Function at 0x43cd29
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2480
call fcn.00453130
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push 0xfff
mov dword [ebp - 0x2418], eax
lea eax, [ebp - 0x1413]
push edi
push eax
mov dword [ebp - 0x2424], ebx
mov dword [ebp - 0x241c], edi
mov byte [ebp - 0x1414], 0
call fcn.00450230
add esp, 0xc
mov dword [ebp - 0x2420], edi
mov dword [ebp - 0x2428], 0x1000
mov byte [ebp - 0x20c], 0
mov edi, str.ftp:____
test esi, esi
je 0x43cdac
push 6
push edi
push esi
call fcn.00450c23
add esp, 0xc
test eax, eax
je 0x43cdc0
test ebx, ebx
je 0x43cdd0
push 6
push edi
push ebx
call fcn.00450c23
add esp, 0xc
test eax, eax
jne 0x43cdd0
push str.Restoring_an_image_at_next_reboot_is_not_supported_for_images_on_FTP_servers
call fcn.0041c7ee
pop ecx
jmp 0x43d266
push dword [ebp - 0x2418]
call fcn.0043c736
cmp eax, 1
jne 0x43d266
test esi, esi
je 0x43d266
cmp byte [esi], 0
je 0x43d266
mov edi, dword [sym.imp.___total_physical_size__lu_MB_GetFullPathNameA]
push 0
lea eax, [ebp - 0x20c]
push eax
mov ebx, 0x104
push ebx
push esi
call edi
test eax, eax
jne 0x43ce1f
push esi
push str.GetFullPathName_for__s_failed_n
call fcn.0041c7ee
pop ecx
jmp 0x43cdca
mov esi, 0x46c02c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00442cad
lea edx, [ebp - 0x108]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43ce39
push 0
push dword [ebp - 0x2418]
lea eax, [ebp - 0x108]
push eax
call fcn.0043c5fe
test eax, eax
je 0x43d266
mov eax, dword [ebp - 0x2424]
test eax, eax
je 0x43cec2
cmp byte [eax], 0
je 0x43cec2
push 0
lea ecx, [ebp - 0x20c]
push ecx
push ebx
push eax
call edi
test eax, eax
jne 0x43ce87
push dword [ebp - 0x2424]
jmp 0x43ce12
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00442cad
lea edx, [ebp - 0x310]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x43ce9c
push 0
push dword [ebp - 0x2418]
lea eax, [ebp - 0x310]
push eax
call fcn.0043c5fe
test eax, eax
je 0x43d266
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x2480]
push eax
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.00442cad
push eax
call fcn.00421a88
test eax, eax
jne 0x43d241
cmp dword [ebp - 0x2480], eax
jbe 0x43d241
push dword [ebp - 0x2418]
lea eax, [ebp - 0x414]
push 0x46a500
push eax
call fcn.00450c76
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call fcn.0041b490
mov ecx, dword [ebp - 0x247c]
cmp edx, dword [ecx + 0x4b]
ja 0x43cf73
jb 0x43cf2c
cmp eax, dword [ecx + 0x47]
jae 0x43cf73
mov esi, dword [ecx + 0x47]
mov edi, dword [ecx + 0x4b]
push edx
push eax
push 7
push edx
push eax
call fcn.0040c6f5
push eax
push edi
push esi
push 7
push edi
push esi
call fcn.0040c6f5
push eax
push dword [ebp - 0x2418]
push str.The_image_doesnt_fit_on_disk__s_nImagesize___sb___I64u__nDisksize____sb___I64u_
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x126
push str.REGNATIVE
call fcn.0044dc85
add esp, 0x2c
jmp 0x43d266
push 0
call dword [sym.imp.___total_physical_size__lu_MB_SetLastError]
lea eax, [ebp - 0x414]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43cf84
sub eax, edx
mov edi, eax
mov eax, 0xfa
cmp edi, eax
jbe 0x43cfbd
push edi
push eax
push str.The_length_of_the_destination_path_is_too_long._nMaximum_number_of_characters_alllowed_is__d___you_use__d
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x130
push str.REGNATIVE
call fcn.0044dc85
add esp, 0x18
jmp 0x43d266
lea ecx, [ebp - 0x108]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x43cfc6
sub ecx, esi
cmp ecx, eax
jbe 0x43cfe8
push ecx
push eax
push str.The_length_of_the_full_image_name_is_too_long._nMaximum_number_of_characters_alllowed_is__d___you_use__d
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x137
jmp 0x43cfab
cmp edi, eax
jbe 0x43d001
push edi
push eax
push str.The_length_of_the_differential_image_name_is_too_long._nMaximum_number_of_characters_alllowed_is__d___you_use__d
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x13e
jmp 0x43cfab
xor esi, esi
cmp dword [ebp + 0x14], esi
jne 0x43d010
push esi
call fcn.0043c85c
jmp 0x43d01a
call fcn.0043c80e
mov dword [0x4d45d0], eax
cmp dword [0x4d45d0], esi
jne 0x43d035
call fcn.0043c4a0
mov dword [ebp - 0x2420], eax
cmp eax, esi
je 0x43d217
mov edi, 0x4a301c
mov ecx, edi
call fcn.0040d125
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d044
sub eax, edx
je 0x43d063
mov ecx, edi
call fcn.0040d125
push eax
push 0x46a008
mov ecx, edi
call fcn.0040d530
push dword [0x4cd668]
push 0x477b9c
call fcn.0041effc
push dword [0x4cd66c]
push 0x477ba8
call fcn.0041effc
push dword [0x4cd664]
push 0x477c40
call fcn.0041effc
lea eax, [ebp - 0x241c]
push eax
mov esi, str.SYSTEMCurrentControlSetControlSession_Manager
push esi
push reloc.lu_heads___lu_sectors___lu_byte_Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegOpenKeyA]
test eax, eax
je 0x43d0c6
push esi
push str.Cant_open__s
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x15b
jmp 0x43d259
lea eax, [ebp - 0x2428]
push eax
lea eax, [ebp - 0x2414]
push eax
push 0
push 0
mov edi, 0x477a80
push edi
push dword [ebp - 0x241c]
call dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
test eax, eax
je 0x43d104
push str.Query_Value_failed
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x161
jmp 0x43d202
push dword [ebp - 0x2418]
mov esi, str.___s
push esi
call fcn.0042f614
pop ecx
pop ecx
push eax
push dword [0x4d45d0]
push 0x477a70
call fcn.0042f614
pop ecx
pop ecx
push eax
call fcn.0041f048
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.0042f614
pop ecx
pop ecx
push eax
push dword [0x4d45d0]
push 0x477b0c
call fcn.0042f614
pop ecx
pop ecx
push eax
call fcn.0041f048
mov eax, dword [ebp - 0x2424]
test eax, eax
je 0x43d18f
cmp byte [eax], 0
je 0x43d18f
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.0042f614
pop ecx
pop ecx
push eax
push dword [0x4d45d0]
push 0x477b00
call fcn.0042f614
pop ecx
pop ecx
push eax
call fcn.0041f048
cmp dword [0x4d45d0], 0
jne 0x43d211
push 0x4777b4
lea eax, [ebp - 0x1414]
push 0x469a48
push eax
call fcn.00450c76
push dword [ebp - 0x2428]
mov esi, eax
lea eax, [ebp - 0x2414]
push eax
lea eax, [ebp + esi - 0x1413]
push eax
call fcn.00451390
add esi, dword [ebp - 0x2428]
add esp, 0x18
inc esi
push esi
lea eax, [ebp - 0x1414]
push eax
push 7
push 0
push edi
push dword [ebp - 0x241c]
call dword [sym.imp.ical_size__lu_MB_RegSetValueExA]
test eax, eax
je 0x43d211
push str.Setting_registry_value_failed
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x17f
push str.REGNATIVE
call fcn.0044dc85
add esp, 0x10
jmp 0x43d217
mov dword [ebp - 0x2420], ebx
cmp dword [ebp - 0x241c], 0
je 0x43d22c
push dword [ebp - 0x241c]
call dword [sym.imp.ical_size__lu_MB_RegCloseKey]
cmp dword [ebp - 0x2420], ebx
je 0x43d239
call fcn.0043c42e
mov eax, dword [ebp - 0x2420]
jmp 0x43d268
lea eax, [ebp - 0x108]
push eax
push str._s_is_not_a_valid_volume_image
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x119
push str.REGNATIVE
call fcn.0044dc85
add esp, 0x14
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 0x10