Function at 0x74019d25
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
and dword [eax], 0
push ebx
push esi
push edi
push 4
mov esi, edx
mov ebx, ecx
mov ecx, 0x740025f8
xor edx, edx
pop edi
mov eax, dword [ebx + edx*4]
mov dword [ebp - 4], 0x74002628
cmp eax, dword [ecx + edx*4]
jne 0x74019d63
inc edx
cmp edx, edi
jne 0x74019d44
mov dword [esi], 0x74049ec0
jmp 0x74019e43
mov edx, 0x74002618
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019d82
inc ecx
cmp ecx, edi
jne 0x74019d6a
mov dword [esi], 0x74049ec8
jmp 0x74019e43
mov edx, 0x740025e8
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019da1
inc ecx
cmp ecx, edi
jne 0x74019d89
mov dword [esi], 0x74049ed8
jmp 0x74019e43
mov edx, 0x740026a8
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019dc0
inc ecx
cmp ecx, edi
jne 0x74019da8
mov dword [esi], 0x74049ed0
jmp 0x74019e43
mov edx, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019dda
inc ecx
cmp ecx, edi
jne 0x74019dc5
mov dword [esi], 0x74049ee0
jmp 0x74019e46
mov edx, 0x74002648
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019df0
inc ecx
cmp ecx, edi
jne 0x74019de1
jmp 0x74019e08
mov edx, 0x74002638
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019f34
inc ecx
cmp ecx, edi
jne 0x74019df7
push 0x74002a04
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x74019f34
push 0x74002a10
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x74019f34
push dword [ebp + 8]
mov ecx, edi
push esi
push ebx
call dword [0x74050130]
call edi
push 4
pop edi
mov edx, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebx + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x74019e5a
inc ecx
cmp ecx, edi
jne 0x74019e48
jmp 0x74019f30
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x740024b4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x74019f30
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x74002a24
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x74019f27
cmp dword [ebp - 0xc], edi
jne 0x74019f27
cmp dword [ebp - 4], edi
jne 0x74019f27
mov eax, dword [ebp - 0x10]
sub eax, 1
je 0x74019f21
sub eax, 1
je 0x74019f19
sub eax, 1
je 0x74019f11
sub eax, 1
je 0x74019edf
sub eax, 1
je 0x74019ed7
sub eax, 1
jne 0x74019f27
mov dword [esi], 0x74049ed8
jmp 0x74019f27
mov dword [esi], 0x74049ee4
jmp 0x74019f27
push 0x74002a04
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x74019f34
push 0x74002a10
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x74019f34
push dword [ebp + 8]
mov ecx, edi
push esi
push ebx
call dword [0x74050130]
call edi
jmp 0x74019f27
mov dword [esi], 0x74049ec8
jmp 0x74019f27
mov dword [esi], 0x74049ed0
jmp 0x74019f27
mov dword [esi], 0x74049ec0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x74019f3c
and dword [esi], 0
mov eax, 0x80004002
pop edi
pop esi
pop ebx
leave
ret 4