Function at 0x42b24c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x45e040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x468], eax
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x464], edx
lea eax, [ebp - 0x434]
mov dword [ebp - 0x460], edi
push eax
push 4
push ecx
push ecx
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x42c], ecx
push eax
push 0x2001f
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x430], ecx
push eax
mov dword [ebp - 0x44c], 0x18
mov dword [ebp - 0x448], ecx
mov dword [ebp - 0x440], 0x40
mov dword [ebp - 0x444], 0x4019f4
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x438], ecx
call dword [sym.imp.ntdll.dll_NtCreateKey]
mov esi, eax
test esi, esi
jns 0x42b321
push esi
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x407870
mov dword [ebp - 0x458], 0x407a34
mov dword [ebp - 0x454], 0xcb
mov dword [ebp - 0x450], 0x4078e0
call fcn.00455c22
xor edi, edi
jmp 0x42b4ec
lea eax, [ebp - 0x430]
push eax
push 0x420
lea eax, [ebp - 0x428]
push eax
push 2
push 0x4019fc
push dword [ebp - 0x42c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edx, 0x410
test eax, eax
js 0x42b369
cmp dword [ebp - 0x424], 3
jne 0x42b369
cmp dword [ebp - 0x420], edx
jne 0x42b369
mov eax, dword [ebp - 0x41c]
jmp 0x42b3a8
push edx
lea eax, [ebp - 0x878]
push 0
push eax
call sub.ntdll.dll_memset
mov ecx, 0x104
lea esi, [ebp - 0x878]
lea edi, [ebp - 0x41c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x460]
add esp, 0xc
or dword [ebp - 0x418], 0xffffffff
mov edx, 0x410
mov dword [ebp - 0x41c], eax
xor ecx, ecx
mov word [ebp - 0x216], cx
mov word [ebp - 0xe], cx
cmp eax, 1
ja 0x42b50c
push edx
push ecx
lea eax, [ebp - 0x41c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x41c], edi
test ebx, ebx
je 0x42b42a
mov eax, dword [ebp - 0x464]
mov esi, ebx
mov dword [ebp - 0x418], eax
xor edi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x42b3ec
sub esi, ecx
sar esi, 1
je 0x42b41e
cmp esi, 0x100
jb 0x42b40a
mov esi, 0xff
lea eax, [esi + esi]
push eax
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + esi*2 - 0x414], ax
jmp 0x42b43c
or dword [ebp - 0x418], 0xffffffff
xor eax, eax
mov word [ebp - 0x414], ax
xor edi, edi
mov edx, dword [ebp - 0x468]
test edx, edx
je 0x42b489
mov esi, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, di
jne 0x42b44b
sub esi, ecx
sar esi, 1
je 0x42b47d
cmp esi, 0x104
jb 0x42b469
mov esi, 0x103
lea eax, [esi + esi]
push eax
push edx
lea eax, [ebp - 0x214]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [ebp + esi*2 - 0x214], ax
jmp 0x42b492
xor eax, eax
mov word [ebp - 0x214], ax
push 0x410
lea eax, [ebp - 0x41c]
push eax
push 3
push edi
push 0x4019fc
push dword [ebp - 0x42c]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
test esi, esi
jns 0x42b50e
push esi
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x407870
mov dword [ebp - 0x458], 0x407a34
mov dword [ebp - 0x454], 0x12d
mov dword [ebp - 0x450], 0x407a78
call fcn.00455c22
mov ecx, dword [ebp - 0x42c]
test ecx, ecx
je 0x42b508
cmp ecx, 0xffffffff
je 0x42b508
push ecx
mov dword [ebp - 0x42c], edi
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
jmp 0x42b52c
xor edi, edi
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x42b52a
cmp eax, 0xffffffff
je 0x42b52a
push eax
mov dword [ebp - 0x42c], edi
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d1ae
leave
ret 8