Function at 0x759b5ca7
Capabilities:
Query or enumerate registry value

Disassembly:
add edi, 2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x26
jg 0x759e4ebe
lea esi, [eax + eax]
lea ecx, [ebp - 0x80]
push esi
mov eax, ecx
push edi
push eax
mov dword [ebp - 0x88], 0x27
mov dword [ebp - 0x8c], ecx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x8c]
push 0xffffffffffffffff
push dword [ebp + 0x30]
xor eax, eax
push ebx
push dword [ebp + 0x28]
mov word [esi + ecx], ax
push dword [ebp - 0x5fc]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 0x5e8]
push dword [ebp - 0x8c]
push dword [ebp - 0x5e0]
push dword [ebp - 0x5e4]
call fcn.759b5ca7
add esp, 0x3c
cmp eax, 0xfffffffc
je 0x759d9881
cmp eax, 0xfffffffe
jle 0x759c66af
cmp eax, 2
jle 0x759d9881
cmp eax, 3
jne 0x759e4ece
mov esi, dword [ebp - 0x5ec]
lea ecx, [ebp - 0x8c]
call fcn.759b499d
lea ecx, [ebp - 0x14]
call fcn.759b1681
lea ecx, [ebp - 0x30]
call fcn.759b3c00
lea ecx, [ebp - 0x28]
call fcn.759b1681
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.759b1748
leave
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x610
mov eax, dword [0x75bc8d18]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x2c]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5e8], ecx
mov ecx, dword [ebp + 0x24]
mov dword [ebp - 0x5e0], edi
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5fc], ecx
mov dword [ebp - 0x5dc], ebx
cmp edi, ebx
je 0x759c66b7
cmp eax, ebx
je 0x759c66b7
lea eax, [ebp - 0x5dc]
push eax
push 0x21
push edi
call fcn.759b4220
test eax, eax
jl 0x759c66b7
cmp dword [ebp - 0x5dc], 0x20
jne 0x759c66b7
cmp dword [ebp + 0x28], 2
push 3
pop eax
mov dword [ebp - 0x5ec], eax
jbe 0x759b5d44
cmp dword [ebp + 0x28], 0xffffffff
jne 0x759e4c58
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x5dc], eax
call fcn.759b3c2d
cmp byte [ebp + 0x30], bl
jne 0x759c669e
cmp dword [ebp - 0x5e4], ebx
jne 0x759e4c61
lea eax, [ebp - 0x5dc]
push eax
push dword [ebp + 0x28]
lea eax, [ebp - 0x30]
push ebx
push eax
push edi
call fcn.759b5c53
mov ecx, dword [ebp - 0x5dc]
add esp, 0x14
cmp eax, ebx
jne 0x759e4c85
cmp ecx, 2
ja 0x759b5da3
cmp esi, ebx
jne 0x759b8780
cmp dword [ebp + 0x28], 0xffffffff
jne 0x759b5da3
mov dword [ebp + 0x28], ecx
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x1a4]
push eax
push ebx
push ebx
push dword [ebp - 0x5f0]
mov dword [ebp - 0x1ac], 0x36
push dword [ebp - 0x30]
mov dword [ebp - 0x60c], 0x6c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x759e4c9d
mov eax, dword [ebp - 0x1b0]
cmp word [eax], 6
je 0x759e4cb0
xor esi, esi
inc esi
cmp dword [ebp + 0x34], esi
je 0x759e4ca0
lea ecx, [ebp - 0x1b0]
call fcn.759b59a8
push ebx
push dword [ebp + 0x28]
lea eax, [ebp - 0x30]
push ebx
push eax
push edi
push dword [ebp - 0x5e4]
call fcn.759b5ade
add esp, 0x18
test eax, eax
jne 0x759b5a79
lea eax, [ebp - 8]
push ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x610]
push eax
push ebx
push dword [ebp - 0x5f0]
mov dword [ebp - 0x10], esi
push dword [ebp - 0x30]
mov dword [ebp - 0xc], esi
call fcn.759b5885
