Function at 0x427780
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x48ad06
mov eax, dword fs:[0]
push eax
mov eax, 0x101e4
call fcn.0046a9e0
mov eax, dword [0x4b38b4]
xor eax, esp
mov dword [esp + 0x101e0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b38b4]
xor eax, esp
push eax
lea eax, [esp + 0x101f8]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x10210]
xor ebx, ebx
mov edi, 0xf
mov dword [esp + 0x14], ecx
mov dword [esp + 0x164], edi
mov dword [esp + 0x160], ebx
mov byte [esp + 0x150], bl
mov dword [esp + 0x10200], ebx
mov dword [esp + 0x148], edi
mov dword [esp + 0x144], ebx
mov byte [esp + 0x134], bl
mov esi, dword [esp + 0x1020c]
cmp esi, ebx
mov byte [esp + 0x10200], 1
jl 0x427edf
cmp esi, 1
jle 0x4278a3
cmp esi, 2
jne 0x427edf
push 0xb
call fcn.00435be0
add esp, 4
test eax, eax
je 0x427e9d
push str.truecrypt.sys
lea ecx, [esp + 0x150]
call fcn.00402690
push str.DumpFilters
lea ecx, [esp + 0x134]
call fcn.00402690
lea eax, [esp + 0x18]
push eax
push 0x2001f
push ebx
push str.SYSTEMCurrentControlSetControlCrashControl
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4278ff
lea ecx, [esp + 0x24]
call fcn.00422d70
push 0x4a991c
lea ecx, [esp + 0x28]
push ecx
call fcn.00469b49
push 9
push str.truecrypt
lea ecx, [esp + 0x154]
call fcn.00402150
push 0xc
push str.UpperFilters
lea ecx, [esp + 0x138]
call fcn.00402150
push 0x2001f
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x427903
mov dword [esp + 0x2c], vtable.TrueCrypt::SystemException.0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x4a991c
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x38], eax
call fcn.00469b49
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x10200], 2
cmp byte [esp + 0x10208], bl
je 0x427a0a
cmp esi, 2
je 0x427a0a
mov esi, dword [esp + 0x160]
inc esi
mov eax, 0x10000
sub eax, esi
mov edi, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x150]
cmp dword [esp + 0x164], edi
jae 0x427954
lea eax, [esp + 0x150]
push 0x10000
push eax
lea ecx, [esp + 0x1fc]
push ecx
call fcn.0046adb0
mov eax, dword [esp + 0x140]
add esp, 0xc
cmp dword [esp + 0x148], edi
jae 0x427981
lea eax, [esp + 0x134]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + esi + 0x1f8]
push ecx
push ebx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4279a8
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x134]
cmp dword [esp + 0x148], edi
jae 0x4279bf
lea eax, [esp + 0x134]
mov ecx, dword [esp + 0x14]
add ecx, esi
push ecx
lea edx, [esp + 0x1f8]
push edx
push 7
push ebx
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x427e94
lea ecx, [esp + 0x24]
call fcn.00422d70
push 0x4a991c
lea ecx, [esp + 0x28]
push ecx
call fcn.00469b49
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x34]
push edx
call fcn.004251b0
push str._truecrypt_driver_setup.inf
push eax
lea eax, [esp + 0x170]
push eax
mov byte [esp + 0x1020c], 3
call fcn.00413670
add esp, 0xc
mov ebp, 0x10
mov byte [esp + 0x10200], 5
cmp dword [esp + 0x4c], ebp
jb 0x427a56
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00469789
add esp, 4
push 1
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x194]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
mov byte [ecx + 4], bl
call fcn.00401e90
lea ecx, [esp + 0x1c4]
call fcn.00424dd0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x18c]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x10228], 6
mov byte [ecx + 4], bl
call fcn.00401e90
lea esi, [esp + 0x1f4]
call fcn.00424850
mov byte [esp + 0x10200], 7
cmp byte [esp + 0x10208], bl
je 0x427ae6
mov eax, str.0008
mov edi, 0x491160
jmp 0x427af0
mov eax, str.8002
mov edi, 0x491154
push eax
lea ecx, [esp + 0xc4]
call fcn.004028e0
mov esi, eax
push edi
lea ecx, [esp + 0x118]
mov byte [esp + 0x10204], 8
call fcn.004028e0
push eax
lea ecx, [esp + 0x8c]
push str._truecrypt__r_n
push ecx
mov byte [esp + 0x1020c], 9
call fcn.00424b80
push str.Regtruecrypt_reg_r_n_r_n_truecrypt_reg__r_nHKR___
push eax
lea edx, [esp + 0x80]
push edx
mov byte [esp + 0x10218], 0xa
call fcn.00413670
lea ecx, [esp + 0x148]
push ecx
push eax
