Function at 0x43de60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2908
call fcn.0042b9a0
push ebx
push esi
push edi
push eax
xor eax, eax
pop eax
je 0x43de78
invalid
push 0x4bd5a0
call fcn.0042ad02
mov ebx, dword [ebp + 0x28]
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43deb2
mov eax, dword [ebx + 4]
push esi
push 0x4bd5a0
push eax
call fcn.004086c0
add esp, 0xc
mov ecx, ebx
push esi
call fcn.0040a230
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [ebp - 4], eax
je 0x43dee8
movsx ecx, byte [eax + 0xc]
push ecx
call fcn.0042b7b4
add esp, 4
test eax, eax
je 0x43e6af
lea ecx, [ebp - 4]
call fcn.00409860
mov eax, dword [ebp - 4]
mov ecx, dword [esi + 4]
cmp eax, ecx
jne 0x43dec1
mov al, byte [0x4c8854]
test al, al
jne 0x43df27
mov al, byte [0x4c8855]
test al, al
jne 0x43df27
mov al, byte [0x4c8856]
test al, al
jne 0x43df27
mov al, byte [0x4c8857]
test al, al
jne 0x43df27
mov al, byte [0x4c8858]
test al, al
jne 0x43df27
mov al, byte [0x4c8859]
test al, al
jne 0x43df27
mov al, byte [0x4c885a]
test al, al
je 0x43df30
mov al, byte [0x4c885b]
test al, al
je 0x43df77
push 0x4b0ac4
call fcn.0042ad02
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43e6af
mov edx, dword [ebx + 4]
push esi
push 0x4b0ac4
push edx
call fcn.004086c0
add esp, 0xc
mov ecx, ebx
push esi
call fcn.0040a230
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov eax, dword [0x4c872c]
test eax, eax
je 0x43df91
mov ecx, 0x4c8728
call fcn.004096e0
mov eax, dword [0x4c872c]
jmp 0x43df96
mov eax, 0x48d810
mov dl, byte [eax]
lea ecx, [ebp - 0x2c]
push ecx
push edx
call fcn.00439da0
test eax, eax
jge 0x43dfd3
push 0x4b4ce8
call fcn.0042ad02
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43e6af
mov eax, dword [ebx + 4]
push esi
push 0x4b4ce8
push eax
jmp 0x43df5b
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
add eax, edi
adc ecx, esi
cmp ecx, 0x200
jb 0x43e021
ja 0x43dff1
test eax, eax
jbe 0x43e021
push 0x4b4cb0
call fcn.0042ad02
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43e6af
mov ecx, dword [ebx + 4]
push esi
push 0x4b4cb0
push ecx
jmp 0x43df5b
call fcn.0043e780
test eax, eax
mov dword [ebp + 0x28], eax
je 0x43e6af
mov edx, dword [ebp - 0x14]
mov esi, str.SystemRoot_system32driversdiskprofile.sys
mov dword [eax + 0x8c], edx
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0x90], ecx
mov ecx, 0x16
lea edi, [ebp - 0x98]
lea edx, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
push 0
push edx
push 0
movsw word es:[edi], word [esi]
call fcn.00441140
mov esi, eax
test esi, esi
je 0x43e07e
push 0x80
push esi
call fcn.00441590
push esi
call fcn.00441680
push 0
lea eax, [ebp - 0x98]
push 0x4b4c4c
push eax
push 0
call fcn.00441450
mov esi, eax
test esi, esi
je 0x43e20f
push 0x26
push esi
call fcn.00441590
push 0
push 0x51c88
push esi
call fcn.004415e0
test eax, eax
jl 0x43e23f
push esi
call fcn.00441680
push 0
lea ecx, [ebp - 0x98]
push 0x4b0aac
push ecx
push 0
call fcn.00441450
mov esi, eax
test esi, esi
je 0x43e268
mov edi, dword [ebp + 0x28]
push 0
push 0
lea eax, [edi + 0x98]
push eax
push esi
call fcn.004416a0
test eax, eax
mov dword [edi + 0x94], eax
je 0x43e291
push esi
call fcn.00441680
push 0
lea edx, [ebp - 0x98]
push 0x4b4c44
push edx
push 0
call fcn.00441450
test eax, eax
mov dword [ebp - 0x30], eax
je 0x43e2db
mov eax, dword [ebp + 0x28]
xor edi, edi
mov ecx, dword [eax + 0x94]
test ecx, ecx
jle 0x43e1e3
mov ecx, eax
lea esi, [ecx + 0x98]
cmp byte [ebp - 0x2c], 7
je 0x43e158
mov ecx, dword [esi]
add ecx, 2
mov dword [esi], ecx
mov eax, dword [esi + 4]
adc eax, 0
mov dword [esi + 4], eax
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x10]
push edx
push eax
push 0
push ecx
call fcn.0042ba40
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x43e184
mov ecx, dword [esi]
cdq
add ecx, eax
mov dword [esi], ecx
mov eax, dword [esi + 4]
adc eax, edx
jmp 0x43e192
mov ecx, dword [esi]
neg eax
cdq
sub ecx, eax
mov dword [esi], ecx
mov eax, dword [esi + 4]
sbb eax, edx
mov dword [esi + 4], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
push 0
push edx
push eax
push ecx
call fcn.0042b9d0
mov edx, dword [esi]
add edx, eax
mov dword [esi], edx
mov ecx, dword [esi + 4]
adc ecx, 0
mov dword [esi + 4], ecx
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0x10]
push edx
push eax
push 0
push ecx
call fcn.0042ba40
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov edx, dword [ebp + 0x28]
inc edi
add esi, 0x10
cmp edi, dword [edx + 0x94]
jl 0x43e142
call fcn.0043e8d0
mov esi, eax
test esi, esi
mov dword [ebp - 0x3c], esi
jne 0x43e314
mov eax, dword [ebp - 0x30]
push eax
call fcn.00441680
push eax
xor eax, eax
pop eax
je 0x43e206
invalid
mov ecx, dword [ebp + 0x28]
push ecx
jmp 0x43e6a0
push 0x4b4c24
call fcn.0042ad02
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43e2ce
mov eax, dword [ebx + 4]
push esi
push 0x4b4c24
push eax
jmp 0x43e302
push 0x4b4bfc
call fcn.0042ad02
add esp, 4
mov edi, eax
mov ecx, ebx
push 1
push edi
call fcn.00401a80
test al, al
je 0x43e2c8
mov ecx, dword [ebx + 4]
push edi
push 0x4b4bfc
push ecx
jmp 0x43e2b8
push 0x4b4bdc
call fcn.0042ad02
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43e2ce
mov edx, dword [ebx + 4]
push esi
push 0x4b4bdc
push edx
jmp 0x43e302
push 0x4b4bac
call fcn.0042ad02
add esp, 4
mov edi, eax
mov ecx, ebx
push 1
push edi
call fcn.00401a80
test al, al
je 0x43e2c8
mov eax, dword [ebx + 4]
push edi
push 0x4b4bac
push eax
call fcn.004086c0
add esp, 0xc
mov ecx, ebx
push edi
call fcn.0040a230
push esi
call fcn.00441680
push eax
xor eax, eax
pop eax
je 0x43e2d6
invalid
jmp 0x43e69c
push 0x4b4b8c
call fcn.0042ad02
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43e2ce
mov ecx, dword [ebx + 4]
push esi
push 0x4b4b8c
push ecx
call fcn.004086c0
add esp, 0xc
mov ecx, ebx
push esi
call fcn.0040a230
jmp 0x43e2ce
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 4]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [ebp - 4], eax
je 0x43e3a0
add esi, 0x18
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], esi
mov ecx, dword [ebp - 0x34]
lea edx, [ebp - 0x2908]
mov dword [0x4c8880], ecx
mov al, byte [eax + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push edx
push eax
push ecx
call fcn.004404b0
test eax, eax
jl 0x43e513
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov edi, eax
add eax, 0x2870
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov ecx, 0xa1c
lea esi, [ebp - 0x2908]
add edx, 0x64
test eax, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], edx
je 0x43e38a
push 0
push 0x64
push 0
push 0x64
call eax
lea ecx, [ebp - 4]
call fcn.00409860
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 4]
jne 0x43e330
mov esi, dword [ebp - 0x3c]
mov al, byte [ebp + 0x10]
test al, al
je 0x43e3ae
or byte [esi + 0x41b78], 1
mov al, byte [ebp + 0x14]
test al, al
je 0x43e3bc
or byte [esi + 0x41b78], 2
mov al, byte [ebp + 0x24]
test al, al
je 0x43e3ca
or byte [esi + 0x41b78], 0x80
mov eax, dword [ebp + 0x18]
lea edi, [esi + 0x41bf8]
push eax
push edi
call fcn.004087f0
lea ecx, [esi + 0x41bb8]
push edi
push ecx
call fcn.004185d0
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx + 4]
test eax, eax
jne 0x43e3f6
mov eax, 0x48d810
push 0xf
push eax
lea eax, [esi + 0x41c58]
push eax
call fcn.004328e0
mov cx, word [ebp + 0x20]
add esp, 0xc
mov word [esi + 0x41c68], cx
push eax
xor eax, eax
pop eax
je 0x43e41b
invalid
lea ecx, [esi + 0x41c88]
xor edi, edi
cmp esi, ecx
mov eax, esi
je 0x43e434
xor edx, edx
mov dl, byte [eax]
add edi, edx
inc eax
cmp eax, ecx
jne 0x43e429
lea ecx, [esi + 0x10]
lea edx, [esi + 0x14]
mov eax, ecx
cmp eax, edx
je 0x43e44e
xor edx, edx
mov dl, byte [eax]
sub edi, edx
inc eax
lea edx, [esi + 0x14]
cmp eax, edx
jne 0x43e440
mov eax, dword [ebp + 0x28]
mov dword [ecx], edi
push 0x41c88
push esi
lea edi, [eax + 0xa98]
push 0x40
push edi
call fcn.00406b40
mov ecx, dword [ebp - 0x30]
push 0
push 0
push 0x41c88
push esi
push ecx
call fcn.00441520
cmp eax, 0x41c88
je 0x43e557
