Function at 0x7dd75337
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
call sym.KERNEL32.dll_RegKrnGetGlobalState
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
call sym.KERNEL32.dll_RegKrnGetGlobalState
mov edi, dword [ebp + 0xc]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
cmp edi, ebx
je 0x7dd75379
movzx ecx, word [edi]
test cl, 1
jne 0x7dd75379
cmp cx, bx
je 0x7dd75399
cmp dword [edi + 4], ebx
jne 0x7dd75399
cmp dword [edi + 4], ebx
jne 0x7dd8da6b
movzx ecx, word [edi]
cmp cx, 2
jne 0x7dd8da6b
cmp word [edi + 2], bx
jne 0x7dd8da6b
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp cx, bx
jbe 0x7dd753aa
add ecx, 0xfffffffe
mov word [edi], cx
cmp esi, 0x80000004
je 0x7dd8da61
cmp esi, 0x80000050
je 0x7dd8da61
cmp esi, 0x80000060
je 0x7dd8da61
cmp dword [ebp - 0x14], ebx
jne 0x7ddb1a1c
cmp dword [ebp - 8], ebx
jne 0x7ddb1a5b
mov dword [ebp - 0x14], esi
and dword [ebp - 0x14], 2
jne 0x7dd8da3e
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x7ddb1a91
push dword [ebp + 0x18]
mov esi, dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
push dword [ebp - 4]
call esi
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov ebx, dword [sym.imp.ntdll.dll_NtClose]
jne 0x7ddb1aa2
call sym.KERNEL32.dll_RegKrnGetGlobalState
test byte [eax + 0x24], 1
jne 0x7ddb1abe
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
pop edi
pop esi
pop ebx
leave
ret 0x14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x2000000
push dword [ebp - 4]
push ebx
call fcn.7dd8c30a
cmp eax, ebx
jge 0x7dd753ed
jmp 0x7ddb1a8b
call sym.KERNEL32.dll_RegKrnGetGlobalState
jmp 0x7ddb1b1a
push 0x57
jmp 0x7ddb1b38
cmp eax, ebx
je 0x7dd753d7
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0x10]
push edi
push esi
call eax
test eax, eax
jl 0x7ddb1a44
mov eax, dword [ebp - 8]
lea ecx, [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x18], eax
jmp 0x7ddb1a47
mov dword [ebp - 8], ebx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
push esi
call dword [ebp - 0x14]
jmp 0x7dd753d7
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
push esi
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [ebp - 8]
mov esi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push esi
jmp 0x7dd75434
push eax
jmp 0x7dd75434
cmp dword [ebp - 0xc], ebx
je 0x7dd753f8
mov dword [ebp - 4], eax
jmp 0x7dd753f8
cmp dword [ebp - 0xc], 0
je 0x7dd75422
cmp eax, dword [ebp + 8]
je 0x7ddb1ab4
push eax
jmp 0x7ddb1ab7
push dword [ebp - 0xc]
call ebx
jmp 0x7dd75422
cmp dword [ebp + 0xc], 0xc0000022
jne 0x7dd75431
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jne 0x7dd75431
cmp dword [ebp - 0x14], 0
je 0x7dd75431
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.7de19c5d
test eax, eax
jge 0x7ddb1af5
push 5
jmp 0x7ddb1b38
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push edi
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov dword [ebp + 0xc], eax
call ebx
cmp dword [ebp + 0xc], 0
jge 0x7dd75431
jmp 0x7ddb1af1
mov eax, dword [eax + 0x28]
cmp eax, ebx
je 0x7ddb1b36
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [edi + 4]
push esi
call eax
jmp 0x7dd7543a
push 6
pop eax
jmp 0x7dd7543a