lea edx, [esp + 0xc4]
push edx
mov byte [esp + 0x10224], 0xb
call fcn.00412ed0
push str.__0x0001
push eax
lea eax, [esp + 0x124]
push eax
mov byte [esp + 0x10230], 0xc
call fcn.00413670
push esi
push eax
lea ecx, [esp + 0x88]
push ecx
mov byte [esp + 0x1023c], 0xd
call fcn.00412ed0
push 0x491104
push eax
lea edx, [esp + 0x120]
push edx
mov byte [esp + 0x10248], 0xe
call fcn.00413670
add esp, 0x48
lea ecx, [esp + 0x14c]
push ecx
push eax
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x1020c], 0xf
call fcn.00412ed0
push 0x491100
push eax
lea eax, [esp + 0x198]
push eax
mov byte [esp + 0x10218], 0x10
call fcn.00413670
add esp, 0x18
cmp dword [esp + 0x4c], ebp
jb 0x427c04
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00469789
add esp, 4
mov esi, 0xf
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
cmp dword [esp + 0xf4], ebp
jb 0x427c2e
mov edx, dword [esp + 0xe0]
push edx
call fcn.00469789
add esp, 4
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
cmp dword [esp + 0x68], ebp
jb 0x427c56
mov eax, dword [esp + 0x54]
push eax
call fcn.00469789
add esp, 4
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
cmp dword [esp + 0x110], ebp
jb 0x427c7b
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.00469789
add esp, 4
mov dword [esp + 0x110], esi
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
cmp dword [esp + 0xbc], ebp
jb 0x427ca9
mov edx, dword [esp + 0xa8]
push edx
call fcn.00469789
add esp, 4
mov dword [esp + 0xbc], esi
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
cmp dword [esp + 0x84], ebp
jb 0x427cd4
mov eax, dword [esp + 0x70]
push eax
call fcn.00469789
add esp, 4
mov dword [esp + 0x84], esi
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
cmp dword [esp + 0xa0], ebp
jb 0x427cff
mov ecx, dword [esp + 0x8c]
push ecx
call fcn.00469789
add esp, 4
mov dword [esp + 0xa0], esi
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
cmp dword [esp + 0x12c], ebp
jb 0x427d2d
mov edx, dword [esp + 0x118]
push edx
call fcn.00469789
add esp, 4
mov dword [esp + 0x12c], esi
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
mov byte [esp + 0x10200], 0x1a
cmp dword [esp + 0xd8], ebp
jb 0x427d63
mov eax, dword [esp + 0xc4]
push eax
call fcn.00469789
add esp, 4
mov eax, dword [esp + 0x188]
mov dword [esp + 0xd8], esi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
cmp dword [esp + 0x19c], ebp
jae 0x427d8f
lea eax, [esp + 0x188]
mov ecx, dword [esp + 0x198]
push ecx
push eax
lea ecx, [esp + 0x1a8]
call fcn.00427500
cmp byte [esp + 0x1a1], bl
je 0x427dcb
cmp byte [esp + 0x1a0], bl
jne 0x427dc4
mov edx, dword [esp + 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x1a1], bl
mov eax, dword [esp + 0x16c]
cmp dword [esp + 0x180], ebp
jae 0x427de2
lea eax, [esp + 0x16c]
push ebx
push 3
push ebx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
cmp eax, 0xffffffff
jne 0x427e13
mov dword [esp + 0x1c], vtable.TrueCrypt::SystemException.0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x20], eax
push 0x4a991c
lea eax, [esp + 0x20]
push eax
call fcn.00469b49
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push 4
push str.truecrypt
push eax
mov eax, dword [edx]
push eax
mov byte [esp + 0x1022c], 0x1b
call dword [sym.imp.SETUPAPI.dll_SetupInstallFromInfSectionA]
test eax, eax
jne 0x427e5b
lea ecx, [esp + 0x24]
call fcn.00422d70
push 0x4a991c
lea ecx, [esp + 0x28]
push ecx
call fcn.00469b49
lea eax, [esp + 0x1c]
call fcn.00422780
lea ecx, [esp + 0x184]
call fcn.00401cf0
lea esi, [esp + 0x1d8]
call fcn.004244d0
lea ecx, [esp + 0x1a0]
call fcn.004221b0
lea ecx, [esp + 0x168]
call fcn.00401cf0
lea eax, [esp + 0x2c]
call fcn.00422770
lea ecx, [esp + 0x130]
call fcn.00401cf0
lea ecx, [esp + 0x14c]
call fcn.00401cf0
mov ecx, dword [esp + 0x101f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x101e0]
xor ecx, esp
call fcn.00469f7b
add esp, 0x101f0
ret 0xc
push 0x4a9954
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], vtable.TrueCrypt::ParameterIncorrect.0
mov dword [esp + 0x28], str.TrueCrypt::BootEncryption::RegisterFilter:1704
call fcn.00469b49
int3