push 0x4b4b78
call fcn.0042ad02
add esp, 4
mov edi, eax
mov ecx, ebx
push 1
push edi
call fcn.00401a80
test al, al
je 0x43e4d2
mov eax, dword [ebx + 4]
mov ecx, 0x4b4b78
test edi, edi
jbe 0x43e4c6
mov dword [ebp + 0x10], edi
mov dx, word [ecx]
add ecx, 2
mov word [eax], dx
mov edx, dword [ebp + 0x10]
add eax, 2
dec edx
mov dword [ebp + 0x10], edx
jne 0x43e4b1
mov eax, dword [ebx + 4]
mov dword [ebx + 8], edi
mov word [eax + edi*2], 0
push eax
xor eax, eax
pop eax
je 0x43e4da
invalid
push esi
call fcn.00485078
mov ecx, dword [ebp - 0x30]
add esp, 4
push ecx
call fcn.00441680
push eax
xor eax, eax
pop eax
je 0x43e4f4
invalid
mov edx, dword [ebp + 0x28]
push edx
call fcn.00485078
add esp, 4
push 0
call fcn.0043f920
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
push eax
xor eax, eax
pop eax
je 0x43e51b
invalid
mov eax, dword [ebp - 0x3c]
push eax
call fcn.00485078
mov ecx, dword [ebp - 0x30]
add esp, 4
push ecx
call fcn.00441680
push eax
xor eax, eax
pop eax
je 0x43e538
invalid
mov edx, dword [ebp + 0x28]
push edx
call fcn.00485078
add esp, 4
push 0
call fcn.0043f920
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
push eax
xor eax, eax
pop eax
je 0x43e55f
invalid
push esi
call fcn.00485078
mov eax, dword [ebp - 0x30]
add esp, 4
push eax
call fcn.00441680
call fcn.0043eaf0
test eax, eax
jge 0x43e5e7
push str._rY6R
call fcn.0042ad02
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43e5c0
mov eax, dword [ebx + 4]
mov ecx, str._rY6R
test esi, esi
jbe 0x43e5b4
mov edx, esi
mov di, word [ecx]
add ecx, 2
mov word [eax], di
add eax, 2
dec edx
jne 0x43e5a5
mov ecx, dword [ebx + 4]
mov dword [ebx + 8], esi
mov word [ecx + esi*2], 0
push eax
xor eax, eax
pop eax
je 0x43e5c8
invalid
mov edx, dword [ebp + 0x28]
push edx
call fcn.00485078
add esp, 4
push 0
call fcn.0043f920
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov esi, dword [ebp + 0x28]
push 0xa98
push esi
push 0x40
push edi
call fcn.00406b40
push esi
call fcn.0043f730
test eax, eax
jge 0x43e6bb
push 0x4b4b58
call fcn.0042ad02
add esp, 4
mov ecx, ebx
mov esi, eax
call fcn.0040a250
cmp eax, esi
jae 0x43e625
call fcn.00479494
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x43e64a
mov al, byte [ecx - 1]
test al, al
je 0x43e64a
cmp al, 0xff
je 0x43e64a
test esi, esi
jne 0x43e66e
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00401800
jmp 0x43e694
test esi, esi
jne 0x43e659
push 1
mov ecx, ebx
call fcn.00401800
jmp 0x43e694
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x43e665
cmp eax, esi
jae 0x43e676
push 1
mov ecx, ebx
call fcn.00401800
push esi
mov ecx, ebx
call fcn.00401bb0
mov eax, dword [ebx + 4]
push esi
push 0x4b4b58
push eax
call fcn.004086c0
mov ecx, dword [ebx + 4]
mov dword [ebx + 8], esi
add esp, 0xc
mov word [ecx + esi*2], 0
push eax
xor eax, eax
pop eax
je 0x43e69c
invalid
mov edx, dword [ebp + 0x28]
push edx
call fcn.00485078
add esp, 4
push 0
call fcn.0043f920
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
push eax
xor eax, eax
pop eax
je 0x43e6c3
invalid
push esi
call fcn.00485078
mov al, byte [0x4c885d]
add esp, 4
test al, al
je 0x43e76f
push eax
xor eax, eax
pop eax
je 0x43e6e1
invalid
lea eax, [ebp + 0x10]
xor edi, edi
push eax
push 0x2001f
push edi
push str.SystemSelect
push reloc.WSOCK32.dll_bind
mov dword [ebp + 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43e76f
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0x24]
push ecx
push edx
push edi
push edi
push str.Current
push eax
mov dword [ebp + 0x24], edi
mov dword [ebp + 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43e761
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp + 0x24]
push ecx
push edx
push 4
push edi
push str.Default
push eax
call esi
test eax, eax
jne 0x43e761
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x24]
push ecx
push edx
push 4
push edi
push str.LastKnownGood
push eax
call esi
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x43e76f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x24