Function at 0x425e40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x48c7f6
mov eax, dword fs:[0]
push eax
mov eax, 0x101e4
call fcn.0046be90
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x101e0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b77c0]
xor eax, esp
push eax
lea eax, [esp + 0x101f8]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x10210]
xor ebx, ebx
mov edi, 0xf
mov dword [esp + 0x14], ecx
mov dword [esp + 0x164], edi
mov dword [esp + 0x160], ebx
mov byte [esp + 0x150], bl
mov dword [esp + 0x10200], ebx
mov dword [esp + 0x148], edi
mov dword [esp + 0x144], ebx
mov byte [esp + 0x134], bl
mov esi, dword [esp + 0x1020c]
cmp esi, ebx
mov byte [esp + 0x10200], 1
jl 0x42659f
cmp esi, 1
jle 0x425f63
cmp esi, 2
jne 0x42659f
push 0xb
call fcn.004369c0
add esp, 4
test eax, eax
je 0x42655d
push str.truecrypt.sys
lea ecx, [esp + 0x150]
call fcn.0040c6a0
push str.DumpFilters
lea ecx, [esp + 0x134]
call fcn.0040c6a0
lea eax, [esp + 0x18]
push eax
push 0x2001f
push ebx
push str.SYSTEMCurrentControlSetControlCrashControl
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x425fbf
lea ecx, [esp + 0x24]
call fcn.0041e690
push 0x4abaa8
lea ecx, [esp + 0x28]
push ecx
call fcn.0046b8cf
push 9
push str.truecrypt
lea ecx, [esp + 0x154]
call fcn.0040c450
push 0xc
push str.UpperFilters
lea ecx, [esp + 0x138]
call fcn.0040c450
push 0x2001f
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x425fc3
mov dword [esp + 0x2c], vtable.TrueCrypt::SystemException.0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x4abaa8
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x38], eax
call fcn.0046b8cf
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x10200], 2
cmp byte [esp + 0x10208], bl
je 0x4260ca
cmp esi, 2
je 0x4260ca
mov esi, dword [esp + 0x160]
inc esi
mov eax, 0x10000
sub eax, esi
mov edi, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x150]
cmp dword [esp + 0x164], edi
jae 0x426014
lea eax, [esp + 0x150]
push 0x10000
push eax
lea ecx, [esp + 0x1fc]
push ecx
call fcn.0046d760
mov eax, dword [esp + 0x140]
add esp, 0xc
cmp dword [esp + 0x148], edi
jae 0x426041
lea eax, [esp + 0x134]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + esi + 0x1f8]
push ecx
push ebx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x426068
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x134]
cmp dword [esp + 0x148], edi
jae 0x42607f
lea eax, [esp + 0x134]
mov ecx, dword [esp + 0x14]
add ecx, esi
push ecx
lea edx, [esp + 0x1f8]
push edx
push 7
push ebx
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x426554
lea ecx, [esp + 0x24]
call fcn.0041e690
push 0x4abaa8
lea ecx, [esp + 0x28]
push ecx
call fcn.0046b8cf
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x34]
push edx
call fcn.00421b30
push str._truecrypt_driver_setup.inf
push eax
lea eax, [esp + 0x170]
push eax
mov byte [esp + 0x1020c], 3
call fcn.004211b0
add esp, 0xc
mov ebp, 0x10
mov byte [esp + 0x10200], 5
cmp dword [esp + 0x4c], ebp
jb 0x426116
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0046b849
add esp, 4
push 1
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x194]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
mov byte [ecx + 4], bl
call fcn.0040c370
lea ecx, [esp + 0x1c4]
call fcn.00421620
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x18c]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x10228], 6
mov byte [ecx + 4], bl
call fcn.0040c370
lea esi, [esp + 0x1f4]
call fcn.00420bf0
mov byte [esp + 0x10200], 7
cmp byte [esp + 0x10208], bl
je 0x4261a6
mov eax, str.0008
mov edi, 0x493044
jmp 0x4261b0
mov eax, str.8002
mov edi, 0x493038
push eax
lea ecx, [esp + 0xc4]
call fcn.0040ca30
mov esi, eax
push edi
lea ecx, [esp + 0x118]
mov byte [esp + 0x10204], 8
call fcn.0040ca30
push eax
lea ecx, [esp + 0x8c]
push str._truecrypt__r_n
push ecx
mov byte [esp + 0x1020c], 9
call fcn.004210f0
push str.Regtruecrypt_reg_r_n_r_n_truecrypt_reg__r_nHKR___
push eax
lea edx, [esp + 0x80]
push edx
mov byte [esp + 0x10218], 0xa
call fcn.004211b0
lea ecx, [esp + 0x148]
push ecx
push eax
lea edx, [esp + 0xc4]
