Function at 0x43d5c0
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x147c
call fcn.00467540
push esi
push edi
mov ecx, 5
mov esi, str.CheckRegistryKeys__
lea edi, [esp + 0x18]
lea eax, [esp + 0x127c]
push 0x104
push eax
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x17], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x43d63a
push 0x4e3c3c
lea ecx, [esp + 0x78]
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d25a4]
lea edx, [esp + 0x24]
push 0xd4c
push edx
lea ecx, [esp + 0x88]
push eax
push ecx
call fcn.0043c750
add esp, 0x1c
mov eax, 0x10
pop edi
pop esi
add esp, 0x147c
ret
mov edx, dword [str.eCopIP.ini]
push ebx
push ebp
lea eax, [esp + 0x1284]
push edx
push eax
push 0x4df9ac
lea ecx, [esp + 0x1394]
push 0x103
push ecx
call fcn.00466ca7
lea edx, [esp + 0x48]
lea eax, [esp + 0x139c]
push edx
push eax
call fcn.0043ee00
add esp, 0x1c
mov edx, dword [str.SOFTWAREBaosight]
xor ebx, ebx
lea ecx, [esp + 0x10]
push ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push 0x80000002
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x43d6e6
mov eax, dword [str.SOFTWAREBaosight]
lea ecx, [esp + 0x7c]
push eax
push 0x4e6220
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d25a4]
lea edx, [esp + 0x30]
push 0xd59
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43d6ed
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, dword [str.SOFTWAREBaosightlsagent]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push 0x80000002
call ebp
test eax, eax
je 0x43d750
mov edx, dword [str.SOFTWAREBaosightlsagent]
lea eax, [esp + 0x7c]
push edx
push 0x4e6220
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [0x4d25a4]
lea ecx, [esp + 0x30]
push 0xd68
push ecx
lea eax, [esp + 0x94]
push edx
push eax
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43d757
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov eax, dword [str.SOFTWAREBaosightlsagentgeneral]
lea edx, [esp + 0x10]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x43d7c8
mov ecx, dword [str.SOFTWAREBaosightlsagentgeneral]
lea edx, [esp + 0x7c]
push ecx
push 0x4e6220
push 0xfff
push edx
call fcn.00466ca7
mov ecx, dword [0x4d25a4]
lea eax, [esp + 0x30]
push 0xd77
push eax
lea edx, [esp + 0x94]
push ecx
push edx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43db9f
mov ecx, dword [str.computerid]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43d7fe
mov ecx, dword [str.computerid]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [str.firsttime]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43d838
mov ecx, dword [str.firsttime]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], 1
call esi
mov ecx, dword [str.timestamp]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43d86e
mov ecx, dword [str.timestamp]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [str.funccode]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43d8a4
mov ecx, dword [str.funccode]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [str.ifinfosubmit]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43d8da
mov ecx, dword [str.ifinfosubmit]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [str.logfiletype]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43d91d
mov edx, dword [0x4d2868]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [str.logfiletype]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 1
push ebx
push eax
push ecx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [str.loglevel]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43d955
mov eax, dword [str.loglevel]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], 6
call esi
mov eax, dword [str.backupcount]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43d98d
mov eax, dword [str.backupcount]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], 7
call esi
mov eax, dword [str.encryptcode]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43d9c1
mov eax, dword [str.encryptcode]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], ebx
call esi
mov eax, dword [str.ejectflag]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43d9f5
mov eax, dword [str.ejectflag]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], ebx
call esi
mov eax, dword [str.ecopport]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43da2d
mov eax, dword [str.ecopport]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], 0x1bb
call esi
mov eax, dword [str.ecopip]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43da6f
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x34]
repne scasb al, byte es:[edi]
