Function at 0x75b83173
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x75b8e004]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xe9], bl
cmp byte [ebp - 0xe9], bl
lea eax, [ebp - 0x10c]
je 0x75b831d1
push str.RegistryMachineSystemCurrentControlSetControlSecurePipeServerswinregAllowedExactPaths
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
mov dword [ebp - 0x104], 0x75b8e0b8
mov esi, 0x75b8e578
mov edi, 0x75b8e574
mov dword [ebp - 0x110], 0x75b8e57c
jmp 0x75b831fb
push str.RegistryMachineSystemCurrentControlSetControlSecurePipeServerswinregAllowedPaths
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
mov dword [ebp - 0x104], 0x75b8e060
mov esi, 0x75b8e570
mov edi, 0x75b8e56c
mov dword [ebp - 0x110], 0x75b8e584
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0xf0]
push eax
push 1
push 0x2000000
push 0xfffffffffffffffe
mov dword [ebp - 0x128], 0x18
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x11c], 0x40
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
call dword [sym.imp.ntdll.dll_NtOpenThreadToken]
cmp eax, 0xc000005c
je 0x75b83274
cmp eax, 0xc000007c
je 0x75b83274
cmp eax, ebx
jne 0x75b83488
push 4
lea eax, [ebp - 0xf8]
push eax
push 5
push 0xfffffffffffffffe
mov dword [ebp - 0xf8], ebx
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
jmp 0x75b8327a
mov dword [ebp - 0xf0], ebx
lea eax, [ebp - 0x128]
push eax
push 0x20019
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.ntdll.dll_NtOpenKey]
cmp dword [ebp - 0xf0], ebx
mov dword [ebp - 0xfc], eax
je 0x75b832d6
push 4
lea eax, [ebp - 0xf0]
push eax
push 5
push 0xfffffffffffffffe
call dword [sym.imp.ntdll.dll_NtSetInformationThread]
push dword [ebp - 0xf0]
mov dword [ebp - 0x12c], eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 0x12c]
cmp eax, ebx
jge 0x75b832d6
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], ebx
jge 0x75b83384
cmp dword [ebp - 0xfc], 0xc000003a
je 0x75b832fe
cmp dword [ebp - 0xfc], 0xc0000034
jne 0x75b8347e
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x75b8336d
push 1
push 0x75b8e080
call dword [sym.imp.ntdll.dll_RtlAcquireResourceExclusive]
mov eax, dword [ebp - 0x104]
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x75b83362
cmp dword [esi], ebx
je 0x75b8335d
mov eax, dword fs:[0x18]
push dword [esi]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [edi]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x104]
mov dword [esi], ebx
mov dword [edi], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
push 0x75b8e080
call dword [sym.imp.ntdll.dll_RtlReleaseResource]
cmp byte [ebp - 0xe9], bl
mov dword [ebp - 0xfc], ebx
je 0x75b83466
jmp 0x75b8347e
lea eax, [ebp - 0x100]
push eax
push 0xe4
lea eax, [ebp - 0xe8]
push eax
push ebx
push dword [ebp - 0xf4]
call dword [sym.imp.ntdll.dll_NtQueryKey]
cmp eax, ebx
mov dword [ebp - 0xfc], eax
jl 0x75b83472
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x104]
cmp ecx, dword [eax + 4]
jl 0x75b83452
jg 0x75b833d3
mov ecx, dword [ebp - 0xe8]
cmp ecx, dword [eax]
jbe 0x75b83452
push 1
push 0x75b8e080
call dword [sym.imp.ntdll.dll_RtlAcquireResourceExclusive]
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x104]
cmp ecx, dword [eax + 4]
jl 0x75b83447
jg 0x75b833fd
mov ecx, dword [ebp - 0xe8]
cmp ecx, dword [eax]
jbe 0x75b83447
cmp dword [esi], ebx
je 0x75b8342f
mov eax, dword fs:[0x18]
push dword [esi]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [edi]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esi], ebx
mov dword [edi], ebx
push dword [ebp - 0x110]
push edi
push esi
push str.Machine
push dword [ebp - 0xf4]
call fcn.75b82ff2
push 0x75b8e080
call dword [sym.imp.ntdll.dll_RtlReleaseResource]
push dword [ebp - 0xf4]
call dword [sym.imp.ntdll.dll_NtClose]
cmp byte [ebp - 0xe9], bl
jne 0x75b83486
mov byte [ebp - 0xe9], 1
jmp 0x75b83197
push dword [ebp - 0xf4]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 0xfc]
jmp 0x75b83488
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.75b8c8aa
leave
ret