Function at 0x443610
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebp
push esi
push edi
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x3f
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20007
push 0
push 0
push 0
push 0x406744
push 0x80000001
mov byte [esp + 0x30], 0
mov byte [esp + 0x31], 0
mov byte [esp + 0x32], 0
mov byte [esp + 0x33], 0
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x443985
mov ecx, dword [esp + 0x10]
mov dl, byte [0x470aec]
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExA]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x406738
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x443985
mov ecx, dword [esp + 0x10]
mov dl, byte [0x470bfc]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x40672c
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x443985
mov al, byte [0x470988]
test al, al
jne 0x443701
mov ecx, dword [esp + 0x10]
mov dl, byte [0x470f1c]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x406724
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x443985
mov ecx, dword [esp + 0x10]
mov dl, byte [0x470db1]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x406714
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x443985
mov ecx, dword [esp + 0x10]
mov dl, byte [0x470970]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x406704
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x443985
mov ecx, dword [esp + 0x10]
mov dl, byte [0x4707c4]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4066f8
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x443985
mov ecx, dword [esp + 0x10]
mov dl, byte [0x470938]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4066e4
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x443985
mov ecx, dword [esp + 0x10]
mov dl, byte [0x470db0]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4066dc
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x443985
mov al, byte [0x470988]
test al, al
jne 0x443800
mov ecx, dword [esp + 0x10]
mov dl, byte [0x470e0c]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4066d4
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x443985
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.advapi32.dll_RegCloseKey]
push edx
call ebp
call fcn.004432d0
test al, al
je 0x4439ef
mov al, byte [0x470db1]
test al, al
je 0x4439a1
push 0xff
lea eax, [esp + 0x1d]
push eax
push 0
mov byte [esp + 0x24], 0x22
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443845
sub eax, edx
lea edi, [esp + 0x18]
mov byte [esp + eax + 0x18], 0x22
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x443858
mov ecx, dword [0x406824]
mov dx, word [0x406828]
mov dword [edi], ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push 0x4067fc
mov word [edi + 4], dx
mov edi, dword [sym.imp.advapi32.dll_RegCreateKeyExA]
push 0x80000000
call edi
test eax, eax
jne 0x443985
lea eax, [esp + 0x18]
lea edx, [eax + 1]
jmp 0x4438b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4438b0
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x443985
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x4067d4
push 0x80000000
call edi
test eax, eax
jne 0x443985
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443910
sub eax, edx
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push 0
push edx
call esi
test eax, eax
jne 0x443985
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push 0x4067b0
push 0x80000000
call edi
test eax, eax
jne 0x443985
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443965
mov ecx, dword [esp + 0x10]
sub eax, edx
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0
push ecx
call esi
test eax, eax
je 0x44398e
xor eax, eax
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.advapi32.dll_RegDeleteKeyA]
push 0x4067fc
push 0x80000000
call esi
push 0x406790
push 0x80000000
call esi
push 0x4067d4
push 0x80000000
call esi
push 0x406770
push 0x80000000
call esi
push 0x4067b0
push 0x80000000
call esi
push 0x406754
push 0x80000000
call esi
pop edi
mov eax, 1
pop esi
pop ebp
mov esp, ebp
pop ebp
ret