Function at 0x7401ac85
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x7405c794]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
and dword [eax], 0
mov esi, edx
push 4
mov ebx, ecx
xor edx, edx
mov ecx, 0x74002e78
pop edi
mov eax, dword [ebx + edx*4]
mov dword [ebp - 8], 0x74002ea8
cmp eax, dword [ecx + edx*4]
jne 0x7401accd
inc edx
cmp edx, edi
jne 0x7401acae
mov dword [esi], 0x7405c758
jmp 0x7401adad
mov edx, 0x74002e98
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401acec
inc ecx
cmp ecx, edi
jne 0x7401acd4
mov dword [esi], 0x7405c760
jmp 0x7401adad
mov edx, 0x74002e68
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401ad0b
inc ecx
cmp ecx, edi
jne 0x7401acf3
mov dword [esi], 0x7405c770
jmp 0x7401adad
mov edx, 0x74002f28
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401ad2a
inc ecx
cmp ecx, edi
jne 0x7401ad12
mov dword [esi], 0x7405c768
jmp 0x7401adad
mov edx, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401ad44
inc ecx
cmp ecx, edi
jne 0x7401ad2f
mov dword [esi], 0x7405c778
jmp 0x7401adb0
mov edx, 0x74002ec8
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401ad5a
inc ecx
cmp ecx, edi
jne 0x7401ad4b
jmp 0x7401ad72
mov edx, 0x74002eb8
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401ae9d
inc ecx
cmp ecx, edi
jne 0x7401ad61
push 0x74003284
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x7401ae9d
push 0x74003290
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x7401ae9d
push dword [ebp + 8]
mov ecx, edi
push esi
push ebx
call dword [0x74063138]
call edi
push 4
pop edi
mov edx, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x7401adc6
inc ecx
cmp ecx, edi
jne 0x7401adb2
xor eax, eax
jmp 0x7401aea5
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x74002d34
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7401adbf
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x740032a4
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7401ae8f
cmp dword [ebp - 0x10], edi
jne 0x7401ae8f
cmp dword [ebp - 8], edi
jne 0x7401ae8f
mov eax, dword [ebp - 0x14]
sub eax, 1
je 0x7401ae89
sub eax, 1
je 0x7401ae81
sub eax, 1
je 0x7401ae79
sub eax, 1
je 0x7401ae47
sub eax, 1
je 0x7401ae3f
sub eax, 1
jne 0x7401ae8f
mov dword [esi], 0x7405c770
jmp 0x7401ae8f
mov dword [esi], 0x7405c77c
jmp 0x7401ae8f
push 0x74003284
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x7401ae9d
push 0x74003290
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x7401ae9d
push dword [ebp + 8]
mov ecx, edi
push esi
push ebx
call dword [0x74063138]
call edi
jmp 0x7401ae8f
mov dword [esi], 0x7405c760
jmp 0x7401ae8f
mov dword [esi], 0x7405c768
jmp 0x7401ae8f
mov dword [esi], 0x7405c758
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7401adbf
and dword [esi], 0
mov eax, 0x80004002
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.74045bf0
mov esp, ebp
pop ebp
ret 4