Function at 0x441a50
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x26c
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov dword [esp], 0x80000002
mov dword [esp + 0x10], eax
call esi
sub esp, 0x14
test eax, eax
jne 0x441e10
lea eax, [esp + 0x40]
lea ebp, [esp + 0x44]
mov dword [esp + 0x44], 4
mov dword [esp + 0x50], 4
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x14], ebp
mov dword [esp + 4], str.SystemRestorePointCreationFrequency
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
mov eax, 0xffffffff
cmove eax, dword [esp + 0x40]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0x20106
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov dword [esp], 0x80000002
call esi
sub esp, 0x14
test eax, eax
jne 0x441d90
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], str.SystemRestorePointCreationFrequency
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub esp, 0x18
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
mov dword [esp], str.SrClient.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
mov dword [ebx], eax
je 0x441d70
mov dword [esp + 4], str.SRSetRestorePointW
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov edi, eax
mov dword [esp + 0x2c], eax
mov eax, dword [ebx]
test edi, edi
setne dl
test eax, eax
setne cl
and dl, cl
mov byte [esp + 0x2b], dl
je 0x441d70
lea edi, [esp + 0x50]
xor eax, eax
mov ecx, 0x84
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x280]
mov dword [esp + 0x50], 0x64
mov dword [esp + 0x54], 0xa
mov eax, dword [eax]
mov dword [esp + 4], eax
lea eax, [esp + 0x60]
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy
test byte [0x8531c0], 0x40
je 0x441d10
mov dword [esp], 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
cmp dword [esp + 0x24], 0xfffffffe
movzx ebp, byte [esp + 0x2b]
je 0x441d63
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], 0x20106
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov dword [esp], 0x80000002
mov dword [esp + 0x10], eax
call esi
sub esp, 0x14
test eax, eax
jne 0x441dd0
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
mov dword [esp + 0x40], eax
je 0x441db0
lea eax, [esp + 0x40]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.SystemRestorePointCreationFrequency
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub esp, 0x18
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
mov eax, ebp
test al, al
jne 0x441d63
cmp dword [esp + 0x44], 0x422
je 0x441df0
mov dword [esp + 4], str.ERROR:_CreateRestorePoint_:_Failed_to_create_restore_point._n
mov dword [esp], 0x835180
call fcn.0041e920
mov eax, dword [ebx]
test eax, eax
je 0x441cf8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
add esp, 0x26c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea eax, [esp + 0x50]
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [esp + 0x2c]
sub esp, 8
test eax, eax
setne al
mov dword [esp + 4], str.Restore_Point:__d___d__n
mov dword [esp], 0x835180
mov ebp, eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], eax
mov eax, ebp
movzx eax, al
mov dword [esp + 8], eax
call fcn.0041f130
cmp dword [esp + 0x24], 0xfffffffe
jne 0x441c2d
mov eax, ebp
test al, al
je 0x441cc4
movzx ebp, byte [esp + 0x2b]
jmp 0x441ce6
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR:_CreateRestorePoint_:_Failed_to_create_restore_point__d_n
xor ebp, ebp
mov dword [esp], 0x835180
call fcn.0041e920
jmp 0x441ce6
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR_in_SetRestorePointCreationFrequency__:_error_in_RegOpenKeyEx__d_n
mov dword [esp], 0x835180
call fcn.0041e920
jmp 0x441b7e
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], str.SystemRestorePointCreationFrequency
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
sub esp, 8
jmp 0x441caa
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR_in_SetRestorePointCreationFrequency__:_error_in_RegOpenKeyEx__d_n
mov dword [esp], 0x835180
call fcn.0041e920
jmp 0x441cba
mov dword [esp + 4], str.ERROR:_CreateRestorePoint_:_Failed_to_create_restore_point._Restore_points_disabled._n
mov dword [esp], 0x835180
call fcn.0041e920
jmp 0x441ce6
mov dword [esp + 8], eax
mov dword [esp + 4], str.ERROR_in_GetRestorePointCreationFrequency__:_error_in_RegOpenKeyEx__d_n
lea ebp, [esp + 0x44]
mov dword [esp], 0x835180
call fcn.0041e920
mov dword [esp + 0x24], 0xfffffffe
jmp 0x441afe