Function at 0x422a10
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x430
mov eax, dword [0x5868f4]
xor eax, esp
mov dword [esp + 0x42c], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push ecx
mov edx, str.O:BAD:_A_OICI_GA___BA__A_OICI_GA___SY_
mov dword [esp + 0xc], 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call fcn.00409cd0
mov esi, eax
add esp, 4
test esi, esi
je 0x422acd
push ecx
push esi
lea ecx, [esp + 0x38]
call fcn.00407db0
mov dword [esp + 0xc], str.OracleOci.cpp
mov dword [esp + 0x10], str.Oci::SetStatusHandlerFile
mov dword [esp + 0x14], 0x12e
mov dword [esp + 0x18], 0
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push str.Log.txt
mov edx, str._ProgramData_QualysQualysAgent
mov dword [esp + 0x24], eax
call fcn.004265b0
lea eax, [esp + 0x38]
push eax
push str.OCI:_Failed_to_create_security_descriptor_for_the_Qualys_agent_registry_key:__s
push 0
push 2
lea eax, [esp + 0x24]
push 0x569ce0
push eax
call fcn.00424820
add esp, 0x20
jmp 0x422cd7
cmp dword [0x58b96c], 0
jne 0x422add
mov eax, str.SoftwareQualys
jmp 0x422b17
cmp word [0x58d4b8], 0
jne 0x422b12
cmp dword [0x58b970], 8
mov eax, dword [0x58b95c]
jae 0x422afa
mov eax, 0x58b95c
push eax
push str.SoftwareQualys
push str._sQualysAgent_s
push 0x58d4b8
call fcn.00431650
add esp, 0x10
mov eax, 0x58d4b8
push 0
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x20106
push 0
push 0
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x422bb0
push ecx
push esi
lea ecx, [esp + 0x38]
call fcn.00407db0
mov dword [esp + 0xc], str.OracleOci.cpp
mov dword [esp + 0x10], str.Oci::SetStatusHandlerFile
mov dword [esp + 0x14], 0x137
mov dword [esp + 0x18], 0
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push str.Log.txt
mov edx, str._ProgramData_QualysQualysAgent
mov dword [esp + 0x24], eax
call fcn.004265b0
lea eax, [esp + 0x38]
push eax
push str.OCI:_Failed_to_open_or_create_the_Qualys_agent_registry_key:__s
push 0
push 2
lea eax, [esp + 0x24]
push 0x569d68
push eax
call fcn.00424820
add esp, 0x20
jmp 0x422cd7
mov ecx, edi
call fcn.004088a0
add eax, eax
test edi, edi
je 0x422c50
push eax
push edi
push 1
push 0
push str.OciStatusHandlerFile
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x422cd7
push ecx
push esi
lea ecx, [esp + 0x38]
call fcn.00407db0
mov dword [esp + 0xc], str.OracleOci.cpp
mov dword [esp + 0x10], str.Oci::SetStatusHandlerFile
mov dword [esp + 0x14], 0x143
mov dword [esp + 0x18], 0
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push str.Log.txt
mov edx, str._ProgramData_QualysQualysAgent
mov dword [esp + 0x24], eax
call fcn.004265b0
lea eax, [esp + 0x38]
push eax
push str.OCI:_Failed_to_set_the_status_handler_file_path_in_the_registry:__s
push 0
push 2
lea eax, [esp + 0x24]
push 0x569df8
push eax
call fcn.00424820
add esp, 0x20
jmp 0x422cd7
push str.OciStatusHandlerFile
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
cmp esi, 2
jne 0x422c6a
xor esi, esi
jmp 0x422cd7
test esi, esi
je 0x422cd7
push ecx
push esi
lea ecx, [esp + 0x38]
call fcn.00407db0
mov dword [esp + 0xc], str.OracleOci.cpp
mov dword [esp + 0x10], str.Oci::SetStatusHandlerFile
mov dword [esp + 0x14], 0x153
mov dword [esp + 0x18], 0
mov byte [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push str.Log.txt
mov edx, str._ProgramData_QualysQualysAgent
mov dword [esp + 0x24], eax
call fcn.004265b0
lea eax, [esp + 0x38]
push eax
push str.OCI:_Failed_to_reset_the_status_handler_file_path._Error_s
push 2
lea eax, [esp + 0x20]
push 0x569e78
push eax
call fcn.004243f0
add esp, 0x1c
mov eax, dword [esp + 8]
test eax, eax
je 0x422cee
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 8], 0
mov eax, dword [esp + 0x28]
test eax, eax
je 0x422cfd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x434]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret 4