Function at 0x41cd90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
test esi, esi
je 0x41cfc2
test ebx, ebx
je 0x41cfc2
cmp dword [ebp + 0xc], 0
je 0x41cfc2
mov eax, dword [ebx]
push edi
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push str.SYSTEMCurrentControlSetServicesVMware_NAT_ServiceParameters
push 0x80000002
mov dword [ebp - 4], eax
call dword [0x4650cc]
mov edi, eax
test edi, edi
je 0x41ce27
call dword [0x4651b0]
push eax
push edi
push str.GetNATFilePath:_Could_not_open_NAT_registry_path:_0x_08x_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
push eax
push ecx
push edx
push esi
call fcn.00417260
add esp, 0x10
test eax, eax
jne 0x41cf8f
push str.GetNATFilePath:_could_not_obtain_config_file_path
push 1
call fcn.004343f0
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
push str.ConfigPath
add edx, edx
push ecx
mov dword [ebp - 0xc], edx
call dword [0x4650c4]
mov edx, dword [ebp - 8]
push edx
mov edi, eax
call dword [0x4650d0]
test edi, edi
jne 0x41cdf2
mov eax, esi
lea edx, [eax + 2]
jmp 0x41ce60
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41ce60
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41ce77
sub eax, edx
sar eax, 1
push str.GetNATFilePath:_read_NAT_config_path_from_registry
push 0x20
mov edi, eax
call fcn.004343f0
mov eax, esi
add esp, 8
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cea0
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 - 2], 0x5c
jne 0x41cf04
lea ebx, [edi + ebx + 1]
cmp ebx, dword [ebp - 4]
ja 0x41cf0d
mov eax, dword [ebp + 0xc]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cec5
sub eax, edx
add esi, 0xfffffffe
mov cx, word [esi + 2]
add esi, 2
test cx, cx
jne 0x41ced5
mov edi, esi
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [eax], ebx
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
lea ebx, [edi + ebx + 2]
cmp ebx, dword [ebp - 4]
jbe 0x41cf26
push esi
push str.GetNATFilePath:_path_too_long_to_append_filename:__S
push 1
call fcn.004343f0
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, esi
add edi, 0xfffffffe
jmp 0x41cf30
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41cf30
mov ecx, dword [0x470914]
mov eax, dword [ebp + 0xc]
mov dword [edi], ecx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cf50
sub eax, edx
add esi, 0xfffffffe
mov cx, word [esi + 2]
add esi, 2
test cx, cx
jne 0x41cf60
mov edi, esi
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [edx], ebx
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.GetNATFilePath:_configuration_file_path:__S
push 0x20
call fcn.004343f0
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41cfa4
sub eax, edx
sar eax, 1
pop edi
inc eax
mov dword [ebx], eax
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push eax
push ebx
push esi
push str.GetNATFilePath:_invalid_parameters:_0x_08x_0x_08x
push 1
call fcn.004343f0
add esp, 0x14
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret