Function at 0x40c050
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x433716
mov eax, dword fs:[0]
push eax
mov eax, 0x101e4
call fcn.00418d50
mov eax, dword [0x44dd94]
xor eax, esp
mov dword [esp + 0x101e0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44dd94]
xor eax, esp
push eax
lea eax, [esp + 0x101f8]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x10210]
xor ebx, ebx
mov edi, 0xf
mov dword [esp + 0x14], ecx
mov dword [esp + 0x164], edi
mov dword [esp + 0x160], ebx
mov byte [esp + 0x150], bl
mov dword [esp + 0x10200], ebx
mov dword [esp + 0x148], edi
mov dword [esp + 0x144], ebx
mov byte [esp + 0x134], bl
mov esi, dword [esp + 0x1020c]
cmp esi, ebx
mov byte [esp + 0x10200], 1
jl 0x40c7af
cmp esi, 1
jle 0x40c173
cmp esi, 2
jne 0x40c7af
push 0xb
call fcn.0040ff70
add esp, 4
test eax, eax
je 0x40c76d
push str.truecrypt.sys
lea ecx, [esp + 0x150]
call fcn.00402010
push str.DumpFilters
lea ecx, [esp + 0x134]
call fcn.00402010
lea eax, [esp + 0x18]
push eax
push 0x2001f
push ebx
push str.SYSTEMCurrentControlSetControlCrashControl
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40c1cf
lea ecx, [esp + 0x24]
call fcn.00408990
push 0x448828
lea ecx, [esp + 0x28]
push ecx
call fcn.004180e9
push 9
push str.truecrypt
lea ecx, [esp + 0x154]
call fcn.00401ba0
push 0xc
push str.UpperFilters
lea ecx, [esp + 0x138]
call fcn.00401ba0
push 0x2001f
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x40c1d3
mov dword [esp + 0x2c], vtable.TrueCrypt::SystemException.0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x448828
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x38], eax
call fcn.004180e9
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x10200], 2
cmp byte [esp + 0x10208], bl
je 0x40c2da
cmp esi, 2
je 0x40c2da
mov esi, dword [esp + 0x160]
inc esi
mov eax, 0x10000
sub eax, esi
mov edi, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x150]
cmp dword [esp + 0x164], edi
jae 0x40c224
lea eax, [esp + 0x150]
push 0x10000
push eax
lea ecx, [esp + 0x1fc]
push ecx
call fcn.00419120
mov eax, dword [esp + 0x140]
add esp, 0xc
cmp dword [esp + 0x148], edi
jae 0x40c251
lea eax, [esp + 0x134]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + esi + 0x1f8]
push ecx
push ebx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40c278
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x134]
cmp dword [esp + 0x148], edi
jae 0x40c28f
lea eax, [esp + 0x134]
mov ecx, dword [esp + 0x14]
add ecx, esi
push ecx
lea edx, [esp + 0x1f8]
push edx
push 7
push ebx
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40c764
lea ecx, [esp + 0x24]
call fcn.00408990
push 0x448828
lea ecx, [esp + 0x28]
push ecx
call fcn.004180e9
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x34]
push edx
call fcn.0040a4a0
push str._truecrypt_driver_setup.inf
push eax
lea eax, [esp + 0x170]
push eax
mov byte [esp + 0x1020c], 3
call fcn.00404910
add esp, 0xc
mov ebp, 0x10
mov byte [esp + 0x10200], 5
cmp dword [esp + 0x4c], ebp
jb 0x40c326
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00417d54
add esp, 4
push 1
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x194]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
mov byte [ecx + 4], bl
call fcn.004019c0
lea ecx, [esp + 0x1c4]
call fcn.0040a260
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x18c]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x10228], 6
mov byte [ecx + 4], bl
call fcn.004019c0
lea esi, [esp + 0x1f4]
call fcn.00409d00
mov byte [esp + 0x10200], 7
cmp byte [esp + 0x10208], bl
je 0x40c3b6
mov eax, str.0008
mov edi, 0x435b70
jmp 0x40c3c0
mov eax, str.8002
mov edi, 0x435b64
push eax
lea ecx, [esp + 0xc4]
call fcn.004020d0
mov esi, eax
push edi
lea ecx, [esp + 0x118]
mov byte [esp + 0x10204], 8
call fcn.004020d0
push eax
lea ecx, [esp + 0x8c]
push str._truecrypt__r_n
push ecx
mov byte [esp + 0x1020c], 9
call fcn.00405070
push str.Regtruecrypt_reg_r_n_r_n_truecrypt_reg__r_nHKR___
push eax
lea edx, [esp + 0x80]
push edx
mov byte [esp + 0x10218], 0xa
call fcn.00404910
lea ecx, [esp + 0x148]
push ecx
push eax
