Function at 0x43d490
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebp
push esi
push edi
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x3f
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20007
push 0
push 0
push 0
push 0x406524
push 0x80000001
mov byte [esp + 0x30], 0
mov byte [esp + 0x31], 0
mov byte [esp + 0x32], 0
mov byte [esp + 0x33], 0
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x43d805
mov ecx, dword [esp + 0x10]
mov dl, byte [0x462f70]
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExA]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x406518
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43d805
mov ecx, dword [esp + 0x10]
mov dl, byte [0x46307c]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x40650c
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43d805
mov al, byte [0x462e44]
test al, al
jne 0x43d581
mov ecx, dword [esp + 0x10]
mov dl, byte [0x46336c]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x406504
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43d805
mov ecx, dword [esp + 0x10]
mov dl, byte [0x463231]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4064f4
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43d805
mov ecx, dword [esp + 0x10]
mov dl, byte [0x462e2c]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4064e4
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43d805
mov ecx, dword [esp + 0x10]
mov dl, byte [0x462c80]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4064d8
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43d805
mov ecx, dword [esp + 0x10]
mov dl, byte [0x462df8]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4064c4
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43d805
mov ecx, dword [esp + 0x10]
mov dl, byte [0x463230]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4064bc
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43d805
mov al, byte [0x462e44]
test al, al
jne 0x43d680
mov ecx, dword [esp + 0x10]
mov dl, byte [0x46325c]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4064b4
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43d805
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.advapi32.dll_RegCloseKey]
push edx
call ebp
call fcn.0043d150
test al, al
je 0x43d86f
mov al, byte [0x463231]
test al, al
je 0x43d821
push 0xff
lea eax, [esp + 0x1d]
push eax
push 0
mov byte [esp + 0x24], 0x22
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d6c5
sub eax, edx
lea edi, [esp + 0x18]
mov byte [esp + eax + 0x18], 0x22
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x43d6d8
mov ecx, dword [0x406604]
mov dx, word [0x406608]
mov dword [edi], ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push 0x4065dc
mov word [edi + 4], dx
mov edi, dword [sym.imp.advapi32.dll_RegCreateKeyExA]
push 0x80000000
call edi
test eax, eax
jne 0x43d805
lea eax, [esp + 0x18]
lea edx, [eax + 1]
jmp 0x43d730
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d730
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x43d805
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x4065b4
push 0x80000000
call edi
test eax, eax
jne 0x43d805
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d790
sub eax, edx
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push 0
push edx
call esi
test eax, eax
jne 0x43d805
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push 0x406590
push 0x80000000
call edi
test eax, eax
jne 0x43d805
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43d7e5
mov ecx, dword [esp + 0x10]
sub eax, edx
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0
push ecx
call esi
test eax, eax
je 0x43d80e
xor eax, eax
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.advapi32.dll_RegDeleteKeyA]
push 0x4065dc
push 0x80000000
call esi
push 0x406570
push 0x80000000
call esi
push 0x4065b4
push 0x80000000
call esi
push 0x406550
push 0x80000000
call esi
push 0x406590
push 0x80000000
call esi
push 0x406534
push 0x80000000
call esi
pop edi
mov eax, 1
pop esi
pop ebp
mov esp, ebp
pop ebp
ret