Function at 0x43b180
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebp
push esi
push edi
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x3f
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20007
push 0
push 0
push 0
push 0x40764c
push 0x80000001
mov byte [esp + 0x30], 0
mov byte [esp + 0x31], 0
mov byte [esp + 0x32], 0
mov byte [esp + 0x33], 0
call dword [sym.imp.advapi32.dll_RegCreateKeyExA]
test eax, eax
jne 0x43b4f5
mov ecx, dword [esp + 0x10]
mov dl, byte [0x4687d4]
mov esi, dword [sym.imp.advapi32.dll_RegSetValueExA]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x407640
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43b4f5
mov ecx, dword [esp + 0x10]
mov dl, byte [0x4688e4]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x407634
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43b4f5
mov al, byte [0x468670]
test al, al
jne 0x43b271
mov ecx, dword [esp + 0x10]
mov dl, byte [0x468c04]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x40762c
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43b4f5
mov ecx, dword [esp + 0x10]
mov dl, byte [0x468a99]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x40761c
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43b4f5
mov ecx, dword [esp + 0x10]
mov dl, byte [0x468658]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x40760c
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43b4f5
mov ecx, dword [esp + 0x10]
mov dl, byte [0x4684ac]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x407600
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43b4f5
mov ecx, dword [esp + 0x10]
mov dl, byte [0x468620]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4075ec
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43b4f5
mov ecx, dword [esp + 0x10]
mov dl, byte [0x468a98]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4075e4
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43b4f5
mov al, byte [0x468670]
test al, al
jne 0x43b370
mov ecx, dword [esp + 0x10]
mov dl, byte [0x468af4]
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4075dc
push ecx
mov byte [esp + 0x24], dl
call esi
test eax, eax
jne 0x43b4f5
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.advapi32.dll_RegCloseKey]
push edx
call ebp
call fcn.0043ae40
test al, al
je 0x43b55f
mov al, byte [0x468a99]
test al, al
je 0x43b511
push 0xff
lea eax, [esp + 0x1d]
push eax
push 0
mov byte [esp + 0x24], 0x22
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b3b5
sub eax, edx
lea edi, [esp + 0x18]
mov byte [esp + eax + 0x18], 0x22
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x43b3c8
mov ecx, dword [0x40772c]
mov dx, word [0x407730]
mov dword [edi], ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push 0x407704
mov word [edi + 4], dx
mov edi, dword [sym.imp.advapi32.dll_RegCreateKeyExA]
push 0x80000000
call edi
test eax, eax
jne 0x43b4f5
lea eax, [esp + 0x18]
lea edx, [eax + 1]
jmp 0x43b420
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b420
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x43b4f5
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x4076dc
push 0x80000000
call edi
test eax, eax
jne 0x43b4f5
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b480
sub eax, edx
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push 0
push edx
call esi
test eax, eax
jne 0x43b4f5
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push 0x4076b8
push 0x80000000
call edi
test eax, eax
jne 0x43b4f5
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43b4d5
mov ecx, dword [esp + 0x10]
sub eax, edx
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0
push ecx
call esi
test eax, eax
je 0x43b4fe
xor eax, eax
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
push edx
call ebp
mov eax, 1
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.advapi32.dll_RegDeleteKeyA]
push 0x407704
push 0x80000000
call esi
push 0x407698
push 0x80000000
call esi
push 0x4076dc
push 0x80000000
call esi
push 0x407678
push 0x80000000
call esi
push 0x4076b8
push 0x80000000
call esi
push 0x40765c
push 0x80000000
call esi
pop edi
mov eax, 1
pop esi
pop ebp
mov esp, ebp
pop ebp
ret