Function at 0x43087b
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x92c
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x910], eax
mov eax, dword [str.Foreign]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x108], eax
mov eax, dword [0x47512c]
push 0xfc
mov dword [ebp - 0x104], eax
xor esi, esi
lea eax, [ebp - 0x100]
push esi
push eax
mov dword [ebp - 0x914], 0x1f4
call fcn.00450230
or dword [ebp - 0x91c], 0xffffffff
add esp, 0xc
lea eax, [ebp - 0x92c]
push eax
mov ebx, 0x400
push edi
mov dword [ebp - 0x920], esi
mov dword [ebp - 0x924], esi
mov dword [ebp - 0x918], ebx
call fcn.00438ed2
test eax, eax
jne 0x43092b
inc edi
push edi
push str.reading_disk_layout_of_disk__d_failed_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x38c
push str.ntfsResize
call fcn.0044dc85
add esp, 0x14
xor eax, eax
inc eax
jmp 0x430cb0
push 0x104
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.___total_physical_size__lu_MB_GetWindowsDirectoryA]
push eax
lea eax, [ebp - 0x508]
push eax
push dword [ebp - 0x910]
call fcn.00450f08
add esp, 0xc
test eax, eax
jne 0x43096f
lea eax, [ebp - 0x108]
push str.SYSTEM
push eax
call fcn.00450c76
pop ecx
pop ecx
jmp 0x430a12
push dword [ebp - 0x910]
lea eax, [ebp - 0x20c]
push str._s_system32config_system
push 0x104
push eax
call fcn.00450d91
add esp, 0x10
test eax, eax
js 0x430923
lea eax, [ebp - 0x20c]
push 4
push eax
call fcn.00450d79
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x4309c4
lea eax, [ebp - 0x20c]
push eax
push str.The_registry_file__s_is_not_readable.
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x39e
jmp 0x430916
push str.SeRestorePrivilege
call fcn.0040a59c
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push reloc.lu_heads___lu_sectors___lu_byte_Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegLoadKeyA]
test eax, eax
je 0x430a08
lea eax, [ebp - 0x20c]
push eax
push str.Loading_registry__s_failed
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x3a6
jmp 0x430916
mov dword [ebp - 0x920], 1
lea eax, [ebp - 0x90c]
push eax
lea eax, [ebp - 0x108]
push eax
push str._sMountedDevices
mov dword [ebp - 0x90c], esi
call fcn.0042f614
pop ecx
pop ecx
push eax
push reloc.lu_heads___lu_sectors___lu_byte_Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegOpenKeyA]
test eax, eax
je 0x430a79
lea eax, [ebp - 0x108]
push eax
push str._sMountedDevices
call fcn.0042f614
pop ecx
pop ecx
push eax
push str.Cant_open_registry_key__s
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x3af
push str.ntfsResize
call fcn.0044dc85
add esp, 0x14
jmp 0x430c3d
push edi
call fcn.004103cf
mov edi, dword [sym.imp.ical_size__lu_MB_RegEnumValueA]
push esi
push esi
push esi
mov dword [ebp - 0x928], eax
push esi
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x910], esi
push esi
jmp 0x430adb
lea eax, [ebp - 0x404]
push str.DosDevicesC:
push eax
call fcn.00450597
pop ecx
pop ecx
test eax, eax
je 0x430af9
inc dword [ebp - 0x910]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x910]
push dword [ebp - 0x90c]
mov dword [ebp - 0x914], 0x1f4
mov dword [ebp - 0x918], ebx
call edi
test eax, eax
je 0x430aa6
jmp 0x430b45
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x908]
push eax
push esi
push esi
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x90c]
call dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
test eax, eax
je 0x430b39
lea eax, [ebp - 0x404]
push eax
push str.SystemMountedDevices
push str.Failed_to_read_registry_key:__s_s
call fcn.0041c7ee
add esp, 0xc
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x924], eax
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x910], esi
push esi
jmp 0x430c1d
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x908]
push eax
push esi
push esi
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x90c]
call dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
test eax, eax
je 0x430ba5
lea eax, [ebp - 0x404]
push eax
push str.SystemMountedDevices
push str.Failed_to_read_registry_key:__s_s
call fcn.0041c7ee
add esp, 0xc
jmp 0x430bff
mov eax, dword [ebp - 0x924]
cmp dword [ebp - 0x908], eax
jne 0x430bff
push dword [ebp - 0x918]
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x908], eax
lea eax, [ebp - 0x908]
push eax
push 3
push esi
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x90c]
call dword [sym.imp.ical_size__lu_MB_RegSetValueExA]
test eax, eax
je 0x430bf9
lea eax, [ebp - 0x404]
push eax
push str.SystemMountedDevices
push str.Error_writing_registry_key:__s_s
jmp 0x430b9b
inc dword [ebp - 0x91c]
inc dword [ebp - 0x910]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x910]
push dword [ebp - 0x90c]
mov dword [ebp - 0x914], 0x1f4
mov dword [ebp - 0x918], ebx
call edi
test eax, eax
je 0x430b63
cmp dword [ebp - 0x90c], esi
je 0x430c51
push dword [ebp - 0x90c]
call dword [sym.imp.ical_size__lu_MB_RegCloseKey]
cmp dword [ebp - 0x920], esi
je 0x430c94
lea eax, [ebp - 0x108]
push eax
push reloc.lu_heads___lu_sectors___lu_byte_Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegUnLoadKeyA]
test eax, eax
je 0x430c94
lea eax, [ebp - 0x20c]
push eax
push str.Unloading_registry__s_failed
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x3fe
push str.ntfsResize
call fcn.0044dc85
add esp, 0x14
cmp dword [ebp - 0x91c], esi
je 0x430cae
push dword [ebp - 0x91c]
push str._u_entries_changed
call fcn.0041c7ee
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret 8