Function at 0x755565ef
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x48
push 0x75561ac8
call fcn.75558b08
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x20], bl
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x755568c8
cmp dword [ebp + 0xc], 0x3e7
ja 0x755568c8
cmp eax, ebx
je 0x755568c8
cmp dword [ebp + 0x10], ebx
jne 0x755568c8
mov ecx, dword [ebp + 0x14]
test ecx, 0xfffffff8
jne 0x755568c1
mov dword [ebp - 0x44], ecx
and dword [ebp - 0x44], 1
je 0x75556678
test cl, 2
jne 0x755568c1
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x7555667b
sub eax, esi
mov dword [ebp - 0x48], eax
lea edi, [eax + 0x33]
push edi
push 0x40
mov esi, dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalAlloc]
call esi
mov dword [ebp - 0x34], eax
cmp eax, ebx
jne 0x755566a3
push 8
jmp 0x755568ca
push str.SOFTWAREMicrosoftCryptographyDefaultsProvider
push edi
push eax
call sub.ntdll.dll_strcpy_s
mov eax, dword [ebp - 0x34]
mov byte [eax + 0x31], 0x5c
push dword [ebp - 0x40]
add edi, 0xffffffce
push edi
add eax, 0x32
push eax
call sub.ntdll.dll_strcpy_s
add esp, 0x18
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push ebx
push dword [ebp - 0x34]
push 0x80000002
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExA
cmp eax, ebx
jne 0x755568c8
mov dword [ebp - 0x50], 4
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push 0x75551314
push dword [ebp - 0x2c]
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExA
cmp eax, ebx
je 0x75556713
push eax
jmp 0x755568ca
mov edi, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x4c]
jne 0x755568c8
push dword [ebp - 0x2c]
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey
cmp eax, ebx
je 0x7555673a
push eax
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
mov dword [ebp - 0x2c], ebx
jmp 0x755568d0
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x44], ebx
je 0x755567e3
mov eax, str.SOFTWAREMicrosoftCryptographyDefaultsProvider_TypesType
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x7555674e
sub eax, edi
lea edi, [eax + 6]
push edi
push 0x40
call esi
mov esi, eax
mov dword [ebp - 0x38], esi
cmp esi, ebx
je 0x7555669c
push str.SOFTWAREMicrosoftCryptographyDefaultsProvider_TypesType
push edi
push esi
call sub.ntdll.dll_strcpy_s
add esp, 0xc
lea ecx, [ebp - 0x28]
mov eax, dword [ebp + 0xc]
call fcn.7555426e
lea eax, [ebp - 0x23]
push eax
push edi
push esi
call sub.ntdll.dll_strcat_s
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push esi
push 0x80000002
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCreateKeyExA
cmp eax, ebx
jne 0x755568c8
test byte [ebp + 0x14], 4
je 0x75556895
push 0x755516a8
push dword [ebp - 0x2c]
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueA
cmp eax, ebx
jne 0x7555670d
mov dword [ebp - 0x30], 1
jmp 0x755568d0
test byte [ebp + 0x14], 2
je 0x75556895
test byte [ebp + 0x14], 4
je 0x75556887
mov eax, str.SOFTWAREMicrosoftCryptographyProvidersType
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x755567ff
sub eax, edi
lea edi, [eax + 6]
push edi
push 0x40
call esi
mov esi, eax
mov dword [ebp - 0x38], esi
cmp esi, ebx
je 0x7555669c
push str.SOFTWAREMicrosoftCryptographyProvidersType
push edi
push esi
call sub.ntdll.dll_strcpy_s
add esp, 0xc
lea ecx, [ebp - 0x28]
mov eax, dword [ebp + 0xc]
call fcn.7555426e
lea eax, [ebp - 0x23]
push eax
push edi
push esi
call sub.ntdll.dll_strcat_s
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
call dword [sym.imp.ntdll.dll_RtlOpenCurrentUser]
test eax, eax
jl 0x755568c8
push ebx
push ebx
push esi
push dword [ebp - 0x3c]
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExA
mov esi, eax
cmp esi, ebx
je 0x75556875
push dword [ebp - 0x3c]
call dword [sym.imp.ntdll.dll_NtClose]
push esi
jmp 0x755568ca
mov dword [ebp - 0x30], 1
push dword [ebp - 0x3c]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x755568d0
push edi
push dword [ebp - 0x40]
call sym.CRYPTSP.dll_CryptSetProviderA
mov dword [ebp - 0x30], eax
jmp 0x755568d0
push dword [ebp - 0x48]
push dword [ebp - 0x40]
xor esi, esi
inc esi
push esi
push ebx
push 0x755516a8
push dword [ebp - 0x2c]
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExA
cmp eax, ebx
jne 0x7555670d
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x30], esi
jmp 0x75556901
push 0x80090009
jmp 0x755568ca
push 0x57
call dword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
jmp 0x75556901
cmp dword [ebp - 0x34], ebx
je 0x7555690f
push dword [ebp - 0x34]
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalFree]
cmp dword [ebp - 0x38], ebx
je 0x7555691d
push dword [ebp - 0x38]
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_LocalFree]
cmp dword [ebp - 0x2c], ebx
je 0x7555692a
push dword [ebp - 0x2c]
call sub.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey
mov eax, dword [ebp - 0x30]
call fcn.75558b50
ret 0x10