Function at 0x43f5f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2908
call fcn.0042b9c0
push ebx
push esi
push edi
push eax
xor eax, eax
pop eax
je 0x43f608
invalid
push 0x4c05e0
call fcn.0042ad22
mov ebx, dword [ebp + 0x28]
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43f642
mov eax, dword [ebx + 4]
push esi
push 0x4c05e0
push eax
call fcn.004086c0
add esp, 0xc
mov ecx, ebx
push esi
call fcn.0040a230
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [ebp - 4], eax
je 0x43f678
movsx ecx, byte [eax + 0xc]
push ecx
call fcn.0042b7d4
add esp, 4
test eax, eax
je 0x43fe3f
lea ecx, [ebp - 4]
call fcn.00409860
mov eax, dword [ebp - 4]
mov ecx, dword [esi + 4]
cmp eax, ecx
jne 0x43f651
mov al, byte [0x4cb9a4]
test al, al
jne 0x43f6b7
mov al, byte [0x4cb9a5]
test al, al
jne 0x43f6b7
mov al, byte [0x4cb9a6]
test al, al
jne 0x43f6b7
mov al, byte [0x4cb9a7]
test al, al
jne 0x43f6b7
mov al, byte [0x4cb9a8]
test al, al
jne 0x43f6b7
mov al, byte [0x4cb9a9]
test al, al
jne 0x43f6b7
mov al, byte [0x4cb9aa]
test al, al
je 0x43f6c0
mov al, byte [0x4cb9ab]
test al, al
je 0x43f707
push 0x4b3b04
call fcn.0042ad22
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43fe3f
mov edx, dword [ebx + 4]
push esi
push 0x4b3b04
push edx
call fcn.004086c0
add esp, 0xc
mov ecx, ebx
push esi
call fcn.0040a230
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov eax, dword [0x4cb87c]
test eax, eax
je 0x43f721
mov ecx, 0x4cb878
call fcn.004096e0
mov eax, dword [0x4cb87c]
jmp 0x43f726
mov eax, 0x48e810
mov dl, byte [eax]
lea ecx, [ebp - 0x2c]
push ecx
push edx
call fcn.0043b530
test eax, eax
jge 0x43f763
push 0x4b7d28
call fcn.0042ad22
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43fe3f
mov eax, dword [ebx + 4]
push esi
push 0x4b7d28
push eax
jmp 0x43f6eb
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
add eax, edi
adc ecx, esi
cmp ecx, 0x200
jb 0x43f7b1
ja 0x43f781
test eax, eax
jbe 0x43f7b1
push 0x4b7cf0
call fcn.0042ad22
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43fe3f
mov ecx, dword [ebx + 4]
push esi
push 0x4b7cf0
push ecx
jmp 0x43f6eb
call fcn.0043ff10
test eax, eax
mov dword [ebp + 0x28], eax
je 0x43fe3f
mov edx, dword [ebp - 0x14]
mov esi, str.SystemRoot_system32driversdiskprofile.sys
mov dword [eax + 0x8c], edx
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0x90], ecx
mov ecx, 0x16
lea edi, [ebp - 0x98]
lea edx, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
push 0
push edx
push 0
movsw word es:[edi], word [esi]
call fcn.004428d0
mov esi, eax
test esi, esi
je 0x43f80e
push 0x80
push esi
call fcn.00442d20
push esi
call fcn.00442e10
push 0
lea eax, [ebp - 0x98]
push 0x4b7c8c
push eax
push 0
call fcn.00442be0
mov esi, eax
test esi, esi
je 0x43f99f
push 0x26
push esi
call fcn.00442d20
push 0
push 0x51c88
push esi
call fcn.00442d70
test eax, eax
jl 0x43f9cf
push esi
call fcn.00442e10
push 0
lea ecx, [ebp - 0x98]
push 0x4b3aec
push ecx
push 0
call fcn.00442be0
mov esi, eax
test esi, esi
je 0x43f9f8
mov edi, dword [ebp + 0x28]