push edx
mov byte [esp + 0x10224], 0xb
call fcn.0040c6d0
push str.__0x0001
push eax
lea eax, [esp + 0x124]
push eax
mov byte [esp + 0x10230], 0xc
call fcn.004211b0
push esi
push eax
lea ecx, [esp + 0x88]
push ecx
mov byte [esp + 0x1023c], 0xd
call fcn.0040c6d0
push 0x492fe8
push eax
lea edx, [esp + 0x120]
push edx
mov byte [esp + 0x10248], 0xe
call fcn.004211b0
add esp, 0x48
lea ecx, [esp + 0x14c]
push ecx
push eax
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x1020c], 0xf
call fcn.0040c6d0
push 0x492fe4
push eax
lea eax, [esp + 0x198]
push eax
mov byte [esp + 0x10218], 0x10
call fcn.004211b0
add esp, 0x18
cmp dword [esp + 0x4c], ebp
jb 0x4262c4
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0046b849
add esp, 4
mov esi, 0xf
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
cmp dword [esp + 0xf4], ebp
jb 0x4262ee
mov edx, dword [esp + 0xe0]
push edx
call fcn.0046b849
add esp, 4
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
cmp dword [esp + 0x68], ebp
jb 0x426316
mov eax, dword [esp + 0x54]
push eax
call fcn.0046b849
add esp, 4
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
cmp dword [esp + 0x110], ebp
jb 0x42633b
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.0046b849
add esp, 4
mov dword [esp + 0x110], esi
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
cmp dword [esp + 0xbc], ebp
jb 0x426369
mov edx, dword [esp + 0xa8]
push edx
call fcn.0046b849
add esp, 4
mov dword [esp + 0xbc], esi
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
cmp dword [esp + 0x84], ebp
jb 0x426394
mov eax, dword [esp + 0x70]
push eax
call fcn.0046b849
add esp, 4
mov dword [esp + 0x84], esi
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
cmp dword [esp + 0xa0], ebp
jb 0x4263bf
mov ecx, dword [esp + 0x8c]
push ecx
call fcn.0046b849
add esp, 4
mov dword [esp + 0xa0], esi
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
cmp dword [esp + 0x12c], ebp
jb 0x4263ed
mov edx, dword [esp + 0x118]
push edx
call fcn.0046b849
add esp, 4
mov dword [esp + 0x12c], esi
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
mov byte [esp + 0x10200], 0x1a
cmp dword [esp + 0xd8], ebp
jb 0x426423
mov eax, dword [esp + 0xc4]
push eax
call fcn.0046b849
add esp, 4
mov eax, dword [esp + 0x188]
mov dword [esp + 0xd8], esi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
cmp dword [esp + 0x19c], ebp
jae 0x42644f
lea eax, [esp + 0x188]
mov ecx, dword [esp + 0x198]
push ecx
push eax
lea ecx, [esp + 0x1a8]
call fcn.00425bc0
cmp byte [esp + 0x1a1], bl
je 0x42648b
cmp byte [esp + 0x1a0], bl
jne 0x426484
mov edx, dword [esp + 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x1a1], bl
mov eax, dword [esp + 0x16c]
cmp dword [esp + 0x180], ebp
jae 0x4264a2
lea eax, [esp + 0x16c]
push ebx
push 3
push ebx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
cmp eax, 0xffffffff
jne 0x4264d3
mov dword [esp + 0x1c], vtable.TrueCrypt::SystemException.0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x20], eax
push 0x4abaa8
lea eax, [esp + 0x20]
push eax
call fcn.0046b8cf
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push 4
push str.truecrypt
push eax
mov eax, dword [edx]
push eax
mov byte [esp + 0x1022c], 0x1b
call dword [sym.imp.SETUPAPI.dll_SetupInstallFromInfSectionA]
test eax, eax
jne 0x42651b
lea ecx, [esp + 0x24]
call fcn.0041e690
push 0x4abaa8
lea ecx, [esp + 0x28]
push ecx
call fcn.0046b8cf
lea eax, [esp + 0x1c]
call fcn.0041e240
lea ecx, [esp + 0x184]
call fcn.0042e890
lea esi, [esp + 0x1d8]
call fcn.00420710
lea ecx, [esp + 0x1a0]
call fcn.0041dc80
lea ecx, [esp + 0x168]
call fcn.0042e890
lea eax, [esp + 0x2c]
call fcn.0041e230
lea ecx, [esp + 0x130]
call fcn.0042e890
lea ecx, [esp + 0x14c]
call fcn.0042e890
mov ecx, dword [esp + 0x101f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x101e0]
xor ecx, esp
call fcn.0046be7b
add esp, 0x101f0
ret 0xc
push 0x4abae0
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], vtable.TrueCrypt::ParameterIncorrect.0
mov dword [esp + 0x28], str.TrueCrypt::BootEncryption::RegisterFilter:1704
call fcn.0046b8cf
int3