eax, dword [ebp - 0x414]
mov dword [eax], edi
jmp 0x719e36a8
push 0x200
lea eax, [ebp - 0x404]
push eax
push esi
call sym.MSWSOCK.dll_GetNameByTypeW
test eax, eax
jne 0x719e35f0
lea eax, [ebp - 0x204]
push 0x719e36c0
push eax
call dword [sym.imp._Cmvrt.DLL_wcscpy]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp._Cmvrt.DLL_wcscat]
add esp, 0x10
lea eax, [ebp - 0x41c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x204]
push eax
push reloc.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_2
call dword [sym.imp._CADVAPI.DLL_RegOpenKeyExW]
test eax, eax
je 0x719e35f8
or eax, 0xffffffff
jmp 0x719e36ae
mov esi, dword [sym.imp._CADVAPI.DLL_RegQueryValueExW]
xor edi, edi
or ebx, 0xffffffff
inc edi
cmp dword [ebp - 0x40c], 0
mov dword [ebp - 0x408], ebx
mov dword [ebp - 0x424], 4
je 0x719e3649
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
push 0x719c22a4
push dword [ebp - 0x41c]
call esi
cmp dword [ebp - 0x408], ebx
jne 0x719e3678
cmp dword [ebp - 0x410], 0
je 0x719e3678
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
push 0x719c224c
push dword [ebp - 0x41c]
call esi
xor edi, edi
push dword [ebp - 0x41c]
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
cmp dword [ebp - 0x408], ebx
je 0x719e36ac
mov eax, dword [ebp - 0x414]
push dword [ebp - 0x408]
mov dword [eax], edi
call sub.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_9
mov ecx, dword [ebp - 0x420]
mov word [ecx], ax
xor eax, eax
jmp 0x719e36ae
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.719c15f6
leave
ret 0x10