Function at 0x75923d4b
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x21c4
call fcn.759235ce
mov eax, dword [0x7594d0ac]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x21a8], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x21a4], eax
lea eax, [ebp - 0x2188]
push eax
mov ebx, 0xf003f
push ebx
push esi
push 0x75923b70
mov edi, 0x80000002
push edi
mov dword [ebp - 0x219c], 1
mov dword [ebp - 0x2188], esi
mov dword [ebp - 0x218c], esi
mov dword [ebp - 0x2194], 4
mov dword [ebp - 0x21a0], 0x2000
mov dword [ebp - 0x2198], esi
mov dword [ebp - 0x2178], esi
mov dword [ebp - 0x2184], esi
mov dword [ebp - 0x2180], esi
mov dword [ebp - 0x217c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x7592fc74
push esi
lea eax, [ebp - 0x2188]
push eax
push esi
push ebx
push esi
push esi
push esi
push 0x75923b00
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x2190], eax
cmp dword [ebp - 0x2190], esi
jne 0x75923e4e
cmp dword [ebp - 0x2198], esi
jne 0x75923e42
lea eax, [ebp - 0x2194]
push eax
lea eax, [ebp - 0x218c]
push eax
push esi
push esi
push 0x75923e78
push dword [ebp - 0x2188]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
mov dword [ebp - 0x2190], eax
jne 0x75923e4e
cmp dword [ebp - 0x218c], esi
jne 0x7592fd1c
cmp dword [ebp - 0x2188], esi
pop edi
pop esi
pop ebx
je 0x75923e65
push dword [ebp - 0x2188]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x219c]
call fcn.75921930
leave
ret 8
lea eax, [ebp - 0x2194]
push eax
lea eax, [ebp - 0x218c]
push eax
push esi
push esi
push 0x75923e78
jmp 0x75a37520
cmp dword [ebp - 0x2198], esi
je 0x7592fd43
push esi
lea eax, [ebp - 0x2188]
push eax
push esi
push ebx
push esi
push esi
push esi
push 0x75923b00
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x2190], eax
cmp dword [ebp - 0x2190], esi
mov dword [ebp - 0x2194], 4
jne 0x75923e4e
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x2194]
push eax
lea eax, [ebp - 0x21ac]
push eax
push esi
push esi
push 0x7592fef8
push dword [ebp - 0x2188]
call edi
test eax, eax
jne 0x7592fec0
cmp dword [ebp - 0x21ac], esi
je 0x7592fec0
push 1
push esi
lea eax, [ebp - 0x2184]
push eax
call sub.USER32.dll_BuildReasonArray
test eax, eax
je 0x7592fec0
lea eax, [ebp - 0x21a0]
push eax
lea eax, [ebp - 0x2174]
push eax
push esi
push esi
mov ebx, 0x7592fed8
push ebx
push dword [ebp - 0x2188]
mov word [ebp - 0x172], si
mov dword [ebp - 0x12c], esi
call edi
test eax, eax
je 0x7592fdf0
mov word [ebp - 0x2174], si
mov dword [ebp - 0x130], esi
jmp 0x7592fe09
push ebx
push dword [ebp - 0x2188]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x21a0]
mov dword [ebp - 0x130], eax
xor edi, edi
inc edi
push 0x1000
mov dword [ebp - 0x128], edi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
push 4
pop ebx
je 0x7592fe2a
or dword [ebp - 0x128], ebx
lea eax, [ebp - 0x2184]
push eax
mov eax, dword [ebp - 0x21a4]
push 0x75937549
push dword [ebp - 0x21a8]
push 0x8a2
push dword [0x7594d0b8]
push dword [eax + 4]
mov eax, dword [0x7594d0fc]
call dword [eax + 0x1c]
cmp eax, edi
je 0x7592fe73
lea eax, [ebp - 0x2184]
push eax
call sub.USER32.dll_DestroyReasons
mov dword [ebp - 0x219c], ebx
jmp 0x75923e4e
mov eax, dword [ebp - 0x2178]
mov dword [ebp - 0x21bc], eax
lea eax, [ebp - 0x2174]
mov dword [ebp - 0x21b0], eax
lea eax, [ebp - 0x21c4]
push eax
mov dword [ebp - 0x21c4], 0x18
mov dword [ebp - 0x21c0], edi
mov dword [ebp - 0x21b8], ebx
call dword [sym.imp.USER32.dll_RecordShutdownReason]
lea eax, [ebp - 0x2184]
push eax
call sub.USER32.dll_DestroyReasons
mov dword [ebp - 0x219c], edi
push 0x7592fef8
push dword [ebp - 0x2188]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x75923e4e