mov eax, dword [str.ecopip]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 1
push ebx
push eax
push ecx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [str.agentversion]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43dab1
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x44]
repne scasb al, byte es:[edi]
mov eax, dword [str.agentversion]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 1
push ebx
push eax
push ecx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [str.digest]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43db94
lea edx, [esp + 0x107c]
push 0x104
push edx
push 0x4df7a8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x43db2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e61fc
lea eax, [esp + 0x84]
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [0x4d25a4]
lea ecx, [esp + 0x30]
push 0xdc1
push ecx
lea eax, [esp + 0x94]
push edx
push eax
call fcn.0043c750
add esp, 0x20
jmp 0x43db94
mov ecx, dword [str.LSAgent.exe]
lea edx, [esp + 0x107c]
push ecx
push edx
push 0x4df9ac
lea eax, [esp + 0x118c]
push 0x103
push eax
call fcn.00466ca7
lea ecx, [esp + 0x6c]
push 0x21
lea edx, [esp + 0x1198]
push ecx
push edx
call fcn.0043eb70
add esp, 0x20
test eax, eax
jne 0x43db94
lea edi, [esp + 0x58]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x58]
not ecx
push ecx
mov ecx, dword [str.digest]
push eax
push 1
push ebx
push ecx
push edx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [str.SOFTWAREBaosightlsagentdevcon]
lea ecx, [esp + 0x10]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push 0x80000002
call ebp
test eax, eax
je 0x43dc00
mov eax, dword [str.SOFTWAREBaosightlsagentdevcon]
lea ecx, [esp + 0x7c]
push eax
push 0x4e6220
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d25a4]
lea edx, [esp + 0x30]
push 0xdd6
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43dc3f
mov eax, dword [str.devconcode]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43dc34
mov eax, dword [str.devconcode]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], ebx
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [str.SOFTWAREBaosightlsagentillegalinterdict]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push 0x80000002
call ebp
test eax, eax
je 0x43dca5
mov edx, dword [str.SOFTWAREBaosightlsagentillegalinterdict]
lea eax, [esp + 0x7c]
push edx
push 0x4e6220
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [0x4d25a4]
lea ecx, [esp + 0x30]
push 0xdea
push ecx
lea eax, [esp + 0x94]
push edx
push eax
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43dd88
mov edx, dword [str.permitinterdict]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call edi
test eax, eax
je 0x43dcdb
mov edx, dword [str.permitinterdict]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call esi
mov edx, dword [str.illegalrecovermode]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call edi
test eax, eax
je 0x43dd11
mov edx, dword [str.illegalrecovermode]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call esi
mov edx, dword [str.illegalneedrecover]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call edi
test eax, eax
je 0x43dd47
mov edx, dword [str.illegalneedrecover]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call esi
mov edx, dword [str.interdicttime]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call edi
test eax, eax
je 0x43dd7d
mov edx, dword [str.interdicttime]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [str.SOFTWAREBaosightlsagenthardware]
lea edx, [esp + 0x10]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call ebp
test eax, eax
je 0x43ddea
mov ecx, dword [str.SOFTWAREBaosightlsagenthardware]
lea edx, [esp + 0x7c]
push ecx
push 0x4e6220
push 0xfff
push edx
call fcn.00466ca7
mov ecx, dword [0x4d25a4]
lea eax, [esp + 0x30]
push 0xe0d
push eax
lea edx, [esp + 0x94]
push ecx
push edx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43ddf5
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [str.SOFTWAREBaosightlsagent_software]
lea ecx, [esp + 0x10]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push 0x80000002
call ebp
test eax, eax
je 0x43de56
mov eax, dword [str.SOFTWAREBaosightlsagent_software]
lea ecx, [esp + 0x7c]
push eax
push 0x4e6220
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d25a4]
lea edx, [esp + 0x30]
push 0xe1c
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43de61
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [str.SOFTWAREBaosightlsagent_softwarecon]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push 0x80000002
call ebp
test eax, eax
je 0x43dec4
mov edx, dword [str.SOFTWAREBaosightlsagent_softwarecon]
lea eax, [esp + 0x7c]
push edx
push 0x4e6220
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [0x4d25a4]
lea ecx, [esp + 0x30]
push 0xe2b
push ecx
lea eax, [esp + 0x94]
push edx
push eax
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43df05
mov edx, dword [str.softcount]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call edi
test eax, eax
je 0x43defa
mov edx, dword [str.softcount]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [str.SOFTWAREBaosightlsagentexdetect]
lea edx, [esp + 0x10]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call ebp
test eax, eax
je 0x43df6a
mov ecx, dword [str.SOFTWAREBaosightlsagentexdetect]
lea edx, [esp + 0x7c]
push ecx
push 0x4e6220
push 0xfff
push edx
call fcn.00466ca7
mov ecx, dword [0x4d25a4]
lea eax, [esp + 0x30]
push 0xe3f
push eax
lea edx, [esp + 0x94]
push ecx
push edx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e1b7
mov ecx, dword [str.scanperiod]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43dfa4
mov ecx, dword [str.scanperiod]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], 0x3c
call esi
mov ecx, dword [str.permitexlink]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43dfde
mov ecx, dword [str.permitexlink]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], 1
call esi
mov ecx, dword [str.interdictmode]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43e014
mov ecx, dword [str.interdictmode]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [str.recovermode]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43e04a
mov ecx, dword [str.recovermode]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [str.needrecover]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43e080
mov ecx, dword [str.needrecover]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [str.scangateway]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43e0ba
mov ecx, dword [str.scangateway]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], 1
call esi
mov ecx, dword [str.defaultrouter]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43e0fd
mov edx, dword [str.127.0.0.1]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [str.defaultrouter]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 1
push ebx
push eax
push ecx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [str.alarmmsg]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43e140
mov edx, dword [0x4d2824]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
push ecx
push edx
mov edx, dword [str.alarmmsg]
push 1
push ebx
push edx
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [str.manualrecovermode]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call edi
test eax, eax
je 0x43e176
mov edx, dword [str.manualrecovermode]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call esi
mov edx, dword [str.manualneedrecover]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call edi
test eax, eax
je 0x43e1ac
mov edx, dword [str.manualneedrecover]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [str.SOFTWAREBaosightlsagentUSBAuthenticate]
lea edx, [esp + 0x10]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call ebp
test eax, eax
je 0x43e219
mov ecx, dword [str.SOFTWAREBaosightlsagentUSBAuthenticate]
lea edx, [esp + 0x7c]
push ecx
push 0x4e6220
push 0xfff
push edx
call fcn.00466ca7
mov ecx, dword [0x4d25a4]
lea eax, [esp + 0x30]
push 0xe80
push eax
lea edx, [esp + 0x94]
push ecx
push edx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e25a
mov ecx, dword [str.checkpolicy]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43e24f
mov ecx, dword [str.checkpolicy]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], ebx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [str.SOFTWAREBaosightlsagentUSBAuthenticateUSBList]
lea ecx, [esp + 0x10]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push 0x80000002
call ebp
test eax, eax
je 0x43e2bb
mov eax, dword [str.SOFTWAREBaosightlsagentUSBAuthenticateUSBList]
lea ecx, [esp + 0x7c]
push eax
push 0x4e6220
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d25a4]
lea edx, [esp + 0x30]
push 0xe94
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e2fa
mov eax, dword [str.count]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43e2ef
mov eax, dword [str.count]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], ebx
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [str.SOFTWAREBaosightlsagentUSBAuthenticateillegalrecord]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push 0x80000002
call ebp
test eax, eax
je 0x43e35d
