Function at 0x7592b53c
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x38
push 0x7592b888
call fcn.759264bd
push 0x7594d180
push 0x2001f
xor ebx, ebx
push ebx
push 0x75926438
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x7592b801
xor esi, esi
inc esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x30], ebx
cmp dword [0x7594d24c], ebx
jne 0x7593077a
mov eax, dword [ebp + 0x14]
mov dword [0x7594d0fc], eax
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x34]
push ecx
push 0x10003
push dword [ebp + 0xc]
call eax
test eax, eax
je 0x7592b5ae
cmp dword [ebp - 0x34], 0x6c
jne 0x7592b5ae
mov dword [ebp - 0x40], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x40], ebx
jne 0x759307b7
cmp dword [0x7594d0fc], ebx
je 0x7592b801
push 0xb38
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x7592b801
lea edi, [esi + 0xc]
push edi
call dword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
test eax, eax
jl 0x7593084f
call fcn.7592dc83
test eax, eax
je 0x759307d2
push 4
mov edi, 0x1000
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x2c], eax
cmp eax, ebx
je 0x75930840
push edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov ecx, 0x400
xor eax, eax
mov edi, dword [esi + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x4a0], eax
add eax, 0x400
mov dword [esi + 0x4ac], eax
add eax, 0x400
mov dword [esi + 0x4f4], eax
add eax, 0x400
mov dword [esi + 0x500], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
push eax
mov eax, dword [0x7594d0fc]
call dword [eax]
call fcn.7592db6b
test eax, eax
je 0x7592b7f6
call fcn.7592dcb5
mov dword [esi + 0x56c], eax
cmp dword [esi + 0x56c], ebx
je 0x759307d5
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
mov edi, 0x7592db38
push edi
push dword [0x7594d180]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x759307f5
push esi
call fcn.7592dd32
test eax, eax
je 0x7593081d
lea edx, [esi + 0x578]
mov ecx, 0x110
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x1d4]
mov dword [edx], eax
cmp eax, ebx
jne 0x75930824
mov eax, dword [0x7594d118]
cmp eax, ebx
je 0x7593082f
lea eax, [ebp - 0x48]
push eax
push 0x10001
push dword [esi + 4]
mov eax, dword [0x7594d0fc]
call dword [eax + 0x4c]
cmp dword [0x7594d118], ebx
je 0x7593085b
push ebx
push 0x75926564
push 0x75922808
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
test eax, eax
je 0x7593085b
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
mov edi, 0x75926544
push edi
push dword [0x7594d180]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7592b785
cmp dword [ebp - 0x20], ebx
je 0x75930866
dec dword [ebp - 0x20]
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push ebx
push edi
push dword [0x7594d180]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
push dword [esi + 4]
mov eax, dword [0x7594d0fc]
call dword [eax + 8]
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push ebx
push 0x7592b820
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x759308a2
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
call fcn.7592d225
lea edi, [esi + 0x9e0]
push edi
call fcn.7592cdc0
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push edi
call fcn.7592cf7f
push esi
call fcn.7592b8b5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x7594d110], eax
xor eax, eax
inc eax
call fcn.75926509
ret 0x14
mov dword [esi + 0x56c], ebx
jmp 0x7592b681
xor eax, eax
jmp 0x7592b7ee
cmp eax, ebx
jne 0x7592b700
jmp 0x7592b714
test eax, eax
je 0x7592b792
jmp 0x7592b739
push dword [ebp + 0x14]
call fcn.7593862d
mov dword [0x7594d0fc], eax
cmp eax, ebx
je 0x75930793
mov dword [ebp - 0x30], esi
jmp 0x7592b58a
mov dword [ebp - 0x30], ebx
jmp 0x7592b582
cmp dword [ebp - 0x30], ebx
jne 0x7592b5bb
push dword [ebp + 0x14]
call fcn.7593862d
mov dword [0x7594d0fc], eax
jmp 0x7592b5bb
push edi
jmp 0x75930849
call fcn.759375dd
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
push 0x8000
push ebx
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x7593084f
cmp dword [ebp - 0x24], 2
jne 0x7592b6bb
mov dword [ebp - 0x24], ebx
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push ebx
push edi
push dword [0x7594d180]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x7592b6bb
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x759307d5
mov dword [0x7594d118], ebx
jmp 0x7592b6f3
cmp dword [0x7594d24c], ebx
je 0x7592b805
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
call fcn.759375dd
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x7592b801
push esi
call fcn.75926f0e
jmp 0x7592b812
push edi
push dword [0x7594d180]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call edi
push 0x75929c00
push dword [0x7594d180]
call edi
push 4
push 0x75922eac
push 1
push ebx
push 0x75926564
push dword [0x7594d180]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x7592b792
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
push 0x7594d23c
lea eax, [ebp - 0x28]
push eax
push ebx
push 0x759308d4
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7592b7b4