Function at 0x759c3805
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4ac
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 0x4a0], esi
mov dword [ebp - 0x49c], edi
mov dword [ebp - 0x488], eax
call fcn.759b3ca6
xor ebx, ebx
cmp dword [ebp - 0x47c], ebx
je 0x759e3a6a
push dword [ebp - 0x47c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x26
jne 0x759e3a6a
cmp esi, ebx
je 0x759e3a6a
cmp edi, ebx
je 0x759e3a6a
cmp dword [ebp - 0x498], ebx
je 0x759c389c
cmp dword [ebp - 0x488], ebx
je 0x759e3a6a
or dword [ebp - 0x480], 0xffffffff
push 0x75bcc8b4
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x474], ebx
call fcn.759c2fd9
pop ecx
cmp eax, ebx
jne 0x759e3970
mov ecx, dword [0x75bcc8b4]
lea eax, [ebp - 0x46c]
push eax
push ebx
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x478]
push eax
mov dword [ebp - 0x46c], 0x759b1758
call fcn.759c2ed7
mov ecx, dword [ebp - 0x47c]
mov eax, dword [ebp - 0x46c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x759c3c1e
cmp dx, bx
je 0x759c392a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x759c3c1e
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x759c3900
xor eax, eax
cmp eax, ebx
jne 0x759c3c28
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x480], eax
je 0x759e3984
inc dword [ebp - 0x480]
cmp dword [ebp - 0x480], eax
jne 0x759c3c28
lea ecx, [ebp - 0x20]
call fcn.759b3c2d
mov byte [ebp - 0x465], 1
mov esi, 0x759b7ff8
mov edi, 0x759b4308
push ebx
push dword [ebp - 0x478]
lea eax, [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x47c]
push edi
call fcn.759b8981
add esp, 0x18
mov dword [ebp - 0x470], eax
cmp eax, 2
je 0x759c3c48
cmp eax, ebx
jne 0x759c3c53
mov eax, 0x104
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x458]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x49c]
mov eax, dword [eax]
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x488], ebx
je 0x759e399d
mov eax, ecx
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x494], 0x208
mov dword [ebp - 0x46c], ebx
lea eax, [ebp - 0x494]
push eax
push dword [ebp - 0x48c]
lea eax, [ebp - 0x484]
push ebx
push ebx
push eax
push dword [ebp - 0x490]
push dword [ebp - 0x474]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x470], eax
cmp eax, ebx
jne 0x759c3c77
mov byte [ebp - 0x466], bl
mov dword [ebp - 0x46c], ebx
cmp dword [ebp - 0x478], ebx
jbe 0x759c3abb
cmp byte [ebp - 0x466], bl
jne 0x759deed9
lea ecx, [ebp - 0x3c]
call fcn.759b3c2d
push ebx
push dword [ebp - 0x46c]
lea eax, [ebp - 0x3c]
push ebx
push eax
push dword [ebp - 0x47c]
push edi
call fcn.759b8981
add esp, 0x18
test eax, eax
je 0x759e39cc
lea ecx, [ebp - 0x3c]
call fcn.759b3c00
lea ecx, [ebp - 0x34]
call fcn.759b1681
inc dword [ebp - 0x46c]
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x478]
jb 0x759c3a54
cmp byte [ebp - 0x466], bl
jne 0x759deed9
cmp dword [ebp - 0x488], ebx
je 0x759c3b3e
push ebx
push ebx
lea eax, [ebp - 0x4ac]
push eax
push ebx
push ebx
push ebx
push 1
push dword [ebp - 0x48c]
call fcn.759b554e
add esp, 0x20
test eax, eax
je 0x759e39f3
mov eax, dword [ebp - 0x4ac]
mov ecx, dword [ebp - 0x48c]
lea edi, [ecx + eax*2]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x46c], eax
cmp dword [ebp - 0x498], ebx
je 0x759c3b36
mov edx, dword [ebp - 0x488]
lea ecx, [eax + 1]
cmp dword [edx], ecx
