Function at 0x43b738
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
cmp dword [0x468440], edi
je 0x43b802
call fcn.0043ae12
call fcn.0043b2a0
mov dword [0x468464], 1
cmp dword [0x468444], edi
je 0x43b7e7
cmp dword [0x4683b0], edi
je 0x43b7e7
call fcn.0043df0c
test eax, eax
je 0x43b7e7
push edi
call fcn.0043df0c
call fcn.004511a6
test eax, eax
je 0x43b7b0
push edi
call fcn.0043df0c
call fcn.004511a6
jmp 0x43b7ba
call fcn.0043df0c
call fcn.004510fe
mov esi, eax
call fcn.0043df0c
mov ebx, eax
call fcn.0044fd8b
call fcn.0043df0c
cmp dword [eax + 0x40], edi
je 0x43b7e4
mov ecx, eax
call fcn.0044fd78
test eax, eax
je 0x43b7e4
mov edi, eax
call fcn.0044f5df
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x43b858
xor esi, esi
inc esi
cmp dword [0x4683b0], 0
je 0x43b852
call fcn.0043df0c
test eax, eax
je 0x43b852
jmp 0x43b83e
test ebx, ebx
je 0x43b858
cmp dword [0x468444], edi
je 0x43b858
cmp dword [0x4683b0], edi
je 0x43b858
call fcn.0043df0c
test eax, eax
je 0x43b858
xor esi, esi
inc esi
call fcn.0043df0c
cmp dword [eax + 0x40], edi
je 0x43b83e
mov ecx, eax
call fcn.0044fd78
test eax, eax
je 0x43b83e
mov edi, eax
call fcn.0044f5df
call fcn.0043df0c
mov edi, eax
call fcn.00451124
test eax, eax
je 0x43b852
xor edx, edx
mov esi, edx
push esi
call fcn.0043dcb4
xor ecx, ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
push 2
push ecx
push ecx
push ecx
push 0x401478
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
pop ecx
test eax, eax
jne 0x43b8d6
cmp dword [0x4683f0], 0
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x43b8bd
test ebx, ebx
je 0x43b8ce
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
xor edx, edx
push edx
push 0x401aac
push dword [ebp - 0x240]
call esi
jmp 0x43b8ce
push 0x401aac
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x240]
call edi
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.004636d2
push 4
pop eax
or word [ebp - 0x248], ax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.0043ae8d
test eax, eax
js 0x43b995
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 3
xor eax, eax
push eax
push dword [ebp - 0x250]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43b995
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
cmp dword [0x4683f0], eax
jne 0x43b954
test ebx, ebx
je 0x43b983
push 4
pop ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
xor eax, eax
push eax
push 0x401aac
push dword [ebp - 0x240]
call esi
jmp 0x43b965
push 0x401aac
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test ebx, ebx
je 0x43b983
push 4
pop eax
push eax
push 0x46844c
push eax
xor eax, eax
push eax
push 0x41bf18
push dword [ebp - 0x240]
call esi
push dword [ebp - 0x240]
call edi
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
jmp 0x43b997
xor ecx, ecx
test ebx, ebx
je 0x43bb05
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
push 3
push ecx
push ecx
push ecx
push 0x401478
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43ba9c
push 4
pop eax
push eax
push 0x468454
push eax
xor eax, eax
push eax
push 0x41bed0
push dword [ebp - 0x240]
call esi
push 1
push 0x468460
push 3
xor eax, eax
push eax
push 0x41bfec
push dword [ebp - 0x240]
call esi
push 4
pop eax
push eax
push 0x468568
push eax
xor eax, eax
push eax
push 0x41bef4
push dword [ebp - 0x240]
call esi
push 4
pop eax
push eax
push 0x46844c
push eax
xor eax, eax
push eax
push 0x41bf18
push dword [ebp - 0x240]
call esi
push 4
pop eax
push eax
push 0x468450
push eax
xor eax, eax
push eax
push 0x41bf5c
push dword [ebp - 0x240]
call esi
push 4
pop eax
push eax
push 0x46856c
push eax
xor eax, eax
push eax
push 0x41bf7c
push dword [ebp - 0x240]
call esi
push 4
pop eax
push eax
push 0x46845c
push eax
xor eax, eax
push eax
push 0x41bfa4
push dword [ebp - 0x240]
call esi
push 4
pop eax
push eax
push 0x468448
push eax
xor eax, eax
push eax
push 0x41bfc4
push dword [ebp - 0x240]
call esi
push dword [ebp - 0x240]
call edi
call fcn.00441f05
cmp dword [0x468464], 0
push reloc.ole32.dll_CoRegisterClassObject
pop ecx
mov esi, 0x401448
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
je 0x43bb00
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor ecx, ecx
push reloc.ole32.dll_CoRegisterClassObject
push ecx
push 0x401084
push ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
call dword [sym.imp.SHELL32.dll_SHCoCreateInstance]
test eax, eax
js 0x43baee
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov ecx, dword [eax]
lea edx, [ebp - 0x34]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test eax, eax
je 0x43bb05
mov ecx, dword [eax]
push eax
call dword [ecx + EventUnregister]
jmp 0x43bb05
call fcn.0043cc1b
mov esi, dword [0x4685f8]
xor eax, eax
mov word [ebp - 0x23c], ax
test esi, esi
je 0x43bb68
lea edi, [esi + 0x30]
mov word [ebp - 0x23c], ax
mov ecx, dword [edi]
test ecx, ecx
je 0x43bb30
xor edx, edx
cmp word [ecx], dx
setne al
test al, al
je 0x43bb4a
push 0x104
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.004641b8
mov esi, dword [0x4685f8]
call fcn.0043f220
mov eax, dword [0x4685f8]
mov ecx, dword [eax]
push eax
call dword [ecx + EventUnregister]
xor eax, eax
mov dword [0x4685f8], eax
mov ax, word [ebp - 0x23c]
test ebx, ebx
je 0x43bba1
test ax, ax
je 0x43bb83
lea eax, reloc.ADVAPI32.dll_TraceMessage
push 0x104
mov edi, eax
call fcn.004403e6
cmp dword [reloc.ole32.dll_CoCreateInstance], 0
je 0x43bb9c
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.0043b37b
test eax, eax
jne 0x43bba1
call fcn.00444eb2
test byte [0x4691c0], 1
je 0x43bbb6
push 1
push 0x41bd90
call fcn.0042cd71
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.00463afc
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4