Function at 0x4428da
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov esi, str.DeviceKFC_
lea edi, [ebp - 0x72c]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.DLL_SysReAllocString
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x442ab2
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x442a88
inc dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea edx, [ebp - 0x52c]
push edx
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x442a88
mov dword [ebp - 0x20], pe_nt_image_headers32
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x22c]
push eax
push 0
push 0
push str.ComponentId
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4429a1
lea edx, [ebp - 0x22c]
push edx
call fcn.00442526
pop ecx
test al, al
je 0x4429a1
mov dword [ebp - 0x2c], 8
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.Linkage
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4429cf
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x442a88
mov dword [ebp - 0x20], 0x100
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x82c]
push edx
push 0
push 0
push str.Export
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x442a0d
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x442a88
lea ecx, [ebp - 0x82c]
push ecx
call fcn.004c08dc
pop ecx
mov ebx, eax
push 0x699917
call fcn.004c08dc
pop ecx
cmp ebx, eax
jb 0x442a88
push 0x699925
call fcn.004c08dc
pop ecx
lea edx, [ebp - 0x82c]
add eax, edx
push eax
lea eax, [ebp - 0x72c]
push eax
push 0x699920
push 0x100
lea ecx, [ebp - 0x32c]
push ecx
call fcn.00441c62
add esp, 0x14
mov byte [ebp - 0x22d], 0
push dword [ebp - 0x2c]
lea eax, [ebp - 0x32c]
push eax
call fcn.00442545
add esp, 8
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x100
lea edx, [ebp - 0x52c]
push edx
push dword [ebp - 0x1c]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegEnumKeyW
mov dword [ebp - 0x18], eax
test eax, eax
je 0x44292e
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesTcpipLinkage
push reloc.OLEAUT32.DLL_SysReAllocString
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x442bc3
lea ecx, [ebp - 0x10]
push ecx
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0x69998e
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
add edx, 2
push edx
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x442b19
xor eax, eax
jmp 0x442bc5
lea edx, [ebp - 0x10]
push edx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x24]
push ecx
push 0
push str.bind
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
cmp byte [edx + ecx], 0
je 0x442ba7
push 0x69999d
call fcn.004c08dc
pop ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x1c]
add eax, edx
push eax
lea eax, [ebp - 0x72c]
push eax
push str._s_s
push 0x100
lea ecx, [ebp - 0x32c]
push ecx
call fcn.00441c62
add esp, 0x14
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x1c]
push eax
call fcn.004c08dc
pop ecx
inc eax
add dword [ebp - 0x1c], eax
push 0
lea edx, [ebp - 0x32c]
push edx
call fcn.00442545
add esp, 8
jmp 0x442b43
push dword [ebp - 0x28]
call sub.KERNEL32.DLL_GlobalHandle
push eax
call sub.KERNEL32.DLL_GlobalUnlock
push dword [ebp - 0x28]
call sub.KERNEL32.DLL_GlobalHandle
push eax
call sub.KERNEL32.DLL_GlobalFree
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret