Function at 0x443b20
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x26c
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov dword [esp], 0x80000002
mov dword [esp + 0x10], eax
call ebp
sub esp, 0x14
test eax, eax
jne 0x443ee0
lea eax, [esp + 0x40]
lea esi, [esp + 0x44]
mov dword [esp + 0x44], 4
mov dword [esp + 0x50], 4
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x14], esi
mov dword [esp + 4], str.SystemRestorePointCreationFrequency
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
mov eax, 0xffffffff
cmove eax, dword [esp + 0x40]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x20106
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov dword [esp], 0x80000002
call ebp
sub esp, 0x14
test eax, eax
jne 0x443da0
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], str.SystemRestorePointCreationFrequency
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub esp, 0x18
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
mov dword [esp], str.SrClient.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
mov dword [ebx], eax
je 0x443d60
mov dword [esp + 4], str.SRSetRestorePointW
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
mov eax, dword [ebx]
sub esp, 8
test edx, edx
mov dword [esp + 0x28], edx
setne cl
mov edi, ecx
test eax, eax
setne cl
mov edx, edi
and dl, cl
mov byte [esp + 0x2f], dl
je 0x443d60
lea edi, [esp + 0x50]
xor eax, eax
mov ecx, 0x84
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x280]
mov dword [esp + 0x50], 0x64
mov dword [esp + 0x54], 0xa
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x60]
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
test byte [0x8671a0], 0x40
mov edx, dword [esp + 0x28]
jne 0x443dd0
lea eax, [esp + 0x50]
mov dword [esp + 4], esi
mov dword [esp], eax
call edx
sub esp, 8
test eax, eax
setne al
mov dword [esp + 4], str.Restore_Point:__d___d__n
mov dword [esp], 0x849160
mov esi, eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], eax
mov eax, esi
movzx eax, al
mov dword [esp + 8], eax
call fcn.0041f830
cmp dword [esp + 0x24], 0xfffffffe
jne 0x443df0
mov eax, esi
test al, al
jne 0x443dc0
cmp dword [esp + 0x44], 0x422
je 0x443e82
mov dword [esp + 4], str.ERROR:_CreateRestorePoint_:_Failed_to_create_restore_point._n
mov dword [esp], 0x849160
call fcn.0041f010
jmp 0x443d7a
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR:_CreateRestorePoint_:_Failed_to_create_restore_point__d_n
xor esi, esi
mov dword [esp], 0x849160
call fcn.0041f010
mov eax, dword [ebx]
test eax, eax
je 0x443d8c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
add esp, 0x26c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR_in_SetRestorePointCreationFrequency__:_error_in_RegOpenKeyEx__d_n
mov dword [esp], 0x849160
call fcn.0041f010
jmp 0x443c4e
movzx esi, byte [esp + 0x2f]
jmp 0x443d7a
mov dword [esp], 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
cmp dword [esp + 0x24], 0xfffffffe
je 0x443dc0
movzx esi, byte [esp + 0x2f]
lea esi, [esi]
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], 0x20106
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov dword [esp], 0x80000002
mov dword [esp + 0x10], eax
call ebp
sub esp, 0x14
test eax, eax
jne 0x443ea0
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x3c]
cmp edi, 0xffffffff
mov dword [esp + 0x40], edi
je 0x443ec0
lea edx, [esp + 0x40]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.SystemRestorePointCreationFrequency
mov dword [esp + 0x10], edx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub esp, 0x18
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x443d2c
mov dword [esp + 4], str.ERROR:_CreateRestorePoint_:_Failed_to_create_restore_point._Restore_points_disabled._n
mov dword [esp], 0x849160
call fcn.0041f010
jmp 0x443d7a
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR_in_SetRestorePointCreationFrequency__:_error_in_RegOpenKeyEx__d_n
mov dword [esp], 0x849160
call fcn.0041f010
jmp 0x443d2c
mov dword [esp + 4], str.SystemRestorePointCreationFrequency
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
sub esp, 8
jmp 0x443e6d
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR_in_GetRestorePointCreationFrequency__:_error_in_RegOpenKeyEx__d_n
lea esi, [esp + 0x44]
mov dword [esp], 0x849160
call fcn.0041f010
mov dword [esp + 0x24], 0xfffffffe
jmp 0x443bce