Function at 0x75bb9205
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa
pop edi
mov dword [ebp - 0x3c], ecx
xor esi, esi
lea eax, [ebp - 0x18]
push 0x75bb969c
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x34], 0x75bc8fe0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], eax
call fcn.759c6e99
push 1
lea ecx, [ebp - 0x48]
call fcn.759b87f0
lea eax, [ebp - 0x30]
mov ebx, 0x20019
push eax
mov dword [ebp - 0x30], ebx
call fcn.759b172f
pop ecx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x30]
push esi
mov esi, 0x75bb9610
push esi
push dword [0x75bce540]
call dword [0x75bcc908]
test eax, eax
je 0x75bb92ea
push eax
push 0x840
call fcn.75a20457
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
mov ebx, eax
call fcn.759b87d1
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x20], edi
jle 0x75bb92b7
push dword [ebp - 0x24]
call fcn.759c6f79
pop ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x75bb92d8
cmp eax, dword [0x75bce53c]
je 0x75bb92d8
push eax
call esi
cmp dword [ebp - 0x28], 0
je 0x75bb92e3
push dword [ebp - 0x28]
call esi
mov eax, ebx
jmp 0x75bb95a4
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x40]
push eax
push 0
lea eax, [ebp - 0x4c]
push eax
push 0
push 0x75bb95ec
push dword [ebp - 0x28]
call edi
test eax, eax
je 0x75bb93d4
push esi
lea ecx, [ebp - 0x30]
call fcn.759c6e99
push 0x75bb967c
lea ecx, [ebp - 0x30]
call fcn.759ca705
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x30]
call fcn.759c7add
push 0x75bb95fc
lea ecx, [ebp - 0x34]
call fcn.759c8365
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
lea ecx, [ebp - 0x2c]
push ecx
push ebx
xor ebx, ebx
push ebx
push eax
push dword [0x75bce540]
call dword [0x75bcc908]
cmp eax, ebx
je 0x75bb93c9
push eax
push 0x840
call fcn.75a20457
pop ecx
pop ecx
mov edi, eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x48]
call fcn.759b87d1
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x20], 0xa
jle 0x75bb9397
push dword [ebp - 0x24]
call fcn.759c6f79
pop ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x75bb93b8
cmp eax, dword [0x75bce53c]
je 0x75bb93b8
push eax
call esi
cmp dword [ebp - 0x28], ebx
je 0x75bb93c2
push dword [ebp - 0x28]
call esi
mov eax, edi
jmp 0x75bb95a4
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x75bb93f7
push 0x75bb9688
lea ecx, [ebp - 0x34]
call fcn.759c8365
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x34]
call fcn.759c7add
mov eax, dword [0x75bce53c]
mov dword [ebp - 0x2c], eax
xor ebx, ebx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
lea ecx, [ebp - 0x40]
push ecx
push ebx
lea ecx, [ebp - 0x4c]
push ecx
push ebx
push eax
push dword [ebp - 0x2c]
call edi
cmp eax, ebx
je 0x75bb9428
push eax
push 0x840
call fcn.75a20457
pop ecx
pop ecx
mov edi, eax
jmp 0x75bb9377
push dword [ebp - 0x40]
lea ecx, [ebp - 0x24]
call fcn.75bb8fc2
mov esi, dword [ebp - 0x24]
cmp esi, ebx
jne 0x75bb943e
push 0xe
jmp 0x75bb9415
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
lea ecx, [ebp - 0x40]
push ecx
push esi
lea ecx, [ebp - 0x4c]
push ecx
push ebx
push eax
push dword [ebp - 0x2c]
call edi
cmp eax, ebx
jne 0x75bb9414
mov esi, dword [ebp - 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x75bb94d7
push esi
lea ecx, [ebp - 0x50]
call fcn.759c6e99
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esi + edi*2 + 2]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x75bb95c8
push esi
call edi
test eax, eax
jne 0x75bb94a4
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30]
mov dword [eax + 0x64], ecx
jmp 0x75bb94d0
push 0x75bb95b8
push esi
call edi
test eax, eax
jne 0x75bb94bb
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30]
mov dword [eax + 0x68], ecx
jmp 0x75bb94d0
push 0x75bb95d4
push esi
call edi
test eax, eax
jne 0x75bb94d0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30]
mov dword [eax + 0x6c], ecx
push esi
call ebx
lea esi, [esi + eax*2 + 2]
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x75bb9466
mov eax, dword [ebp - 0x3c]
push dword [eax + 0x64]
add eax, 0x28
push 0x75bb9680
push 0x1e
push eax
call fcn.759b4c31
add esp, 0x10
test eax, eax
jge 0x75bb9556
push eax
push 0x840
call fcn.75a20457
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
mov edi, eax
call fcn.759b87d1
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x20], 0xa
jle 0x75bb952c
push dword [ebp - 0x24]
call fcn.759c6f79
pop ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x75bb954d
cmp eax, dword [0x75bce53c]
je 0x75bb954d
push eax
call esi
cmp dword [ebp - 0x28], 0
jmp 0x75bb93bb
lea ecx, [ebp - 0x48]
call fcn.759b87d1
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x20], 0xa
jle 0x75bb9576
push dword [ebp - 0x24]
call fcn.759c6f79
pop ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x75bb9597
cmp eax, dword [0x75bce53c]
je 0x75bb9597
push eax
call esi
cmp dword [ebp - 0x28], 0
je 0x75bb95a2
push dword [ebp - 0x28]
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret