Function at 0x7593f0a6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x7594d0ac]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x134], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp + 0x20]
push 0x373c
xor edi, edi
push edi
mov dword [ebp - 0x140], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, edi
jne 0x7593f0f5
xor eax, eax
jmp 0x7593f404
test byte [ebp + 0xc], 0x40
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x3730], eax
je 0x7593f12f
test byte [ebp + 0xd], 1
jne 0x7593f12f
push edi
push 0x7593f480
push 0x7593f418
push 0x80000001
call fcn.7593e68d
test eax, eax
je 0x7593f12f
mov dword [esi + 0x16cc], 0x40
jmp 0x7593f138
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x16cc], eax
mov eax, dword [ebp + 0x24]
push esi
push ebx
push dword [ebp + 0xc]
mov dword [esi + 0x16dc], eax
mov dword [esi + 0x16d0], edi
mov dword [esi + 0x16d4], edi
mov dword [esi + 0x16d8], edi
mov dword [esi + 0x3738], edi
call fcn.7593dc18
test eax, eax
je 0x7593f3dc
lea eax, [ebp - 0x128]
push eax
push 0xf003f
push edi
push 0x75923b70
mov ebx, 0x80000002
push ebx
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x130], 4
mov dword [ebp - 0x13c], edi
mov dword [esi + 0x372c], edi
mov word [esi + 0x16e0], di
mov dword [esi + 0x3724], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x7593f328
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x124]
push eax
push edi
push edi
push 0x75923e78
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x128]
mov dword [ebp - 0x12c], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x12c], edi
mov dword [ebp - 0x128], edi
jne 0x7593f328
cmp dword [ebp - 0x124], edi
mov dword [ebp - 0x120], 0x11c
je 0x7593f259
cmp dword [ebp - 0x124], 1
je 0x7593f259
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x7593f31d
movzx eax, byte [ebp - 6]
dec eax
je 0x7593f247
xor eax, eax
cmp dword [ebp - 0x124], 3
jmp 0x7593f250
xor eax, eax
cmp dword [ebp - 0x124], 2
sete al
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x13c], 1
cmp dword [ebp - 0x12c], edi
jne 0x7593f2e8
cmp dword [ebp - 0x13c], edi
jne 0x7593f298
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x124]
push eax
push edi
push edi
push 0x75923e78
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x7593f2e8
cmp dword [ebp - 0x124], edi
je 0x7593f2e8
lea eax, [esi + 0x16c8]
xor ecx, ecx
cmp dword [eax], edi
jle 0x7593f2c7
mov edx, esi
mov ebx, dword [edx]
and ebx, 0x106
or dword [esi + 0x372c], ebx
inc ecx
add edx, 0x288
cmp ecx, dword [eax]
jl 0x7593f2ae
cmp dword [esi + 0x372c], edi
je 0x7593f2e2
push edi
push 1
lea eax, [esi + 0x16d0]
push eax
call sub.USER32.dll_BuildReasonArray
test eax, eax
jne 0x7593f2e8
mov dword [esi + 0x372c], edi
cmp dword [ebp - 0x138], edi
je 0x7593f350
cmp dword [ebp - 0x140], edi
je 0x7593f350
push esi
push 0x7593efb2
push dword [ebp - 0x134]
push 0x898
push dword [0x7594d0b8]
push dword [ebp - 0x138]
call dword [ebp - 0x140]
jmp 0x7593f36d
mov dword [ebp - 0x124], edi
jmp 0x7593f259
push edi
lea eax, [ebp - 0x128]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push 0x75923b00
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x12c], eax
jmp 0x7593f263
push esi
push 0x7593efb2
push dword [ebp - 0x134]
push 0x898
push dword [0x7594d0b8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ebx, eax
test bx, 0x106
je 0x7593f3c6
jmp 0x75a40be8
cmp dword [ebp - 0x128], edi
je 0x7593f3de
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7593f3de
xor ebx, ebx
lea eax, [esi + 0x16d0]
push eax
call sub.USER32.dll_DestroyReasons
mov eax, dword [esi + 0x3738]
cmp eax, edi
je 0x7593f3fb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.75921930
leave
ret 0x24