Function at 0x75927559
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x7594d0ac]
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp dword [0x7594d23c], 1
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x254], esi
je 0x7592f585
push ebx
lea eax, [ebp - 0x23c]
push eax
push esi
lea eax, [ebp - 0x244]
push eax
push esi
mov ebx, str.DCache
push ebx
push dword [0x7594d180]
mov dword [ebp - 0x23c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x7592f591
cmp eax, 0x6f
je 0x7592f591
cmp eax, esi
je 0x7592f591
lea eax, [ebp - 0x240]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonDomainCache
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x7592f68f
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.75921930
leave
ret 8
mov dword [edi], esi
mov dword [edi + 4], esi
xor eax, eax
jmp 0x75927602
push dword [ebp - 0x23c]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, esi
mov dword [ebp - 0x238], eax
je 0x7592f673
lea ecx, [ebp - 0x23c]
push ecx
push eax
lea eax, [ebp - 0x244]
push eax
push esi
push ebx
push dword [0x7594d180]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7592f667
mov eax, dword [ebp - 0x23c]
mov edi, dword [ebp - 0x238]
add eax, edi
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x240]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonDomainCache
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x7592f661
mov eax, dword [ebp - 0x234]
cmp edi, eax
je 0x7592f655
push 2
push 0x7592902c
push 1
push esi
push edi
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea edi, [edi + eax*2]
jmp 0x7592f648
cmp edi, dword [ebp - 0x234]
je 0x7592f655
inc edi
inc edi
cmp word [edi], si
je 0x7592f63e
cmp edi, dword [ebp - 0x234]
jne 0x7592f61a
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x24c]
push dword [ebp - 0x238]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push dword [0x7594d180]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x254], 1
jmp 0x759275da
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x248]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x250]
mov eax, dword [eax]
cmp eax, esi
jne 0x7592f6c9
mov eax, dword [ebp - 0x248]
push 1
add eax, 5
push eax
call fcn.75929905
cmp eax, esi
mov dword [ebp - 0x234], eax
je 0x7592f7bf
cmp dword [ebp - 0x248], esi
mov dword [ebp - 0x238], esi
jbe 0x7592f7bf
mov edi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x244]
push eax
push esi
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x238]
mov dword [ebp - 0x264], 0x11
push dword [ebp - 0x240]
mov dword [ebp - 0x260], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x7592f7a1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x26c]
push eax
call edi
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x25c]
push eax
call edi
mov ax, word [ebp - 0x25c]
neg ax
push esi
lea ecx, [ebp - 0x25c]
sbb eax, eax
and eax, ecx
push eax
lea eax, [ebp - 0x26c]
push eax
xor eax, eax
cmp word [ebp - 0x25c], si
setne al
add eax, 3
push eax
call fcn.759272c1
mov ebx, eax
cmp ebx, esi
je 0x7592f7a1
push ebx
push dword [ebp - 0x234]
call fcn.75927239
push ebx
call fcn.759292d3
inc dword [ebp - 0x238]
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x248]
jb 0x7592f6ef
mov edi, dword [ebp - 0x24c]
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x7592f813
push 8
pop ebx
lea eax, [ebp - 0x23c]
push eax
push edi
lea eax, [ebp - 0x244]
push eax
push esi
push str.DCacheUpdate
push dword [0x7594d180]
mov dword [ebp - 0x23c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x7592f80e
cmp dword [ebp - 0x244], 3
jne 0x7592f80e
cmp dword [ebp - 0x23c], ebx
je 0x7592f813
mov dword [edi], esi
mov dword [edi + 4], esi
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0x250]
mov dword [ecx], eax
xor eax, eax
cmp dword [ebp - 0x254], esi
sete al
jmp 0x75927601