jb 0x759e3a3d
lea eax, [eax + eax + 2]
push eax
push edi
push dword [ebp - 0x498]
call sub.msvcrt.dll_memmove
mov eax, dword [ebp - 0x46c]
add esp, 0xc
mov ecx, dword [ebp - 0x488]
mov dword [ecx], eax
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0x49c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x4a0]
cmp dword [ebp - 0x490], eax
jne 0x759e3a4c
mov byte [ebp - 0x465], bl
lea ecx, [ebp - 0x464]
call fcn.759b170a
lea ecx, [ebp - 0x250]
call fcn.759b170a
cmp byte [ebp - 0x465], bl
jne 0x759c3969
cmp dword [ebp - 0x470], 0x103
je 0x759c3c5e
push dword [ebp - 0x47c]
inc dword [ebp - 0x474]
push dword [ebp - 0x480]
mov ecx, dword [0x75bcc8b4]
push dword [ebp - 0x474]
push dword [ebp - 0x478]
call fcn.759c3bfe
test al, al
je 0x759e3a5b
lea ecx, [ebp - 0x20]
call fcn.759b3c00
lea ecx, [ebp - 0x18]
call fcn.759b1681
lea ecx, [ebp - 0x4a8]
call fcn.759b3ed0
mov eax, dword [ebp - 0x470]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret 0x18
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x759c392c
cmp dword [ebp + 0xc], ebx
jne 0x759e398d
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x480], ebx
jmp 0x759c3955
inc dword [ebp - 0x478]
jmp 0x759c396e
mov byte [ebp - 0x465], bl
jmp 0x759c3b7a
cmp dword [ebp + 0xc], ebx
je 0x759deeca
mov ecx, dword [0x75bcc8b4]
call fcn.759c31d7
jmp 0x759c3bc7
cmp eax, 0x103
je 0x759c3d1e
cmp eax, 0xea
jne 0x759c3b5e
push ebx
push ebx
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x484]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x470], eax
cmp eax, ebx
jne 0x759c3b5e
inc dword [ebp - 0x484]
mov eax, dword [ebp - 0x49c]
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax]
ja 0x759e39ae
cmp dword [ebp - 0x488], ebx
je 0x759c3d06
mov eax, dword [ebp - 0x494]
shr eax, 1
cmp eax, dword [ebp - 0x24c]
jbe 0x759c3d06
push ebx
push eax
lea ecx, [ebp - 0x250]
call fcn.759b444d
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x48c], eax
inc dword [ebp - 0x46c]
cmp dword [ebp - 0x46c], 2
jl 0x759c3a07
jmp 0x759c3b64
inc dword [ebp - 0x478]
mov dword [ebp - 0x474], ebx
jmp 0x759c3b64
mov dword [ebp - 0x470], 0x647
jmp 0x759c3bc7
inc dword [ebp - 0x474]
jmp 0x759c3b64
mov esi, eax
lea ecx, [ebp - 0x4a8]
call fcn.759b3ed0
mov eax, esi
jmp 0x759c3be8
cmp dword [ebp - 0x480], 0xffffffff
jne 0x759e3992
push 0x57
pop esi
jmp 0x759e3972
dec dword [ebp - 0x474]
jmp 0x759c3955
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x494], ebx
jmp 0x759c3a01
push ebx
push ecx
lea ecx, [ebp - 0x464]
call fcn.759b444d
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x490], eax
jmp 0x759c3cd5
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x490]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x759c3a8b
mov byte [ebp - 0x466], 1
jmp 0x759c3a8b
push ebx
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x47c]
push edi
call fcn.759b8981
push ebx
push ebx
push esi
push esi
push esi
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x48c]
push dword [ebp - 0x490]
push 0x3ea
push 1
push 0x15
call fcn.759c26bf
add esp, 0x48
mov dword [ebp - 0x470], 0x64a
jmp 0x759c3b5e
mov dword [ebp - 0x470], 0xea
jmp 0x759c3b36
mov dword [ebp - 0x470], 0xea
jmp 0x759c3b5e
mov dword [ebp - 0x470], 8
jmp 0x759c3bc7
lea ecx, [ebp - 0x4a8]
call fcn.759b3ed0
push 0x57
pop eax
jmp 0x759c3be8