Function at 0x42a8db
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x45b0d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x468], eax
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x464], edx
lea eax, [ebp - 0x434]
mov dword [ebp - 0x460], edi
push eax
push 4
push ecx
push ecx
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x42c], ecx
push eax
push 0x2001f
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x430], ecx
push eax
mov dword [ebp - 0x44c], 0x18
mov dword [ebp - 0x448], ecx
mov dword [ebp - 0x440], 0x40
mov dword [ebp - 0x444], 0x401994
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x438], ecx
call dword [sym.imp.ntdll.dll_NtCreateKey]
mov esi, eax
test esi, esi
jns 0x42a9b0
push esi
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x4077e0
mov dword [ebp - 0x458], 0x4079a4
mov dword [ebp - 0x454], 0xcb
mov dword [ebp - 0x450], 0x407850
call fcn.0045365a
xor edi, edi
jmp 0x42ab7b
lea eax, [ebp - 0x430]
push eax
push 0x420
lea eax, [ebp - 0x428]
push eax
push 2
push 0x40199c
push dword [ebp - 0x42c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edx, 0x410
test eax, eax
js 0x42a9f8
cmp dword [ebp - 0x424], 3
jne 0x42a9f8
cmp dword [ebp - 0x420], edx
jne 0x42a9f8
mov eax, dword [ebp - 0x41c]
jmp 0x42aa37
push edx
lea eax, [ebp - 0x878]
push 0
push eax
call sub.ntdll.dll_memset
mov ecx, 0x104
lea esi, [ebp - 0x878]
lea edi, [ebp - 0x41c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x460]
add esp, 0xc
or dword [ebp - 0x418], 0xffffffff
mov edx, 0x410
mov dword [ebp - 0x41c], eax
xor ecx, ecx
mov word [ebp - 0x216], cx
mov word [ebp - 0xe], cx
cmp eax, 1
ja 0x42ab9b
push edx
push ecx
lea eax, [ebp - 0x41c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x41c], edi
test ebx, ebx
je 0x42aab9
mov eax, dword [ebp - 0x464]
mov esi, ebx
mov dword [ebp - 0x418], eax
xor edi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x42aa7b
sub esi, ecx
sar esi, 1
je 0x42aaad
cmp esi, 0x100
jb 0x42aa99
mov esi, 0xff
lea eax, [esi + esi]
push eax
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + esi*2 - 0x414], ax
jmp 0x42aacb
or dword [ebp - 0x418], 0xffffffff
xor eax, eax
mov word [ebp - 0x414], ax
xor edi, edi
mov edx, dword [ebp - 0x468]
test edx, edx
je 0x42ab18
mov esi, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x42aada
sub esi, ecx
sar esi, 1
je 0x42ab0c
cmp esi, 0x104
jb 0x42aaf8
mov esi, 0x103
lea eax, [esi + esi]
push eax
push edx
lea eax, [ebp - 0x214]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + esi*2 - 0x214], ax
jmp 0x42ab21
xor eax, eax
mov word [ebp - 0x214], ax
push 0x410
lea eax, [ebp - 0x41c]
push eax
push 3
push edi
push 0x40199c
push dword [ebp - 0x42c]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
test esi, esi
jns 0x42ab9d
push esi
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x4077e0
mov dword [ebp - 0x458], 0x4079a4
mov dword [ebp - 0x454], 0x12d
mov dword [ebp - 0x450], 0x4079e8
call fcn.0045365a
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x42ab97
cmp eax, 0xffffffff
je 0x42ab97
push eax
mov dword [ebp - 0x42c], edi
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x42abbb
xor edi, edi
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x42abb9
cmp eax, 0xffffffff
je 0x42abb9
push eax
mov dword [ebp - 0x42c], edi
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a80a
leave
ret 8