Function at 0x75a46ae5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2b0
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 0x2a4], 0
and dword [ebp - 0x290], 0
cmp byte [0x75bcca70], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, 0x75bc8fe0
push edi
mov edi, esi
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2a0], edi
mov dword [ebp - 0x29c], esi
mov dword [ebp - 0x2ac], esi
je 0x75a46cdd
lea ecx, [ebp - 0x28c]
call fcn.759b3c2d
lea ecx, [ebp - 0x28c]
call fcn.759b3e2d
mov dword [ebp - 0x294], eax
lea eax, [ebp - 0x298]
push eax
mov dword [ebp - 0x298], 0x20119
call fcn.759b172f
pop ecx
push dword [ebp - 0x294]
push dword [ebp - 0x298]
push 0
push 0x75a46fd0
push 0x80000002
call dword [0x75bcc908]
test eax, eax
jne 0x75a46cba
cmp byte [ebp + 0x10], al
mov dword [ebp - 0x298], 0x26a
mov eax, 0x75a47050
jne 0x75a46baf
mov eax, 0x75a47038
lea ecx, [ebp - 0x298]
push ecx
lea ecx, [ebp - 0x270]
push ecx
push 0
push 0
push eax
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
mov dword [ebp - 0x298], 0x26a
mov word [ebp - 6], cx
test eax, eax
jne 0x75a46cba
mov edi, dword [ebx]
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x294], esi
add edi, 0xb4
call fcn.759c6ee9
push eax
lea ecx, [ebp - 0x290]
call fcn.759c6f3c
push eax
lea eax, [ebp - 0x270]
push eax
push ebx
call dword [edi]
mov edi, eax
test edi, edi
je 0x75a46c70
mov eax, dword [ebp - 0x294]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x28c]
call fcn.759b3c00
lea ecx, [ebp - 0x284]
call fcn.759b1681
mov eax, dword [0x75bc8fe0]
push esi
call dword [eax + 8]
mov eax, dword [0x75bc8fe0]
push esi
call dword [eax + 8]
mov eax, dword [0x75bc8fe0]
push esi
call dword [eax + 8]
mov eax, dword [ebp - 0x290]
test eax, eax
je 0x75a46c69
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
jmp 0x75a46fba
mov eax, dword [ebp - 0x290]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 0x2a4]
push edx
push 0x759fa164
push eax
call dword [ecx + 0x34]
mov edi, eax
test edi, edi
jne 0x75a46c1c
mov eax, dword [ebp - 0x290]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.759c755e
mov eax, dword [ebp - 0x294]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [ebp - 0x2a0]
lea ecx, [ebp - 0x28c]
call fcn.759b3c00
lea ecx, [ebp - 0x284]
call fcn.759b1681
cmp dword [ebp - 0x2a4], 0
jne 0x75a46f18
cmp byte [ebp + 0x10], 0
jne 0x75a46de0
push 0x104
lea eax, [ebp - 0x270]
push eax
push dword [0x75bc842c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x75a46dd3
mov eax, dword [ebx]
add eax, 0xb4
lea ecx, [ebp - 0x298]
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x2a0], eax
call fcn.759c6ee9
push eax
lea ecx, [ebp - 0x290]
call fcn.759c6f3c
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x2a0]
push ebx
call dword [eax]
mov dword [ebp - 0x294], eax
test eax, eax
je 0x75a46d8b
mov eax, dword [ebp - 0x298]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [0x75bc8fe0]
push esi
call dword [eax + 8]
mov eax, dword [0x75bc8fe0]
push esi
call dword [eax + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x290]
test eax, eax
je 0x75a46d80
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x294]
jmp 0x75a46fba
mov eax, dword [ebp - 0x290]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 0x2a4]
push edx
push 0x759fa164
push eax
call dword [ecx + 0x34]
mov dword [ebp - 0x294], eax
test eax, eax
jne 0x75a46d4c
mov eax, dword [ebp - 0x290]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push eax
lea ecx, [ebp - 0x29c]
call fcn.759c755e
mov eax, dword [ebp - 0x298]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x2a4], 0
jne 0x75a46f18
xor eax, eax
cmp byte [ebp + 0x10], al
sete al
push eax
lea eax, [ebp - 0x270]
push 0x104
push eax
call fcn.759b8943
mov eax, dword [ebx]
add eax, 0x3c
add esp, 0xc
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x2a0], eax
call fcn.759c6f3c
push eax
lea eax, [ebp - 0x270]
push eax
mov eax, dword [ebp - 0x2a0]
push ebx
call dword [eax]
mov dword [ebp - 0x294], eax
test eax, eax
je 0x75a46e51
mov eax, dword [0x75bc8fe0]
push esi
call dword [eax + 8]
mov eax, dword [0x75bc8fe0]
push esi
call dword [eax + 8]
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x75a46d6a
mov eax, dword [ebp - 0x290]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 0x2a4]
push edx
push 0x759fa164
push eax
call dword [ecx + 0x34]
mov dword [ebp - 0x294], eax
test eax, eax
jne 0x75a46e2e
mov eax, dword [ebp - 0x290]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
push eax
lea ecx, [ebp - 0x2ac]
call fcn.759c755e
mov eax, dword [0x75bc8fe0]
push esi
call dword [eax + 8]
cmp dword [ebp - 0x2a4], 0
jne 0x75a46f18
mov eax, dword [ebx]
push 5
push ebx
call dword [eax + 0x18]
push 0xa2d
mov esi, eax
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0x34]
mov eax, dword [esi]
push 0x759fa164
push 2
push esi
call dword [eax + 0x40]
mov ebx, dword [ebp - 0x2ac]
mov eax, dword [esi]
push ebx
push 3
push esi
call dword [eax + 0x3c]
push dword [ebp - 0x29c]
mov eax, dword [esi]
push 4
push esi
call dword [eax + 0x3c]
mov eax, dword [esi]
push edi
push 5
push esi
call dword [eax + 0x3c]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x290]
test eax, eax
je 0x75a46f11
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x75a46fba
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x2a8], esi
mov esi, dword [eax]
lea ecx, [ebp - 0x2a8]
mov ebx, eax
je 0x75a46f3c
add esi, 0xd0
jmp 0x75a46f3f
add esi, 0x3c
call fcn.759c6ee9
push eax
push 0x759fa164
push ebx
call dword [esi]
mov esi, eax
test esi, esi
je 0x75a46f6d
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2ac]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x75a46eef
push dword [ebp - 0x2b0]
lea ecx, [ebp - 0x2a8]
call fcn.759ca326
mov eax, dword [ebp - 0x2a8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x2ac]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebp - 0x290]
test eax, eax
je 0x75a46fb8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret