Function at 0x75e7b68d
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3e0
mov eax, dword [0x75ea0720]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp + 0x18]
xor edi, edi
mov dword [ebp - 0x3e0], ebx
mov dword [ebp - 0x3bc], esi
mov dword [ebp - 0x3dc], eax
cmp ebx, edi
jne 0x75e7b6d6
xor eax, eax
jmp 0x75e7bab2
cmp word [ebp + 0x10], di
jne 0x75e7b6ee
push 0x10
push edi
push ebx
call sub.ntdll.dll_wcstoul
movzx eax, ax
add esp, 0xc
mov dword [ebp + 0x10], eax
test byte [esi], 2
je 0x75e7b727
push 0x75e74744
push 9
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 0x75e7bbc0
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
push edi
push edi
push edi
push edi
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x18]
push eax
push 9
push ebx
call fcn.75e46dea
push 0x10
push edi
push ebx
call sub.ntdll.dll_wcstoul
add esp, 0xc
push 0x75e74820
mov dword [ebp - 0x3b4], eax
mov esi, 0x9a
push esi
lea eax, [ebp - 0x14c]
push eax
mov dword [ebp - 0x3a4], edi
call fcn.75e46dea
push ebx
push esi
lea eax, [ebp - 0x14c]
push eax
call fcn.75e3cd34
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x3b0]
push eax
call esi
lea eax, [ebp - 0x3b0]
mov dword [ebp - 0x3d0], eax
lea eax, [ebp - 0x3d8]
push eax
mov ebx, 0x20019
push ebx
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x3d4], edi
mov dword [ebp - 0x3c8], edi
mov dword [ebp - 0x3c4], edi
mov edi, dword [sym.imp.ntdll.dll_NtOpenKey]
push eax
mov dword [ebp - 0x3d8], 0x18
mov dword [ebp - 0x3cc], 0x40
call edi
test eax, eax
lea eax, [ebp - 0x3b0]
jl 0x75e7b914
push 0x75e7bb08
push eax
call esi
mov edi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
lea eax, [ebp - 0x3b8]
push eax
push 0x210
lea eax, [ebp - 0x3a0]
push eax
push 2
lea eax, [ebp - 0x3b0]
push eax
push dword [ebp - 0x3a8]
call edi
mov ebx, 0x80000005
cmp eax, ebx
jne 0x75e7b813
xor eax, eax
test eax, eax
jl 0x75e7b82c
lea eax, [ebp - 0x394]
mov dword [ebp - 0x3a4], eax
xor eax, eax
mov word [ebp - 0x196], ax
push 0x75e7bb20
lea eax, [ebp - 0x3b0]
push eax
call esi
lea eax, [ebp - 0x3b8]
push eax
push 0x14
lea eax, [ebp - 0x160]
push eax
push 2
lea eax, [ebp - 0x3b0]
push eax
push dword [ebp - 0x3a8]
call edi
test eax, eax
jl 0x75e7b873
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x3bc]
and ecx, 0xff0000
or dword [eax], ecx
mov eax, dword [ebp - 0x3b4]
shr eax, 0x10
mov ecx, eax
and ecx, 0xf000
mov edx, 0xe000
cmp cx, dx
jne 0x75e7b893
movzx eax, ax
jmp 0x75e7b8fa
test ax, ax
je 0x75e7b9c5
push 0x75e7baf4
lea eax, [ebp - 0x3b0]
push eax
call esi
lea eax, [ebp - 0x3b8]
push eax
push 0x30
lea eax, [ebp - 0x190]
push eax
push 2
lea eax, [ebp - 0x3b0]
push eax
push dword [ebp - 0x3a8]
call edi
cmp eax, ebx
jne 0x75e7b8d1
xor eax, eax
test eax, eax
jl 0x75e7b905
xor eax, eax
push 0x10
push eax
mov word [ebp - 0x166], ax
lea eax, [ebp - 0x184]
push eax
call sub.ntdll.dll_wcstol
and eax, 0xfff
add esp, 0xc
or eax, 0xf000
mov dword [ebp - 0x3b4], eax
jmp 0x75e7b9c5
mov dword [ebp - 0x3b4], 0xfffe
jmp 0x75e7b9c5
and dword [ebp - 0x3a4], 0
push 0x75e7bb38
push eax
call esi
xor eax, eax
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3c4], eax
lea eax, [ebp - 0x3d8]
push eax
push ebx
lea eax, [ebp - 0x3a8]
lea ecx, [ebp - 0x3b0]
push eax
mov dword [ebp - 0x3d8], 0x18
mov dword [ebp - 0x3cc], 0x40
mov dword [ebp - 0x3d0], ecx
call edi
test eax, eax
jl 0x75e7b9d1
push dword [ebp - 0x3e0]
lea eax, [ebp - 0x3b0]
push eax
call esi
lea eax, [ebp - 0x3b8]
push eax
push 0x210
lea eax, [ebp - 0x3a0]
push eax
push 2
lea eax, [ebp - 0x3b0]
push eax
push dword [ebp - 0x3a8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
cmp eax, 0x80000005
jne 0x75e7b9ac
xor eax, eax
test eax, eax
jl 0x75e7b9c5
lea eax, [ebp - 0x394]
mov dword [ebp - 0x3a4], eax
xor eax, eax
mov word [ebp - 0x196], ax
push dword [ebp - 0x3a8]
call dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [ebp - 0x3b4]
movzx ecx, word [ebp + 0x10]
mov eax, dword [ebp - 0x3dc]
movzx edx, si
shl edx, 0x10
or edx, ecx
cmp dword [ebp - 0x3a4], 0
mov dword [eax], edx
jne 0x75e7ba96
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x30]
cmp dword [edx + 0x1d4], 0
je 0x75e7ba7a
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x30]
mov edi, dword [0x7ffe02d8]
cmp dword [edx + 0x1d4], edi
je 0x75e7ba7a
shr esi, 0x10
and esi, 0xf000
mov edx, 0xe000
cmp si, dx
jne 0x75e7ba7a
mov edx, dword [ebp + 0x10]
and edx, 0x3ff
cmp dx, 0x11
jne 0x75e7ba57
mov dword [ebp - 0x3a4], 0x75e7badc
mov dword [eax], 0x4110411
jmp 0x75e7ba96
cmp dx, 0x12
jne 0x75e7ba6f
mov dword [ebp - 0x3a4], 0x75e7bac4
mov dword [eax], 0x4120412
jmp 0x75e7ba96
mov edx, ecx
shl edx, 0x10
or edx, ecx
mov dword [eax], edx
jmp 0x75e7ba8c
mov ecx, dword [ebp - 0x3bc]
test dword [ecx], 0x80000000
mov dword [eax], 0x4090409
mov dword [ebp - 0x3a4], 0x75e74808
push dword [ebp - 0x3a4]
push 0x104
push dword [ebp - 0x3c0]
call fcn.75e46dea
mov eax, dword [ebp - 0x3c0]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.75e36120
leave
ret 0x14