add esp, 0x18
test eax, eax
jne 0x759b5a71
mov edi, dword [ebp - 0x14]
push edi
mov dword [ebp - 0x5dc], ebx
mov dword [ebp - 0x5f4], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x604], eax
movzx eax, word [edi]
cmp ax, bx
je 0x759b6155
cmp dword [ebp - 0x5dc], ebx
jne 0x759e4f0c
cmp ax, 2
je 0x759b59c5
cmp dword [ebp - 0x604], 0x14
jl 0x759e4ebe
push 0x21
pop eax
push 3
lea ecx, [ebp - 0x12c]
push eax
mov dword [ebp - 0x134], eax
mov eax, ecx
push eax
push edi
mov dword [ebp - 0x138], ecx
call fcn.759b5b89
add esp, 0x10
test eax, eax
je 0x759c649e
xor eax, eax
push 0x4c
mov word [ebp - 0xdc], ax
lea eax, [ebp - 0xda]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x138]
add esp, 0xc
mov edi, 0x759b3ef0
movzx ecx, word [eax]
cmp cx, bx
je 0x759c649e
mov dl, byte [edi]
cmp dl, 0x27
jae 0x759c649e
inc edi
inc eax
movzx edx, dl
inc eax
mov word [ebp + edx*2 - 0xdc], cx
cmp edi, 0x759b3f10
jb 0x759b5f00
mov eax, 0x759b4304
mov cl, byte [eax]
cmp cl, 0x27
jae 0x759c649e
movzx ecx, cl
push 0x2d
inc eax
pop edx
mov word [ebp + ecx*2 - 0xdc], dx
cmp eax, 0x759b4308
jb 0x759b5f32
mov ecx, dword [ebp - 0x5e8]
push 0x7b
pop eax
mov word [ebp - 0xdc], ax
push 0x7d
pop eax
mov word [ebp - 0x92], ax
xor eax, eax
mov word [ebp - 0x90], ax
mov byte [ebp - 0x5f8], bl
cmp ecx, ebx
jne 0x759b8787
lea eax, [ebp - 0x5cc]
mov dword [ebp - 0x5d8], eax
lea eax, [ebp - 0x3b8]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp + 0x28]
mov esi, 0x104
mov dword [ebp - 0x5d4], esi
mov dword [ebp - 0x3c0], esi
cmp eax, 0xffffffff
je 0x759e4cbd
cmp eax, 2
ja 0x759e4cbd
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x5e4]
neg eax
sbb eax, eax
not eax
lea ecx, [ebp - 0x600]
and eax, ecx
push eax
lea eax, [ebp - 0x608]
push eax
lea eax, [ebp - 0x5d8]
push eax
push dword [ebp - 0x138]
push dword [ebp - 0x5e0]
push dword [ebp - 0x5e4]
mov dword [ebp - 0x5d0], esi
call fcn.759b607e
add esp, 0x18
cmp eax, 0xfffffff9
je 0x759b602d
cmp eax, 0xffffffff
je 0x759b6250
push 3
pop edi
cmp eax, edi
jne 0x759e4cde
cmp dword [ebp + 0x18], ebx
jne 0x759c512d
add dword [ebp - 0x5f4], 0x28
sub dword [ebp - 0x604], 0x14
lea ecx, [ebp - 0x3c4]
call fcn.759b170a
lea ecx, [ebp - 0x5d8]
call fcn.759b170a
lea ecx, [ebp - 0x138]
call fcn.759b3f40
mov eax, dword [ebp - 0x5f4]
movzx eax, word [eax]
cmp ax, bx
je 0x759b6149
mov edi, dword [ebp - 0x5f4]
jmp 0x759b5e8b
cmp dword [ebp - 0x5dc], ebx
jne 0x759e4f0c
lea ecx, [ebp - 0x14]
call fcn.759b1681
lea ecx, [ebp - 0x30]
call fcn.759b3c00
lea ecx, [ebp - 0x28]
call fcn.759b1681
mov eax, dword [ebp - 0x5ec]
jmp 0x759b5a8b
lea ecx, [ebp - 0x3c4]
call fcn.759b170a
lea ecx, [ebp - 0x5d8]
call fcn.759b170a
lea ecx, [ebp - 0x138]
call fcn.759b3f40
lea ecx, [ebp - 0x14]
call fcn.759b1681
xor esi, esi
inc esi
jmp 0x759b5a79
mov dword [esi], ecx
jmp 0x759b5d9a
lea eax, [ebp - 0xdc]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x759b87a4
cmp dx, bx
je 0x759b87c8
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
je 0x759b87bd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x759b5f84
