Function at 0x75935dff
Capabilities:
Get hostname
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1450
call fcn.759235ce
mov eax, dword [0x7594d0ac]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xffffffffffffffeb
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x140c], esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x141c], eax
mov eax, dword [eax]
push 0x6a8
push esi
mov dword [ebp - 0x1418], eax
mov dword [ebp - 0x1420], 1
call dword [sym.imp.USER32.dll_GetDlgItem]
xor ebx, ebx
push ebx
push ebx
push 0x147
push eax
mov dword [ebp - 0x1410], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 6
pop ecx
mov dword [ebp - 0x1408], eax
xor eax, eax
lea edi, [ebp - 0x1450]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextW]
mov esi, 0x200
push esi
lea eax, [ebp - 0x804]
push eax
push 0x6a6
push dword [ebp - 0x140c]
mov dword [ebp - 0x1414], ebx
mov dword [ebp - 0x1428], ebx
mov word [ebp - 0x804], bx
mov word [ebp - 0x404], bx
mov word [ebp - 0x1004], bx
mov word [ebp - 0xc04], bx
mov word [ebp - 0x1404], bx
call edi
lea eax, [ebp - 0x804]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
je 0x75935f22
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x404]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
jmp 0x75a3fb80
mov eax, dword [ebp - 0x141c]
test byte [eax + 0x10], 1
je 0x75935fe4
push ebx
push dword [ebp - 0x1408]
push 0x150
push dword [ebp - 0x1410]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
mov dword [ebp - 0x1408], eax
jne 0x75935f5d
mov dword [ebp - 0x1408], ebx
mov eax, ebx
cmp eax, ebx
jne 0x75935fa2
cmp dword [ebp - 0x1414], ebx
jne 0x75935f7e
push esi
lea eax, [ebp - 0x404]
push eax
push 0x6a8
push dword [ebp - 0x140c]
call edi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x1434]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push ebx
push ebx
lea eax, [ebp - 0x1434]
push eax
push 3
jmp 0x75936050
cmp dword [eax + 8], 4
jne 0x75935fc4
push dword [eax + 0x18]
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov dword [ebp - 0x1428], 1
jmp 0x75935fd4
push dword [eax + 0x10]
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push dword [ebp - 0x1408]
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x7593605b
cmp dword [ebp - 0x1414], ebx
jne 0x75936025
push esi
lea eax, [ebp - 0x404]
push eax
push 0x6a8
push dword [ebp - 0x140c]
call edi
cmp word [ebp - 0x404], bx
jne 0x75936025
mov eax, dword [ebp - 0x1418]
push dword [eax + 0x4ac]
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x1434]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push ebx
push ebx
lea eax, [ebp - 0x1434]
push eax
xor eax, eax
cmp dword [ebp - 0x1414], ebx
setne al
inc eax
inc eax
push eax
call fcn.759272c1
mov dword [ebp - 0x1408], eax
cmp dword [ebp - 0x1408], ebx
jne 0x7593606b
push 2
pop eax
jmp 0x759364a3
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x6aa
push dword [ebp - 0x140c]
call edi
push esi
lea eax, [ebp - 0xc04]
push eax
push 0x6ac
push dword [ebp - 0x140c]
call edi
push esi
lea eax, [ebp - 0x1404]
push eax
push 0x6ae
push dword [ebp - 0x140c]
call edi
cmp dword [ebp - 0x1414], ebx
jne 0x759360e0
call fcn.75927c63
test eax, eax
je 0x759360e0
lea eax, [ebp - 0x1410]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x1410], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x759360e0
mov word [ebp - 0x404], bx
mov esi, dword [sym.imp.msvcrt.dll_wcschr]
lea eax, [ebp - 0x804]
push 0x40
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x759360fe
mov word [ebp - 0x404], bx
lea eax, [ebp - 0x1404]
push eax
lea eax, [ebp - 0xc04]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x75936158
push 0xfffffff
push 0x30
push 0x5e5
push 0x5e8
push dword [ebp - 0x1418]
push dword [ebp - 0x140c]
call fcn.7594024b
mov edi, 0x10000000
mov esi, eax
and esi, edi
sub esi, edi
neg esi
sbb esi, esi
and esi, 0xf0000000
add esi, 0x10000002
jmp 0x75936250
cmp word [ebp - 0x404], bx
jne 0x759361dc
lea eax, [ebp - 0x804]
push 0x40
push eax
call esi
cmp eax, ebx
pop ecx
pop ecx
jne 0x759361b0
push 0xfffffff
push 0x30
push 0x5e5
push 0x615
push dword [ebp - 0x1418]
push dword [ebp - 0x140c]
call fcn.7594024b
mov edi, 0x10000000
and eax, edi
sub eax, edi
neg eax
sbb eax, eax
and eax, 0xf0000000
add eax, 0x10000002
jmp 0x759364a3
add eax, 2
push eax
mov eax, dword [ebp - 0x1418]
push dword [eax + 0x56c]
call fcn.7592771c
mov esi, eax
cmp esi, ebx
je 0x759361dc
push dword [ebp - 0x1408]
call fcn.759292d3
mov dword [ebp - 0x1408], esi
lea eax, [ebp - 0xc04]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xe
mov edi, 0x10000000
jle 0x75936262
mov eax, dword [ebp - 0x1408]
mov eax, dword [eax + 8]
cmp eax, 1
je 0x75936210
cmp eax, 2
je 0x75936210
cmp eax, 3
je 0x75936210
cmp eax, 4
jne 0x75936262
push 0xfffffff
push 0x31
push 0x5e5
push 0x616
push dword [ebp - 0x1418]
push dword [ebp - 0x140c]
call fcn.7594024b
mov esi, eax
test edi, esi
je 0x7593623f
mov esi, 0x10000002
jmp 0x75936244
cmp esi, 2
jne 0x75936244
mov eax, esi
and eax, 0xefffffff
cmp eax, 2
jne 0x75936262
push dword [ebp - 0x1408]
call fcn.759292d3
mov eax, esi
jmp 0x759364a3
mov eax, dword [ebp - 0x1408]
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x1450]
push ecx
lea ecx, [ebp - 0x1424]
push ecx
lea ecx, [ebp - 0xc04]
push ecx
lea ecx, [ebp - 0x1004]
push ecx
lea ecx, [ebp - 0x404]
push ecx
lea ecx, [ebp - 0x804]
push ecx
push dword [ebp - 0x141c]
call dword [eax*4 + 0x7594def4]
mov esi, eax
cmp esi, 0xc00000da
jne 0x75936373
cmp word [ebp - 0x404], bx
jne 0x75936373
cmp dword [ebp - 0x1428], ebx
jne 0x7593637b
lea eax, [ebp - 0x1414]
push eax
push 0x20019
push ebx
push 0x75926438
push 0x80000002
mov dword [ebp - 0x1414], ebx
mov dword [ebp - 0x1410], ebx
mov dword [ebp - 0x142c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x75936333
lea eax, [ebp - 0x142c]
push eax
lea eax, [ebp - 0x1410]
push eax
lea eax, [ebp - 0x1438]
push eax
push ebx
push 0x759364b4
push dword [ebp - 0x1414]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x1414]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1410], ebx
je 0x759363a3
lea eax, [ebp - 0x1450]
push eax
lea eax, [ebp - 0x1424]
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x141c]
call dword [0x7594df08]
mov esi, eax
cmp dword [ebp - 0x1428], ebx
je 0x75936393
mov eax, dword [ebp - 0x1408]
push dword [eax + 0x10]
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
cmp esi, 0xc0000233
je 0x759363a3
cmp esi, 0xc00000da
jne 0x759363e5
mov eax, dword [ebp - 0x1408]
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x1450]
push ecx
lea ecx, [ebp - 0x1424]
push ecx
lea ecx, [ebp - 0xc04]
push ecx
lea ecx, [ebp - 0x1004]
push ecx
lea ecx, [ebp - 0x404]
push ecx
lea ecx, [ebp - 0x804]
push ecx
push dword [ebp - 0x141c]
call dword [eax*4 + 0x7594def4]
mov esi, eax
cmp esi, ebx
jl 0x7593640d
push 0xfffffff
push 0x40
push 0x5e5
push 0x5eb
push dword [ebp - 0x1418]
push dword [ebp - 0x140c]
call fcn.7594024b
jmp 0x75936444
lea eax, [ebp - 0x1450]
push eax
push dword [ebp - 0x1424]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push eax
push esi
push dword [ebp - 0x1418]
mov dword [ebp - 0x1420], 2
push dword [ebp - 0x140c]
call fcn.75934fef
cmp esi, ebx
mov dword [ebp - 0x1410], eax
jl 0x7593648e
push ebx
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x804]
push eax
mov eax, dword [ebp - 0x141c]
mov eax, dword [eax + 0x10]
shr eax, 4
not eax
and eax, 1
push eax
push dword [ebp - 0x140c]
push dword [ebp - 0x1418]
call fcn.75935a83
cmp dword [ebp - 0x1410], 1
je 0x7593649d
or dword [ebp - 0x1420], edi
mov eax, dword [ebp - 0x1420]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.75921930
leave
ret 4