Function at 0x42b78c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x45e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x468], eax
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x464], edx
lea eax, [ebp - 0x434]
mov dword [ebp - 0x460], edi
push eax
push 4
push ecx
push ecx
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x42c], ecx
push eax
push 0x2001f
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x430], ecx
push eax
mov dword [ebp - 0x44c], 0x18
mov dword [ebp - 0x448], ecx
mov dword [ebp - 0x440], 0x40
mov dword [ebp - 0x444], 0x4019f4
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x438], ecx
call dword [sym.imp.ntdll.dll_NtCreateKey]
mov esi, eax
test esi, esi
jns 0x42b861
push esi
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x4078f0
mov dword [ebp - 0x458], 0x407ab4
mov dword [ebp - 0x454], 0xcb
mov dword [ebp - 0x450], 0x407960
call fcn.00456190
xor edi, edi
jmp 0x42ba2c
lea eax, [ebp - 0x430]
push eax
push 0x420
lea eax, [ebp - 0x428]
push eax
push 2
push 0x4019fc
push dword [ebp - 0x42c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edx, 0x410
test eax, eax
js 0x42b8a9
cmp dword [ebp - 0x424], 3
jne 0x42b8a9
cmp dword [ebp - 0x420], edx
jne 0x42b8a9
mov eax, dword [ebp - 0x41c]
jmp 0x42b8e8
push edx
lea eax, [ebp - 0x878]
push 0
push eax
call sub.ntdll.dll_memset
mov ecx, 0x104
lea esi, [ebp - 0x878]
lea edi, [ebp - 0x41c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x460]
add esp, 0xc
or dword [ebp - 0x418], 0xffffffff
mov edx, 0x410
mov dword [ebp - 0x41c], eax
xor ecx, ecx
mov word [ebp - 0x216], cx
mov word [ebp - 0xe], cx
cmp eax, 1
ja 0x42ba4c
push edx
push ecx
lea eax, [ebp - 0x41c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x41c], edi
test ebx, ebx
je 0x42b96a
mov eax, dword [ebp - 0x464]
mov esi, ebx
mov dword [ebp - 0x418], eax
xor edi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x42b92c
sub esi, ecx
sar esi, 1
je 0x42b95e
cmp esi, 0x100
jb 0x42b94a
mov esi, 0xff
lea eax, [esi + esi]
push eax
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + esi*2 - 0x414], ax
jmp 0x42b97c
or dword [ebp - 0x418], 0xffffffff
xor eax, eax
mov word [ebp - 0x414], ax
xor edi, edi
mov edx, dword [ebp - 0x468]
test edx, edx
je 0x42b9c9
mov esi, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x42b98b
sub esi, ecx
sar esi, 1
je 0x42b9bd
cmp esi, 0x104
jb 0x42b9a9
mov esi, 0x103
lea eax, [esi + esi]
push eax
push edx
lea eax, [ebp - 0x214]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + esi*2 - 0x214], ax
jmp 0x42b9d2
xor eax, eax
mov word [ebp - 0x214], ax
push 0x410
lea eax, [ebp - 0x41c]
push eax
push 3
push edi
push 0x4019fc
push dword [ebp - 0x42c]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
test esi, esi
jns 0x42ba4e
push esi
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x4078f0
mov dword [ebp - 0x458], 0x407ab4
mov dword [ebp - 0x454], 0x12d
mov dword [ebp - 0x450], 0x407af8
call fcn.00456190
mov ecx, dword [ebp - 0x42c]
test ecx, ecx
je 0x42ba48
cmp ecx, 0xffffffff
je 0x42ba48
push ecx
mov dword [ebp - 0x42c], edi
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x42ba6c
xor edi, edi
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x42ba6a
cmp eax, 0xffffffff
je 0x42ba6a
push eax
mov dword [ebp - 0x42c], edi
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d72e
leave
ret 8