Function at 0x42d05f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x462040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x468], eax
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x464], edx
lea eax, [ebp - 0x434]
mov dword [ebp - 0x460], edi
push eax
push 4
push ecx
push ecx
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x42c], ecx
push eax
push 0x2001f
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x430], ecx
push eax
mov dword [ebp - 0x44c], 0x18
mov dword [ebp - 0x448], ecx
mov dword [ebp - 0x440], 0x40
mov dword [ebp - 0x444], 0x401a14
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x438], ecx
call dword [sym.imp.ntdll.dll_NtCreateKey]
mov esi, eax
test esi, esi
jns 0x42d151
push esi
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x4079ec
mov dword [ebp - 0x458], 0x407bb4
mov dword [ebp - 0x454], 0xcb
mov dword [ebp - 0x450], 0x407a60
call fcn.0045a015
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x42d14a
cmp eax, 0xffffffff
je 0x42d14a
and dword [ebp - 0x42c], 0
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x42d363
lea eax, [ebp - 0x430]
push eax
push 0x420
lea eax, [ebp - 0x428]
push eax
push 2
push 0x401a1c
push dword [ebp - 0x42c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edx, 0x410
test eax, eax
js 0x42d199
cmp dword [ebp - 0x424], 3
jne 0x42d199
cmp dword [ebp - 0x420], edx
jne 0x42d199
mov eax, dword [ebp - 0x41c]
jmp 0x42d1d8
push edx
lea eax, [ebp - 0x878]
push 0
push eax
call sub.ntdll.dll_memset
mov ecx, 0x104
lea esi, [ebp - 0x878]
lea edi, [ebp - 0x41c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x460]
add esp, 0xc
or dword [ebp - 0x418], 0xffffffff
mov edx, 0x410
mov dword [ebp - 0x41c], eax
xor ecx, ecx
mov word [ebp - 0x216], cx
mov word [ebp - 0xe], cx
sub eax, ecx
je 0x42d1f2
sub eax, 1
jne 0x42d343
push edx
lea eax, [ebp - 0x41c]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x41c], edi
test ebx, ebx
je 0x42d25f
mov eax, dword [ebp - 0x464]
mov esi, ebx
mov dword [ebp - 0x418], eax
xor edi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x42d221
sub esi, ecx
sar esi, 1
je 0x42d253
cmp esi, 0x100
jb 0x42d23f
mov esi, 0xff
lea eax, [esi + esi]
push eax
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + esi*2 - 0x414], ax
jmp 0x42d271
or dword [ebp - 0x418], 0xffffffff
xor eax, eax
mov word [ebp - 0x414], ax
xor edi, edi
mov edx, dword [ebp - 0x468]
test edx, edx
je 0x42d2be
mov esi, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x42d280
sub esi, ecx
sar esi, 1
je 0x42d2b2
cmp esi, 0x104
jb 0x42d29e
mov esi, 0x103
lea eax, [esi + esi]
push eax
push edx
lea eax, [ebp - 0x214]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + esi*2 - 0x214], ax
jmp 0x42d2c7
xor eax, eax
mov word [ebp - 0x214], ax
push 0x410
lea eax, [ebp - 0x41c]
push eax
push 3
push edi
push 0x401a1c
push dword [ebp - 0x42c]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
test esi, esi
jns 0x42d345
push esi
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x4079ec
mov dword [ebp - 0x458], 0x407bb4
mov dword [ebp - 0x454], 0x12d
mov dword [ebp - 0x450], 0x407bf8
call fcn.0045a015
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x42d14a
cmp eax, 0xffffffff
je 0x42d14a
mov dword [ebp - 0x42c], edi
jmp 0x42d143
xor edi, edi
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x42d361
cmp eax, 0xffffffff
je 0x42d361
push eax
mov dword [ebp - 0x42c], edi
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00461687
leave
ret 8