Function at 0x7dd75327
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
call sym.KERNEL32.dll_RegKrnGetGlobalState
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
call sym.KERNEL32.dll_RegKrnGetGlobalState
mov edi, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
cmp edi, ebx
je 0x7dd75369
movzx ecx, word [edi]
test cl, 1
jne 0x7dd75369
cmp cx, bx
je 0x7dd75389
cmp dword [edi + 4], ebx
jne 0x7dd75389
cmp dword [edi + 4], ebx
jne 0x7dd8da93
movzx ecx, word [edi]
cmp cx, 2
jne 0x7dd8da93
cmp word [edi + 2], bx
jne 0x7dd8da93
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp cx, bx
jbe 0x7dd7539a
add ecx, 0xfffffffe
mov word [edi], cx
cmp esi, 0x80000004
je 0x7dd8da89
cmp esi, 0x80000050
je 0x7dd8da89
cmp esi, 0x80000060
je 0x7dd8da89
cmp dword [ebp - 0x14], ebx
jne 0x7ddb19fc
cmp dword [ebp - 8], ebx
jne 0x7ddb1a3b
mov dword [ebp - 0x14], esi
and dword [ebp - 0x14], 2
jne 0x7dd8da66
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x7ddb1a71
push dword [ebp + 0x18]
mov esi, dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
push dword [ebp - 4]
call esi
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov ebx, dword [sym.imp.ntdll.dll_NtClose]
jne 0x7ddb1a82
call sym.KERNEL32.dll_RegKrnGetGlobalState
test byte [eax + 0x24], 1
jne 0x7ddb1a9e
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
pop edi
pop esi
pop ebx
leave
ret 0x14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x2000000
push dword [ebp - 4]
push ebx
call fcn.7dd8c332
cmp eax, ebx
jge 0x7dd753dd
jmp 0x7ddb1a6b
call sym.KERNEL32.dll_RegKrnGetGlobalState
jmp 0x7ddb1afa
push 0x57
jmp 0x7ddb1b18
cmp eax, ebx
je 0x7dd753c7
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0x10]
push edi
push esi
call eax
test eax, eax
jl 0x7ddb1a24
mov eax, dword [ebp - 8]
lea ecx, [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x18], eax
jmp 0x7ddb1a27
mov dword [ebp - 8], ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
push esi
call dword [ebp - 0x14]
jmp 0x7dd753c7
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
push esi
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [ebp - 8]
mov esi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push esi
jmp 0x7dd75424
push eax
jmp 0x7dd75424
cmp dword [ebp - 0xc], ebx
je 0x7dd753e8
mov dword [ebp - 4], eax
jmp 0x7dd753e8
cmp dword [ebp - 0xc], 0
je 0x7dd75412
cmp eax, dword [ebp + 8]
je 0x7ddb1a94
push eax
jmp 0x7ddb1a97
push dword [ebp - 0xc]
call ebx
jmp 0x7dd75412
cmp dword [ebp + 0xc], 0xc0000022
jne 0x7dd75421
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jne 0x7dd75421
cmp dword [ebp - 0x14], 0
je 0x7dd75421
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.7de199fd
test eax, eax
jge 0x7ddb1ad5
push 5
jmp 0x7ddb1b18
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push edi
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
call ebx
cmp dword [ebp + 0xc], 0
jge 0x7dd75421
jmp 0x7ddb1ad1
mov eax, dword [eax + 0x28]
cmp eax, ebx
je 0x7ddb1b16
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [edi + 4]
push esi
call eax
jmp 0x7dd7542a
push 6
pop eax
jmp 0x7dd7542a