Function at 0x719cb8ce
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
lea ebx, [esi + 0x34]
cmp dword [ebx], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
jne 0x719cb93c
lea eax, [ebp + 8]
push eax
push 0x20019
mov dword [ebp + 8], edi
call dword [sym.imp._CADVAPI.DLL_RegOpenCurrentUser]
test eax, eax
jne 0x719d31f2
push edi
push ebx
push edi
push 0x20019
push edi
push 0x719caf08
push edi
push 0x719caec0
push dword [ebp + 8]
call dword [sym.imp._CADVAPI.DLL_RegCreateKeyExA]
test eax, eax
jne 0x719cb9c4
push dword [ebp + 8]
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
lea eax, [esi + 0x38]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebx]
call dword [sym.imp._CADVAPI.DLL_RegQueryInfoKeyA]
test eax, eax
jne 0x719cb962
mov eax, dword [esi + 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x5c]
cmp eax, edi
jne 0x719d31fc
push edi
push edi
push edi
push edi
lea eax, [esi + 0x60]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebx]
mov dword [ebp - 4], eax
call dword [sym.imp._CADVAPI.DLL_RegQueryInfoKeyA]
test eax, eax
jne 0x719cb997
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, edi
ja 0x719d3215
lea eax, [esi + 0x38]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea ebx, [esi + 0x34]
push dword [ebx]
call dword [sym.imp._CADVAPI.DLL_RegQueryInfoKeyA]
test eax, eax
jne 0x719cb9c4
mov eax, dword [ebp - 0xc]
cmp eax, dword [esi + 0x38]
jne 0x719cb962
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x3c]
jne 0x719cb962
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push 0x271d
jmp 0x719d330a
push eax
push edi
push dword [0x719f7224]
call dword [sym.imp._CKERNEL.DLL_HeapFree]
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
jmp 0x719cb96d
imul eax, eax, 0x418
push eax
push 8
push dword [0x719f7224]
call dword [sym.imp._CKERNEL.DLL_HeapAlloc]
cmp eax, edi
mov dword [esi + 0x5c], eax
je 0x719d32f9
mov eax, dword [ebp - 4]
cmp dword [eax], edi
mov dword [ebp + 8], edi
jbe 0x719cb997
xor ebx, ebx
mov eax, dword [esi + 0x5c]
push edi
push edi
mov dword [ebp - 4], edi
mov dword [ebx + eax + 0x208], 0xff
mov eax, dword [esi + 0x5c]
lea ecx, [ebp - 4]
push ecx
add eax, ebx
push edi
lea ecx, [eax + 0x208]
push ecx
add eax, 8
push eax
push dword [ebp + 8]
push dword [esi + 0x34]
call dword [sym.imp._CADVAPI.DLL_RegEnumValueW]
test eax, eax
jne 0x719d32d5
inc eax
cmp dword [ebp - 4], eax
jne 0x719d32d5
mov ecx, dword [esi + 0x5c]
mov dword [ebx + ecx], eax
mov eax, dword [esi + 0x5c]
lea eax, [ebx + eax + 0x208]
inc dword [eax]
mov eax, dword [esi + 0x5c]
mov dword [ebx + eax + 0x40c], 0xff
mov eax, dword [esi + 0x5c]
add eax, ebx
lea ecx, [eax + 0x40c]
push ecx
lea ecx, [eax + 0x20c]
push ecx
push edi
push edi
add eax, 8
push eax
push dword [esi + 0x34]
call dword [sym.imp._CADVAPI.DLL_RegQueryValueExW]
test eax, eax
je 0x719d32df
mov eax, dword [esi + 0x5c]
mov dword [ebx + eax + 0x40c], edi
jmp 0x719d32df
mov eax, dword [esi + 0x5c]
mov dword [ebx + eax + 0x208], edi
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
add ebx, 0x418
cmp eax, dword [esi + 0x60]
jae 0x719cb997
jmp 0x719d3245
push dword [ebx]
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
mov eax, dword [ebp - 4]
mov dword [ebx], edi
mov dword [eax], edi
push 8
call dword [sym.imp._CKERNEL.DLL_SetLastError]
or eax, 0xffffffff
jmp 0x719cb9c6