push 0
push 0
lea eax, [edi + 0x98]
push eax
push esi
call fcn.00442e30
test eax, eax
mov dword [edi + 0x94], eax
je 0x43fa21
push esi
call fcn.00442e10
push 0
lea edx, [ebp - 0x98]
push 0x4b7c84
push edx
push 0
call fcn.00442be0
test eax, eax
mov dword [ebp - 0x30], eax
je 0x43fa6b
mov eax, dword [ebp + 0x28]
xor edi, edi
mov ecx, dword [eax + 0x94]
test ecx, ecx
jle 0x43f973
mov ecx, eax
lea esi, [ecx + 0x98]
cmp byte [ebp - 0x2c], 7
je 0x43f8e8
mov ecx, dword [esi]
add ecx, 2
mov dword [esi], ecx
mov eax, dword [esi + 4]
adc eax, 0
mov dword [esi + 4], eax
mov edx, dword [esi + 4]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x10]
push edx
push eax
push 0
push ecx
call fcn.0042ba60
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x43f914
mov ecx, dword [esi]
cdq
add ecx, eax
mov dword [esi], ecx
mov eax, dword [esi + 4]
adc eax, edx
jmp 0x43f922
mov ecx, dword [esi]
neg eax
cdq
sub ecx, eax
mov dword [esi], ecx
mov eax, dword [esi + 4]
sbb eax, edx
mov dword [esi + 4], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
push 0
push edx
push eax
push ecx
call fcn.0042b9f0
mov edx, dword [esi]
add edx, eax
mov dword [esi], edx
mov ecx, dword [esi + 4]
adc ecx, 0
mov dword [esi + 4], ecx
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0x10]
push edx
push eax
push 0
push ecx
call fcn.0042ba60
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov edx, dword [ebp + 0x28]
inc edi
add esi, 0x10
cmp edi, dword [edx + 0x94]
jl 0x43f8d2
call fcn.00440060
mov esi, eax
test esi, esi
mov dword [ebp - 0x3c], esi
jne 0x43faa4
mov eax, dword [ebp - 0x30]
push eax
call fcn.00442e10
push eax
xor eax, eax
pop eax
je 0x43f996
invalid
mov ecx, dword [ebp + 0x28]
push ecx
jmp 0x43fe30
push 0x4b7c64
call fcn.0042ad22
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43fa5e
mov eax, dword [ebx + 4]
push esi
push 0x4b7c64
push eax
jmp 0x43fa92
push 0x4b7c3c
call fcn.0042ad22
add esp, 4
mov edi, eax
mov ecx, ebx
push 1
push edi
call fcn.00401a80
test al, al
je 0x43fa58
mov ecx, dword [ebx + 4]
push edi
push 0x4b7c3c
push ecx
jmp 0x43fa48
push 0x4b7c1c
call fcn.0042ad22
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43fa5e
mov edx, dword [ebx + 4]
push esi
push 0x4b7c1c
push edx
jmp 0x43fa92
push 0x4b7bec
call fcn.0042ad22
add esp, 4
mov edi, eax
mov ecx, ebx
push 1
push edi
call fcn.00401a80
test al, al
je 0x43fa58
mov eax, dword [ebx + 4]
push edi
push 0x4b7bec
push eax
call fcn.004086c0
add esp, 0xc
mov ecx, ebx
push edi
call fcn.0040a230
push esi
call fcn.00442e10
push eax
xor eax, eax
pop eax
je 0x43fa66
invalid
jmp 0x43fe2c
push 0x4b7bcc
call fcn.0042ad22
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43fa5e
mov ecx, dword [ebx + 4]
push esi
push 0x4b7bcc
push ecx
call fcn.004086c0
add esp, 0xc
mov ecx, ebx
push esi
call fcn.0040a230
jmp 0x43fa5e
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx + 4]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [ebp - 4], eax
je 0x43fb30
add esi, 0x18