mov edx, dword [str.SOFTWAREBaosightlsagentUSBAuthenticateillegalrecord]
lea eax, [esp + 0x7c]
push edx
push 0x4e6220
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [0x4d25a4]
lea ecx, [esp + 0x30]
push 0xea8
push ecx
lea eax, [esp + 0x94]
push edx
push eax
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e39e
mov edx, dword [str.count]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call edi
test eax, eax
je 0x43e393
mov edx, dword [str.count]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [str.SOFTWAREBaosightlsagentextend]
lea edx, [esp + 0x10]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call ebp
test eax, eax
je 0x43e400
mov ecx, dword [str.SOFTWAREBaosightlsagentextend]
lea edx, [esp + 0x7c]
push ecx
push 0x4e6220
push 0xfff
push edx
call fcn.00466ca7
mov ecx, dword [0x4d25a4]
lea eax, [esp + 0x30]
push 0xebc
push eax
lea edx, [esp + 0x94]
push ecx
push edx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e40b
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [str.SOFTWAREBaosightlsagentchanges]
lea ecx, [esp + 0x10]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push 0x80000002
call ebp
test eax, eax
je 0x43e46c
mov eax, dword [str.SOFTWAREBaosightlsagentchanges]
lea ecx, [esp + 0x7c]
push eax
push 0x4e6220
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d25a4]
lea edx, [esp + 0x30]
push 0xecb
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e477
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [str.SOFTWAREBaosightlsagent_records]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push 0x80000002
call ebp
test eax, eax
je 0x43e4da
mov edx, dword [str.SOFTWAREBaosightlsagent_records]
lea eax, [esp + 0x7c]
push edx
push 0x4e6220
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [0x4d25a4]
lea ecx, [esp + 0x30]
push 0xeda
push ecx
lea eax, [esp + 0x94]
push edx
push eax
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e4e5
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [str.SOFTWAREBaosightlsagenthotfix]
lea edx, [esp + 0x10]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call ebp
test eax, eax
je 0x43e547
mov ecx, dword [str.SOFTWAREBaosightlsagenthotfix]
lea edx, [esp + 0x7c]
push ecx
push 0x4e6220
push 0xfff
push edx
call fcn.00466ca7
mov ecx, dword [0x4d25a4]
lea eax, [esp + 0x30]
push 0xee9
push eax
lea edx, [esp + 0x94]
push ecx
push edx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e552
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [str.SOFTWAREBaosightlsagent_flowmonitor]
lea ecx, [esp + 0x10]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push 0x80000002
call ebp
test eax, eax
je 0x43e5b6
mov eax, dword [str.SOFTWAREBaosightlsagent_flowmonitor]
lea ecx, [esp + 0x7c]
push eax
push 0x4e6220
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d25a4]
lea edx, [esp + 0x30]
push 0xef9
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e6a1
mov eax, dword [str.interdictionscheme]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43e5ee
mov eax, dword [str.interdictionscheme]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], 2
call esi
mov eax, dword [str.reportcycle]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43e626
mov eax, dword [str.reportcycle]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], 5
call esi
mov eax, dword [str.samplecycle]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43e65e
mov eax, dword [str.samplecycle]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], 0x14
call esi
mov eax, dword [str.violatecycle]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43e696
mov eax, dword [str.violatecycle]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], 0x3c
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [str.SOFTWAREBaosightlsagent_flowmonitor_reportdata]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push 0x80000002
call ebp
test eax, eax
je 0x43e704
mov edx, dword [str.SOFTWAREBaosightlsagent_flowmonitor_reportdata]
lea eax, [esp + 0x7c]
push edx
push 0x4e6220
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [0x4d25a4]
lea ecx, [esp + 0x30]
push 0xf1c
push ecx
lea eax, [esp + 0x94]
push edx
push eax
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e77b
mov edx, dword [str.reportcount]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call edi
test eax, eax
je 0x43e73a
mov edx, dword [str.reportcount]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call esi
mov edx, dword [str.sumcount]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call edi
test eax, eax
je 0x43e770
