Function at 0x759dd9fb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0x40]
push ebx
mov ebx, dword [ebp + 0x28]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp + 0x44]
push esi
mov esi, dword [ebp + 0x30]
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x124]
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x12c], 0x104
mov dword [ebp - 0x130], eax
call fcn.759b3c2d
test esi, esi
je 0x759ddb05
push dword [ebp - 0x140]
push ebx
push dword [ebp - 0x150]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push esi
push dword [ebp + 0x2c]
push dword [ebp - 0x14c]
push dword [ebp - 0x148]
push dword [ebp + 0x14]
push edi
call fcn.759dc5ca
add esp, 0x2c
cmp dword [ebp + 0x34], 1
mov dword [ebp - 0x134], eax
jne 0x759e3666
mov eax, dword [ebp - 0x144]
test eax, eax
jne 0x759e3637
mov esi, dword [ebp - 0x134]
lea ecx, [ebp - 0x20]
call fcn.759b3c00
lea ecx, [ebp - 0x18]
call fcn.759b1681
lea ecx, [ebp - 0x130]
call fcn.759b170a
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret
push dword [ebp + 0x48]
lea eax, [ebp - 0x20]
push esi
push eax
push dword [ebp - 0x138]
push edi
push dword [ebp - 0x134]
call fcn.759ddb7c
add esp, 0x18
test eax, eax
jne 0x759e35d8
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0x130]
lea eax, [ebp + 0x34]
push eax
push 0
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x759e3605
cmp dword [ebp + 0x34], 1
jne 0x759e35fb
mov esi, dword [ebp - 0x130]
jmp 0x759dda86
lea ecx, [ebp - 0x20]
call fcn.759b3c00
lea ecx, [ebp - 0x18]
call fcn.759b1681
lea ecx, [ebp - 0x130]
call fcn.759b170a
or eax, 0xffffffff
jmp 0x759ddaf6
cmp dword [ebp + 0x34], 7
je 0x759ddb6c
cmp eax, 0xea
jne 0x759e3651
push 0
push dword [ebp - 0x138]
lea ecx, [ebp - 0x130]
call fcn.759db688
inc dword [ebp - 0x134]
cmp dword [ebp - 0x134], 2
jge 0x759dda86
jmp 0x759ddb31
mov ecx, dword [ebp - 0x13c]
test ecx, ecx
je 0x759e3649
cmp dword [eax], 0
je 0x759e3649
mov byte [ecx], 0
and dword [eax], 0
jmp 0x759ddad3
cmp eax, 2
jne 0x759e365e
or esi, 0xffffffff
jmp 0x759ddad9
push 0xfffffffffffffffa
pop esi
jmp 0x759ddad9
mov al, byte [esi]
inc esi
test al, al
jne 0x759e3666
push dword [ebp - 0x140]
push ebx
push 0
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push esi
push dword [ebp + 0x2c]
push dword [ebp - 0x144]
push dword [ebp - 0x13c]
push dword [ebp + 0x14]
push edi
call fcn.759dc5ca
mov esi, dword [ebp - 0x134]
add esp, 0x2c
cmp esi, 0xfffffffd
je 0x759e36bd
cmp eax, 0xfffffffd
je 0x759e36bd
cmp esi, 3
je 0x759e36b6
cmp esi, 4
jne 0x759ddad9
mov esi, eax
jmp 0x759ddad9
push 0xfffffffffffffffd
jmp 0x759e3660