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], esi
mov ecx, dword [ebp - 0x34]
lea edx, [ebp - 0x2908]
mov dword [0x4cb9d0], ecx
mov al, byte [eax + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push edx
push eax
push ecx
call fcn.00441c40
test eax, eax
jl 0x43fca3
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov edi, eax
add eax, 0x2870
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov ecx, 0xa1c
lea esi, [ebp - 0x2908]
add edx, 0x64
test eax, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], edx
je 0x43fb1a
push 0
push 0x64
push 0
push 0x64
call eax
lea ecx, [ebp - 4]
call fcn.00409860
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 4]
jne 0x43fac0
mov esi, dword [ebp - 0x3c]
mov al, byte [ebp + 0x10]
test al, al
je 0x43fb3e
or byte [esi + 0x41b78], 1
mov al, byte [ebp + 0x14]
test al, al
je 0x43fb4c
or byte [esi + 0x41b78], 2
mov al, byte [ebp + 0x24]
test al, al
je 0x43fb5a
or byte [esi + 0x41b78], 0x80
mov eax, dword [ebp + 0x18]
lea edi, [esi + 0x41bf8]
push eax
push edi
call fcn.004087f0
lea ecx, [esi + 0x41bb8]
push edi
push ecx
call fcn.004185d0
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx + 4]
test eax, eax
jne 0x43fb86
mov eax, 0x48e810
push 0xf
push eax
lea eax, [esi + 0x41c58]
push eax
call fcn.00432900
mov cx, word [ebp + 0x20]
add esp, 0xc
mov word [esi + 0x41c68], cx
push eax
xor eax, eax
pop eax
je 0x43fbab
invalid
lea ecx, [esi + 0x41c88]
xor edi, edi
cmp esi, ecx
mov eax, esi
je 0x43fbc4
xor edx, edx
mov dl, byte [eax]
add edi, edx
inc eax
cmp eax, ecx
jne 0x43fbb9
lea ecx, [esi + 0x10]
lea edx, [esi + 0x14]
mov eax, ecx
cmp eax, edx
je 0x43fbde
xor edx, edx
mov dl, byte [eax]
sub edi, edx
inc eax
lea edx, [esi + 0x14]
cmp eax, edx
jne 0x43fbd0
mov eax, dword [ebp + 0x28]
mov dword [ecx], edi
push 0x41c88
push esi
lea edi, [eax + 0xa98]
push 0x40
push edi
call fcn.00406b40
mov ecx, dword [ebp - 0x30]
push 0
push 0
push 0x41c88
push esi
push ecx
call fcn.00442cb0
cmp eax, 0x41c88
je 0x43fce7
push 0x4b7bb8
call fcn.0042ad22
add esp, 4
mov edi, eax
mov ecx, ebx
push 1
push edi
call fcn.00401a80
test al, al
je 0x43fc62
mov eax, dword [ebx + 4]
mov ecx, 0x4b7bb8
test edi, edi
jbe 0x43fc56
mov dword [ebp + 0x10], edi
mov dx, word [ecx]
add ecx, 2
mov word [eax], dx
mov edx, dword [ebp + 0x10]
add eax, 2
dec edx
mov dword [ebp + 0x10], edx
jne 0x43fc41
mov eax, dword [ebx + 4]
mov dword [ebx + 8], edi
mov word [eax + edi*2], 0
push eax
xor eax, eax
pop eax
je 0x43fc6a
invalid
push esi
call fcn.00486808
mov ecx, dword [ebp - 0x30]
add esp, 4
push ecx
call fcn.00442e10
push eax
xor eax, eax
pop eax
je 0x43fc84
invalid
mov edx, dword [ebp + 0x28]
push edx
call fcn.00486808
add esp, 4
push 0
call fcn.004410b0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
push eax
xor eax, eax
pop eax
je 0x43fcab
invalid
mov eax, dword [ebp - 0x3c]
push eax
call fcn.00486808
mov ecx, dword [ebp - 0x30]
add esp, 4
push ecx
call fcn.00442e10
push eax
xor eax, eax
pop eax
je 0x43fcc8
invalid
mov edx, dword [ebp + 0x28]
push edx