mov edx, dword [str.sumcount]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [str.SOFTWAREBaosightlsagent_flowmonitor_rule]
lea edx, [esp + 0x10]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call ebp
test eax, eax
je 0x43e7dd
mov ecx, dword [str.SOFTWAREBaosightlsagent_flowmonitor_rule]
lea edx, [esp + 0x7c]
push ecx
push 0x4e6220
push 0xfff
push edx
call fcn.00466ca7
mov ecx, dword [0x4d25a4]
lea eax, [esp + 0x30]
push 0xf35
push eax
lea edx, [esp + 0x94]
push ecx
push edx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e81e
mov ecx, dword [str.rulecount]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43e813
mov ecx, dword [str.rulecount]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], ebx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [str.SOFTWAREBaosightlsagent_flowmonitor_violaterecord]
lea ecx, [esp + 0x10]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push 0x80000002
call ebp
test eax, eax
je 0x43e87f
mov eax, dword [str.SOFTWAREBaosightlsagent_flowmonitor_violaterecord]
lea ecx, [esp + 0x7c]
push eax
push 0x4e6220
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d25a4]
lea edx, [esp + 0x30]
push 0xf49
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e8f2
mov eax, dword [str.recordcount]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43e8b3
mov eax, dword [str.recordcount]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], ebx
call esi
mov eax, dword [str.sumcount]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43e8e7
mov eax, dword [str.sumcount]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], ebx
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [str.SOFTWAREBaosightlsagentprintermanager]
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push 0x80000002
call ebp
test eax, eax
je 0x43e955
mov edx, dword [str.SOFTWAREBaosightlsagentprintermanager]
lea eax, [esp + 0x7c]
push edx
push 0x4e6220
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [0x4d25a4]
lea ecx, [esp + 0x30]
push 0xf64
push ecx
lea eax, [esp + 0x94]
push edx
push eax
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43e996
mov edx, dword [str.allowedcount]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
push eax
call edi
test eax, eax
je 0x43e98b
mov edx, dword [str.allowedcount]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 4
push ecx
push 4
push ebx
push edx
push eax
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [str.SOFTWAREBaosightlsagent_filemonitor]
lea edx, [esp + 0x10]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call ebp
test eax, eax
je 0x43e9f8
mov ecx, dword [str.SOFTWAREBaosightlsagent_filemonitor]
lea edx, [esp + 0x7c]
push ecx
push 0x4e6220
push 0xfff
push edx
call fcn.00466ca7
mov ecx, dword [0x4d25a4]
lea eax, [esp + 0x30]
push 0xf7a
push eax
lea edx, [esp + 0x94]
push ecx
push edx
call fcn.0043c750
add esp, 0x20
mov byte [esp + 0x17], bl
jmp 0x43ea39
mov ecx, dword [str.allowedcount]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push ebx
push ecx
push edx
call edi
test eax, eax
je 0x43ea2e
mov ecx, dword [str.allowedcount]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push ebx
push ecx
push edx
mov dword [esp + 0x30], ebx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [str.SOFTWAREBaosightlsagentupdateconfig]
lea ecx, [esp + 0x10]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edx
push 0x80000002
call ebp
test eax, eax
je 0x43eaaa
mov eax, dword [str.SOFTWAREBaosightlsagentupdateconfig]
lea ecx, [esp + 0x7c]
push eax
push 0x4e6220
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d25a4]
lea edx, [esp + 0x30]
push 0xf90
push edx
lea ecx, [esp + 0x94]
push eax
push ecx
call fcn.0043c750
xor al, al
add esp, 0x20
neg al
sbb eax, eax
pop ebp
and al, 0xf0
pop ebx
pop edi
add eax, 0x10
pop esi
add esp, 0x147c
ret
mov eax, dword [str.auoption]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43eade
mov eax, dword [str.auoption]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], ebx
call esi
mov eax, dword [str.installday]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43eb12
mov eax, dword [str.installday]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], ebx
call esi
mov eax, dword [str.installtime]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call edi
test eax, eax
je 0x43eb46
mov eax, dword [str.installtime]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 4
push edx
push 4
push ebx
push eax
push ecx
mov dword [esp + 0x30], ebx
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x17]
pop ebp
neg al
sbb eax, eax
pop ebx
and al, 0xf0
pop edi
add eax, 0x10
pop esi
add esp, 0x147c
ret