Function at 0x7401a6ab
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
and dword [eax], 0
push ebx
push esi
push edi
push 4
mov esi, edx
mov ebx, ecx
mov ecx, 0x74002608
xor edx, edx
pop edi
mov eax, dword [ebx + edx*4]
mov dword [ebp - 4], 0x74002638
cmp eax, dword [ecx + edx*4]
jne 0x7401a6e9
inc edx
cmp edx, edi
jne 0x7401a6ca
mov dword [esi], 0x7404aeb8
jmp 0x7401a7c9
mov edx, 0x74002628
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401a708
inc ecx
cmp ecx, edi
jne 0x7401a6f0
mov dword [esi], 0x7404aec0
jmp 0x7401a7c9
mov edx, 0x740025f8
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401a727
inc ecx
cmp ecx, edi
jne 0x7401a70f
mov dword [esi], 0x7404aed0
jmp 0x7401a7c9
mov edx, 0x740026b8
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401a746
inc ecx
cmp ecx, edi
jne 0x7401a72e
mov dword [esi], 0x7404aec8
jmp 0x7401a7c9
mov edx, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401a760
inc ecx
cmp ecx, edi
jne 0x7401a74b
mov dword [esi], 0x7404ae58
jmp 0x7401a7cc
mov edx, 0x74002658
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401a776
inc ecx
cmp ecx, edi
jne 0x7401a767
jmp 0x7401a78e
mov edx, 0x74002648
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401a8ba
inc ecx
cmp ecx, edi
jne 0x7401a77d
push 0x74002a14
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x7401a8ba
push 0x74002a20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x7401a8ba
push dword [ebp + 8]
mov ecx, edi
push esi
push ebx
call dword [0x74051130]
call edi
push 4
pop edi
mov edx, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401a7e0
inc ecx
cmp ecx, edi
jne 0x7401a7ce
jmp 0x7401a8b6
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x740024c4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7401a8b6
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x74002a34
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7401a8ad
cmp dword [ebp - 0xc], edi
jne 0x7401a8ad
cmp dword [ebp - 4], edi
jne 0x7401a8ad
mov eax, dword [ebp - 0x10]
sub eax, 1
je 0x7401a8a7
sub eax, 1
je 0x7401a89f
sub eax, 1
je 0x7401a897
sub eax, 1
je 0x7401a865
sub eax, 1
je 0x7401a85d
sub eax, 1
jne 0x7401a8ad
mov dword [esi], 0x7404aed0
jmp 0x7401a8ad
mov dword [esi], 0x7404ae54
jmp 0x7401a8ad
push 0x74002a14
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x7401a8ba
push 0x74002a20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x7401a8ba
push dword [ebp + 8]
mov ecx, edi
push esi
push ebx
call dword [0x74051130]
call edi
jmp 0x7401a8ad
mov dword [esi], 0x7404aec0
jmp 0x7401a8ad
mov dword [esi], 0x7404aec8
jmp 0x7401a8ad
mov dword [esi], 0x7404aeb8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x7401a8c2
and dword [esi], 0
mov eax, 0x80004002
pop edi
pop esi
pop ebx
leave
ret 4