Function at 0x417ed0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, dword [ecx + 0x10]
test edi, edi
mov dword [ebp - 8], ecx
jne 0x417efa
push str.Failed_to_get_filter_class_from_inf_file__n
call fcn.0040c2f0
add esp, 4
mov eax, 0x80070490
pop edi
mov esp, ebp
pop ebp
ret 8
push esi
push 0x20000
call fcn.0042e047
mov esi, eax
add esp, 4
test esi, esi
jne 0x417f2d
push 0x20000
push str.Failed_alloc_memory__size__Id__n
call fcn.0040c2f0
add esp, 8
pop esi
mov eax, 0x8007000e
pop edi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [str.FilterClasses]
mov ecx, dword [str.SystemCurrentControlSetControlNetwork]
push ebx
push eax
push ecx
push str.Reading_reg_val_HKLM_ls_ls_n
mov dword [ebp - 0xc], 7
mov dword [ebp - 4], 0x20000
call fcn.0040c2f0
mov ecx, dword [str.FilterClasses]
add esp, 0xc
lea edx, [ebp - 4]
push edx
mov edx, dword [str.SystemCurrentControlSetControlNetwork]
push esi
lea eax, [ebp - 0xc]
push eax
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ebx, eax
xor eax, eax
cmp ebx, eax
je 0x417faf
push ebx
push str.Failed_to_read_registry__err_x_n
call fcn.0040c2f0
push esi
call fcn.0042df6a
add esp, 0xc
test ebx, ebx
jle 0x417fa4
and ebx, 0xffff
or ebx, 0x80070000
mov eax, ebx
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 8
cmp byte [ebp + 8], al
mov word [esi + 0x1fffc], ax
mov word [esi + 0x1fffe], ax
je 0x418081
cmp byte [ebp + 0xc], al
mov eax, 0x4440ac
jne 0x417fd5
mov eax, str.high
push eax
push edi
push str.Adding_filter_class__ls_at__s_altitude_n
call fcn.0040c2f0
mov ebx, dword [ebp - 8]
add esp, 0xc
push edi
push esi
mov ecx, ebx
call fcn.00417af0
cmp eax, 0xffffffff
je 0x418054
test eax, eax
jne 0x418008
cmp byte [ebp + 0xc], al
jne 0x41800e
push str.Filter_has_already_been_added__n
jmp 0x4180a5
cmp byte [ebp + 0xc], 0
jne 0x417ffe
push str.Filter_class_has_already_been_added__but_at_the_wrong_altitude__will_delete_it._n
call fcn.0040c2f0
add esp, 4
push 0
push 0
mov ecx, ebx
call fcn.00417ed0
test eax, eax
mov dword [ebp + 8], eax
je 0x418054
push edi
push esi
mov ecx, ebx
call fcn.00417af0
cmp eax, 0xffffffff
je 0x418054
push str.Failed_to_delete_filter_class_residing_at_the_wrong_altitude__n
call fcn.0040c2f0
mov eax, dword [ebp + 8]
add esp, 4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 8
cmp byte [ebp + 0xc], 0
push 0x10000
je 0x418070
mov eax, dword [ebp - 4]
shr eax, 1
push eax
push edi
push esi
mov ecx, ebx
call fcn.00417c50
jmp 0x4180ce
mov ecx, dword [ebp - 4]
shr ecx, 1
push ecx
push edi
push esi
mov ecx, ebx
call fcn.00417b90
jmp 0x4180ce
push edi
push str.Deleting_filter_class__ls_n
call fcn.0040c2f0
mov ebx, dword [ebp - 8]
add esp, 8
push edi
push esi
mov ecx, ebx
call fcn.00417af0
cmp eax, 0xffffffff
jne 0x4180be
push str.Filter_has_already_been_deleted___n
call fcn.0040c2f0
push esi
call fcn.0042df6a
add esp, 8
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 4]
shr edx, 1
push edx
push eax
push edi
push esi
mov ecx, ebx
call fcn.00417cc0
cmp eax, 0xffffffff
jne 0x4180f4
push str.Failed_to_add_del_filter_class__n
call fcn.0040c2f0
push esi
call fcn.0042df6a
add esp, 8
pop ebx
pop esi
mov eax, 0x8007007a
pop edi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [str.FilterClasses]
mov edx, dword [str.SystemCurrentControlSetControlNetwork]
add eax, eax
push eax
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edi, eax
test edi, edi
jne 0x41813a
mov eax, dword [str.FilterClasses]
mov ecx, dword [str.SystemCurrentControlSetControlNetwork]
push eax
push ecx
push str.Successfully_modified_reg_value_HKLM_ls_ls_n
call fcn.0040c2f0
add esp, 0xc
jmp 0x418148
push edi
push str.Failed_to_set_reg_value__err_x_n
call fcn.0040c2f0
add esp, 8
push esi
call fcn.0042df6a
add esp, 4
test edi, edi
jle 0x418161
and edi, 0xffff
or edi, 0x80070000
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 8