lea edx, [esp + 0xc4]
push edx
mov byte [esp + 0x10224], 0xb
call fcn.004049d0
push str.__0x0001
push eax
lea eax, [esp + 0x124]
push eax
mov byte [esp + 0x10230], 0xc
call fcn.00404910
push esi
push eax
lea ecx, [esp + 0x88]
push ecx
mov byte [esp + 0x1023c], 0xd
call fcn.004049d0
push 0x435b14
push eax
lea edx, [esp + 0x120]
push edx
mov byte [esp + 0x10248], 0xe
call fcn.00404910
add esp, 0x48
lea ecx, [esp + 0x14c]
push ecx
push eax
lea edx, [esp + 0x3c]
push edx
mov byte [esp + 0x1020c], 0xf
call fcn.004049d0
push 0x435b10
push eax
lea eax, [esp + 0x198]
push eax
mov byte [esp + 0x10218], 0x10
call fcn.00404910
add esp, 0x18
cmp dword [esp + 0x4c], ebp
jb 0x40c4d4
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00417d54
add esp, 4
mov esi, 0xf
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
cmp dword [esp + 0xf4], ebp
jb 0x40c4fe
mov edx, dword [esp + 0xe0]
push edx
call fcn.00417d54
add esp, 4
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
cmp dword [esp + 0x68], ebp
jb 0x40c526
mov eax, dword [esp + 0x54]
push eax
call fcn.00417d54
add esp, 4
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
cmp dword [esp + 0x110], ebp
jb 0x40c54b
mov ecx, dword [esp + 0xfc]
push ecx
call fcn.00417d54
add esp, 4
mov dword [esp + 0x110], esi
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
cmp dword [esp + 0xbc], ebp
jb 0x40c579
mov edx, dword [esp + 0xa8]
push edx
call fcn.00417d54
add esp, 4
mov dword [esp + 0xbc], esi
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
cmp dword [esp + 0x84], ebp
jb 0x40c5a4
mov eax, dword [esp + 0x70]
push eax
call fcn.00417d54
add esp, 4
mov dword [esp + 0x84], esi
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
cmp dword [esp + 0xa0], ebp
jb 0x40c5cf
mov ecx, dword [esp + 0x8c]
push ecx
call fcn.00417d54
add esp, 4
mov dword [esp + 0xa0], esi
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
cmp dword [esp + 0x12c], ebp
jb 0x40c5fd
mov edx, dword [esp + 0x118]
push edx
call fcn.00417d54
add esp, 4
mov dword [esp + 0x12c], esi
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
mov byte [esp + 0x10200], 0x1a
cmp dword [esp + 0xd8], ebp
jb 0x40c633
mov eax, dword [esp + 0xc4]
push eax
call fcn.00417d54
add esp, 4
mov eax, dword [esp + 0x188]
mov dword [esp + 0xd8], esi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
cmp dword [esp + 0x19c], ebp
jae 0x40c65f
lea eax, [esp + 0x188]
mov ecx, dword [esp + 0x198]
push ecx
push eax
lea ecx, [esp + 0x1a8]
call fcn.0040bdd0
cmp byte [esp + 0x1a1], bl
je 0x40c69b
cmp byte [esp + 0x1a0], bl
jne 0x40c694
mov edx, dword [esp + 0x1b0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x1a1], bl
mov eax, dword [esp + 0x16c]
cmp dword [esp + 0x180], ebp
jae 0x40c6b2
lea eax, [esp + 0x16c]
push ebx
push 3
push ebx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
cmp eax, 0xffffffff
jne 0x40c6e3
mov dword [esp + 0x1c], vtable.TrueCrypt::SystemException.0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x20], eax
push 0x448828
lea eax, [esp + 0x20]
push eax
call fcn.004180e9
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push 4
push str.truecrypt
push eax
mov eax, dword [edx]
push eax
mov byte [esp + 0x1022c], 0x1b
call dword [sym.imp.SETUPAPI.dll_SetupInstallFromInfSectionA]
test eax, eax
jne 0x40c72b
lea ecx, [esp + 0x24]
call fcn.00408990
push 0x448828
lea ecx, [esp + 0x28]
push ecx
call fcn.004180e9
lea eax, [esp + 0x1c]
call fcn.004083c0
lea ecx, [esp + 0x184]
call fcn.00401870
lea esi, [esp + 0x1d8]
call fcn.00409a90
lea ecx, [esp + 0x1a0]
call fcn.004080c0
lea ecx, [esp + 0x168]
call fcn.00401870
lea eax, [esp + 0x2c]
call fcn.004083b0
lea ecx, [esp + 0x130]
call fcn.00401870
lea ecx, [esp + 0x14c]
call fcn.00401870
mov ecx, dword [esp + 0x101f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x101e0]
xor ecx, esp
call fcn.0041851b
add esp, 0x101f0
ret 0xc
push 0x448860
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], vtable.TrueCrypt::ParameterIncorrect.0
mov dword [esp + 0x28], str.TrueCrypt::BootEncryption::RegisterFilter:1704
call fcn.004180e9
int3