Function at 0x75e7b33f
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push eax
push 0x2000000
mov dword [ebp - 0x30], esi
call dword [sym.imp.ntdll.dll_RtlOpenCurrentUser]
test eax, eax
jge 0x75e7b37d
push 0x75e748b0
push 9
push esi
call fcn.75e46dea
jmp 0x75e7b5ec
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push ebx
push edi
push 0x75e7b658
lea eax, [ebp - 0x38]
push eax
call esi
mov eax, dword [ebp - 0x3c]
mov edi, dword [sym.imp.ntdll.dll_NtOpenKey]
and dword [ebp - 0x48], 0
and dword [ebp - 0x44], 0
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x58]
push eax
mov ebx, 0xf003f
push ebx
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x58], 0x18
mov dword [ebp - 0x4c], 0x40
call edi
test eax, eax
lea eax, [ebp - 0x38]
jl 0x75e7b44e
push 0x75e7b654
push eax
call esi
lea eax, [ebp - 0x5c]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 2
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
cmp eax, 0x80000005
jne 0x75e7b3f9
xor eax, eax
test eax, eax
jl 0x75e7b414
mov esi, dword [ebp - 0x30]
push 8
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.75e619a2
xor eax, eax
mov word [esi + 0x10], ax
jmp 0x75e7b423
push 0x75e748b0
push 9
push dword [ebp - 0x30]
call fcn.75e46dea
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.ntdll.dll_NtClose]
call esi
push dword [ebp - 0x3c]
call esi
mov eax, dword [0x75ea0138]
test byte [eax], 4
je 0x75e7b5ea
push dword [ebp - 0x30]
call fcn.75e7ac0f
jmp 0x75e7b5ea
push 0x75e7b634
push eax
call esi
mov eax, dword [ebp - 0x3c]
and dword [ebp - 0x48], 0
and dword [ebp - 0x44], 0
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x58]
push eax
push ebx
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x58], 0x18
mov dword [ebp - 0x4c], 0x40
call edi
push dword [ebp - 0x3c]
mov edi, dword [sym.imp.ntdll.dll_NtClose]
mov ebx, eax
call edi
test ebx, ebx
jge 0x75e7b4a8
push 0x75e748b0
push 9
push dword [ebp - 0x30]
call fcn.75e46dea
jmp 0x75e7b5ea
push 0x75e7b624
lea eax, [ebp - 0x38]
push eax
call esi
lea eax, [ebp - 0x5c]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 2
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
cmp eax, 0x80000005
jne 0x75e7b4d5
xor eax, eax
test eax, eax
jl 0x75e7b5d6
mov ebx, dword [ebp - 0x30]
push 8
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.75e619a2
xor eax, eax
mov word [ebx + 0x10], ax
mov eax, dword [0x75ea0138]
test byte [eax], 4
je 0x75e7b52e
push 0x10
push 0
push ebx
call sub.ntdll.dll_wcstoul
and eax, 0x3ff
add esp, 0xc
cmp ax, 0x11
jne 0x75e7b51b
push 0x75e7b610
jmp 0x75e7b526
cmp ax, 0x12
jne 0x75e7b52e
push 0x75e7b5fc
push 9
push ebx
call fcn.75e46dea
push 0x75e74734
lea eax, [ebp - 0x38]
push eax
call esi
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x50], eax
xor eax, eax
lea ecx, [ebp - 0x60]
push ecx
push eax
push eax
push eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push eax
push 0x2000f
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x58], 0x18
mov dword [ebp - 0x4c], 0x40
call dword [sym.imp.ntdll.dll_NtCreateKey]
test eax, eax
jl 0x75e7b5e5
push 0x75e7b654
lea eax, [ebp - 0x38]
push eax
call esi
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x75e7b589
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
jge 0x75e7b5bc
push dword [ebp - 0x2c]
call edi
push dword [ebp - 0x40]
jmp 0x75e7b5e8
push 0x75e7b624
lea eax, [ebp - 0x38]
push eax
call esi
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
jmp 0x75e7b5b2
push 0x75e748b0
push 9
push dword [ebp - 0x30]
call fcn.75e46dea
push dword [ebp - 0x2c]
call edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.75e36120
leave
ret 4