call fcn.00486808
add esp, 4
push 0
call fcn.004410b0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
push eax
xor eax, eax
pop eax
je 0x43fcef
invalid
push esi
call fcn.00486808
mov eax, dword [ebp - 0x30]
add esp, 4
push eax
call fcn.00442e10
call fcn.00440280
test eax, eax
jge 0x43fd77
push str._rY6R
call fcn.0042ad22
add esp, 4
mov esi, eax
mov ecx, ebx
push 1
push esi
call fcn.00401a80
test al, al
je 0x43fd50
mov eax, dword [ebx + 4]
mov ecx, str._rY6R
test esi, esi
jbe 0x43fd44
mov edx, esi
mov di, word [ecx]
add ecx, 2
mov word [eax], di
add eax, 2
dec edx
jne 0x43fd35
mov ecx, dword [ebx + 4]
mov dword [ebx + 8], esi
mov word [ecx + esi*2], 0
push eax
xor eax, eax
pop eax
je 0x43fd58
invalid
mov edx, dword [ebp + 0x28]
push edx
call fcn.00486808
add esp, 4
push 0
call fcn.004410b0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov esi, dword [ebp + 0x28]
push 0xa98
push esi
push 0x40
push edi
call fcn.00406b40
push esi
call fcn.00440ec0
test eax, eax
jge 0x43fe4b
push 0x4b7b98
call fcn.0042ad22
add esp, 4
mov ecx, ebx
mov esi, eax
call fcn.0040a250
cmp eax, esi
jae 0x43fdb5
call fcn.0047ac24
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x43fdda
mov al, byte [ecx - 1]
test al, al
je 0x43fdda
cmp al, 0xff
je 0x43fdda
test esi, esi
jne 0x43fdfe
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00401800
jmp 0x43fe24
test esi, esi
jne 0x43fde9
push 1
mov ecx, ebx
call fcn.00401800
jmp 0x43fe24
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x43fdf5
cmp eax, esi
jae 0x43fe06
push 1
mov ecx, ebx
call fcn.00401800
push esi
mov ecx, ebx
call fcn.00401bb0
mov eax, dword [ebx + 4]
push esi
push 0x4b7b98
push eax
call fcn.004086c0
mov ecx, dword [ebx + 4]
mov dword [ebx + 8], esi
add esp, 0xc
mov word [ecx + esi*2], 0
push eax
xor eax, eax
pop eax
je 0x43fe2c
invalid
mov edx, dword [ebp + 0x28]
push edx
call fcn.00486808
add esp, 4
push 0
call fcn.004410b0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
push eax
xor eax, eax
pop eax
je 0x43fe53
invalid
push esi
call fcn.00486808
mov al, byte [0x4cb9ad]
add esp, 4
test al, al
je 0x43feff
push eax
xor eax, eax
pop eax
je 0x43fe71
invalid
lea eax, [ebp + 0x10]
xor edi, edi
push eax
push 0x2001f
push edi
push str.SystemSelect
push reloc.WSOCK32.dll_bind
mov dword [ebp + 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43feff
mov eax, dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
lea edx, [ebp + 0x24]
push ecx
push edx
push edi
push edi
push str.Current
push eax
mov dword [ebp + 0x24], edi
mov dword [ebp + 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43fef1
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp + 0x24]
push ecx
push edx
push 4
push edi
push str.Default
push eax
call esi
test eax, eax
jne 0x43fef1
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x24]
push ecx
push edx
push 4
push edi
push str.LastKnownGood
push eax
call esi
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x43feff
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x24