mov byte [ebp - 0x5f8], 1
jmp 0x759b5f84
add ecx, 4
add eax, 4
cmp dx, bx
jne 0x759b878d
xor eax, eax
jmp 0x759b87a9
push ebx
push dword [ebp - 0x608]
lea eax, [ebp - 0x3c4]
push dword [ebp - 0x5d8]
mov dword [ebp - 0x3bc], esi
push edi
push dword [ebp - 0x5fc]
push dword [ebp - 0x5f8]
push dword [ebp + 0x1c]
push eax
push ebx
push dword [ebp - 0x138]
push dword [ebp - 0x5e0]
push ebx
call fcn.759c5278
add esp, 0x30
cmp eax, edi
je 0x759b602d
cmp byte [ebp + 0x20], bl
je 0x759c6488
cmp eax, 0xfffffffa
je 0x759c6488
cmp eax, 0xfffffffd
je 0x759c6488
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0xdc]
push 0x27
pop esi
mov dword [ebp - 0xe8], eax
xor eax, eax
mov dword [ebp - 0x88], esi
mov dword [ebp - 0xe4], esi
mov word [ebp - 0xdc], ax
mov word [ebp - 0x80], ax
mov edi, 0x759b3ef0
movzx ecx, word [edx]
cmp cx, bx
je 0x759c521c
movzx eax, byte [edi]
cmp eax, esi
jae 0x759c521c
inc edi
inc edx
inc edx
mov word [ebp + eax*2 - 0x80], cx
cmp edi, 0x759b3f10
jb 0x759c51cc
mov ecx, 0x759b4304
movzx eax, byte [ecx]
cmp eax, esi
jae 0x759c521c
push 0x2d
inc ecx
pop edx
mov word [ebp + eax*2 - 0x80], dx
cmp ecx, 0x759b4308
jb 0x759c51f0
push 0x7b
pop eax
mov word [ebp - 0x80], ax
push 0x7d
pop eax
mov word [ebp - 0x36], ax
xor eax, eax
mov word [ebp - 0x34], ax
mov ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe8]
mov edi, dword [ebp - 0x5e0]
mov dword [ebp - 0x5e8], ecx
cmp ecx, esi
jb 0x759c6429
mov esi, 0x759b3ef0
movzx edx, word [edi]
cmp dx, bx
je 0x759c6429
movzx ecx, byte [esi]
cmp ecx, dword [ebp - 0x5e8]
jae 0x759c6427
inc esi
inc edi
inc edi
mov word [eax + ecx*2], dx
cmp esi, 0x759b3f10
jae 0x759c6694
xor ebx, ebx
jmp 0x759c5241
movzx ecx, byte [edx]
cmp ecx, dword [ebp - 0x5e8]
jae 0x759c6427
push 0x2d
inc edx
pop esi
mov word [eax + ecx*2], si
cmp edx, 0x759b4308
jb 0x759c63f9
push 0x7b
pop ecx
mov word [eax], cx
push 0x7d
pop ecx
mov word [eax + 0x4a], cx
xor ecx, ecx
mov word [eax + 0x4c], cx
xor ebx, ebx
lea eax, [ebp - 0x3c4]
push eax
mov dword [ebp - 0x3bc], 0x104
call fcn.759c6516
push ebx
push ebx
mov eax, 0x759b7ff8
push eax
push eax
push eax
push dword [ebp - 0x3c4]
push dword [ebp - 0x8c]
push dword [ebp - 0x5f0]
push dword [ebp - 0xe8]
push 0x3ec
push 2
push 0x15
call fcn.759c26bf
add esp, 0x34
lea ecx, [ebp - 0xe8]
call fcn.759b499d
lea ecx, [ebp - 0x8c]
call fcn.759b499d
lea ecx, [ebp - 0x3c4]
call fcn.759b170a
lea ecx, [ebp - 0x5d8]
call fcn.759b170a
lea ecx, [ebp - 0x138]
call fcn.759b3f40
lea ecx, [ebp - 0x14]
call fcn.759b1681
xor esi, esi
jmp 0x759b5a79
mov edx, 0x759b4304
jmp 0x759c63f9
xor esi, esi
inc esi
cmp dword [ebp + 0x34], esi
je 0x759e4cb5
jmp 0x759b5e11
or esi, 0xffffffff
jmp 0x759b5a66
push 0xfffffffffffffffe
pop eax
jmp 0x759b5a8b
mov esi, eax
jmp 0x759b5a66
or dword [ebp + 0x28], 0xffffffff
jmp 0x759b5d44
push ebx
lea eax, [ebp - 0x30]
push eax
push edi
push 0x759b5c90
push dword [ebp - 0x5e4]
push dword [ebp + 0x28]
call fcn.759b4577
mov ecx, dword [ebp + 0x28]
add esp, 0x18
jmp 0x759b5d85
lea ecx, [ebp - 0x30]
call fcn.759b3c00
lea ecx, [ebp - 0x28]
call fcn.759b1681
or eax, 0xffffffff
jmp 0x759b5a8b
or esi, 0xffffffff
lea ecx, [ebp - 0x1b0]
call fcn.759b59a8
jmp 0x759b5a79
push 2
pop esi
jmp 0x759e4ca0
or esi, 0xffffffff
jmp 0x759b5a79
push ebx
lea eax, [ebp - 0x608]
push eax
lea eax, [ebp - 0x5d8]
push eax
push dword [ebp - 0x138]
push dword [ebp - 0x5e0]
push ebx
jmp 0x759b5ffd
push 4
pop ecx
cmp eax, ecx
jne 0x759e4ede
mov dword [ebp - 0x5ec], ecx
cmp dword [ebp + 0x18], ebx
je 0x759b602d
push ebx
push dword [ebp - 0x608]
lea eax, [ebp - 0x3c4]
push dword [ebp - 0x5d8]
mov dword [ebp - 0x3bc], esi
push edi
push dword [ebp - 0x5fc]
push dword [ebp - 0x5f8]
push dword [ebp + 0x1c]
push eax
push ebx
push dword [ebp - 0x138]
push dword [ebp - 0x5e0]
push ebx
call fcn.759c5278
add esp, 0x30
mov dword [ebp - 0x600], eax
cmp eax, 4
je 0x759b602d
cmp byte [ebp + 0x20], bl
je 0x759e4ea2
cmp eax, 0xfffffffa
je 0x759e4ea2
cmp eax, 0xfffffffd
je 0x759e4ea2
xor eax, eax
push 0x4c
mov word [ebp - 0xdc], ax
lea eax, [ebp - 0xda]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x4c
mov word [ebp - 0x80], ax
lea eax, [ebp - 0x7e]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x138]
add esp, 0x18
mov edi, 0x759b3ef0
movzx ecx, word [eax]
cmp cx, bx
je 0x759e4dfe
mov dl, byte [edi]
cmp dl, 0x27
jae 0x759e4dfe
inc edi
inc eax
movzx edx, dl
inc eax
mov word [ebp + edx*2 - 0xdc], cx
cmp edi, 0x759b3f10
jb 0x759e4d9a
mov eax, 0x759b4304
mov cl, byte [eax]
cmp cl, 0x27
jae 0x759e4dfe
movzx ecx, cl
push 0x2d
inc eax
pop edx
mov word [ebp + ecx*2 - 0xdc], dx
cmp eax, 0x759b4308
jb 0x759e4dc4
push 0x7b
pop eax
mov word [ebp - 0xdc], ax
push 0x7d
pop eax
mov word [ebp - 0x92], ax
xor eax, eax
mov word [ebp - 0x90], ax
mov edi, dword [ebp - 0x5e0]
mov ecx, 0x759b3ef0
movzx eax, word [edi]
cmp ax, bx
je 0x759e4e5e
mov dl, byte [ecx]
cmp dl, 0x27
jae 0x759e4e5e
inc ecx
inc edi
movzx edx, dl
inc edi
mov word [ebp + edx*2 - 0x80], ax
cmp ecx, 0x759b3f10
jb 0x759e4e09
mov eax, 0x759b4304
mov cl, byte [eax]
cmp cl, 0x27
jae 0x759e4e5e
movzx ecx, cl
push 0x2d
inc eax
pop edx
mov word [ebp + ecx*2 - 0x80], dx
cmp eax, 0x759b4308
jb 0x759e4e30
push 0x7b
pop eax
mov word [ebp - 0x80], ax
push 0x7d
pop eax
mov word [ebp - 0x36], ax
xor eax, eax
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x3c4]
push eax
mov dword [ebp - 0x3bc], esi
call fcn.759c6516
push ebx
push ebx
mov eax, 0x759b7ff8
push eax
push eax
push eax
push dword [ebp - 0x3c4]
lea eax, [ebp - 0xdc]
push eax
push dword [ebp - 0x5f0]
lea eax, [ebp - 0x80]
push eax
push 0x3f8
push 2
push 0x15
call fcn.759c26bf
add esp, 0x34
cmp dword [ebp - 0x600], 0xfffffffc
jne 0x759c6488
mov dword [ebp - 0x5dc], 1
jmp 0x759b602d
lea ecx, [ebp - 0x14]
call fcn.759b1681
push 0xfffffffffffffffa
pop esi
jmp 0x759b5a79
push 4
pop esi
cmp eax, esi
jne 0x759c66af
jmp 0x759b5a66
lea ecx, [ebp - 0x3c4]
call fcn.759b170a
lea ecx, [ebp - 0x5d8]
call fcn.759b170a
lea ecx, [ebp - 0x138]
call fcn.759b3f40
lea ecx, [ebp - 0x14]
call fcn.759b1681
jmp 0x759e4cb5
mov dword [ebp - 0x5ec], 0xfffffffc
jmp 0x759b6155