Function at 0x4b19d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513bf1
mov eax, dword fs:[0]
push eax
sub esp, 0x35c
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x35c], ecx
mov edi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
mov esi, dword [ebp + 0xc]
mov byte [ebp - 4], 1
test esi, esi
js 0x4b21cd
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp esi, 1
jle 0x4b1c0b
cmp esi, 2
jne 0x4b21cd
push 0xb
call fcn.0041c0d0
add esp, 4
test eax, eax
je 0x4b2193
push str.CnCrypt.sys
lea ecx, [ebp - 0x248]
call fcn.0043f1f0
push str.DumpFilters
lea ecx, [ebp - 0x230]
call fcn.0043f1f0
lea eax, [ebp - 0x358]
push eax
push 0x2001f
push 0
push str.SYSTEMCurrentControlSetControlCrashControl
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
call ebx
test eax, eax
je 0x4b1ae5
mov dword [ebp - method.CnCrypt::SystemException.virtual_0], vtable.CnCrypt::SystemException.0
call ebx
mov dword [ebp - 0x364], eax
lea eax, [ebp - 0x368]
push 0x5511e0
push eax
call fcn.004e3ce5
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x364], eax
mov edi, dword [ebp + 8]
mov byte [ebp - 4], 2
test edi, edi
je 0x4b1c71
cmp esi, 2
je 0x4b1c71
mov esi, dword [ebp - 0x238]
mov eax, 0x104
inc esi
sub eax, esi
add eax, eax
push 0x208
mov dword [ebp - 0x354], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004e46b0
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
push 0x104
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004ec074
add esp, 0x18
lea eax, [ebp - 0x354]
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
cmovae ecx, dword [ebp - 0x230]
add esi, esi
push eax
lea eax, [ebp - 0x218]
add eax, esi
push eax
push 0
push 0
push ecx
push dword [ebp - 0x358]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x354]
test eax, eax
mov edx, 2
lea eax, [ebp - 0x230]
cmovne ecx, edx
add ecx, esi
cmp dword [ebp - 0x21c], 8
push ecx
cmovae eax, dword [ebp - 0x230]
mov dword [ebp - 0x354], ecx
lea ecx, [ebp - 0x218]
push ecx
push 7
push 0
push eax
push dword [ebp - 0x358]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
call ebx
test eax, eax
je 0x4b2188
mov dword [ebp - method.CnCrypt::SystemException.virtual_0], vtable.CnCrypt::SystemException.0
call ebx
mov dword [ebp - 0x35c], eax
lea eax, [ebp - 0x360]
push 0x5511e0
push eax
call fcn.004e3ce5
push 7
push 0x51a1d0
lea ecx, [ebp - 0x248]
call fcn.004051a0
push 0xc
push str.UpperFilters
lea ecx, [ebp - 0x230]
call fcn.004051a0
push 0x2001f
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenClassRegKey]
mov dword [ebp - 0x358], eax
cmp eax, 0xffffffff
jne 0x4b1aeb
mov dword [ebp - method.CnCrypt::SystemException.virtual_0], vtable.CnCrypt::SystemException.0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x364], eax
lea eax, [ebp - 0x368]
push 0x5511e0
push eax
call fcn.004e3ce5
mov ecx, dword [ebp - 0x35c]
lea eax, [ebp - 0x290]
push eax
call fcn.004b00f0
push str.cncrypt_driver_setup.inf
push eax
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 3
push eax
call fcn.00403cd0
add esp, 0xc
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 5
call fcn.00495b40
push 1
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x4b1ccc
mov eax, dword [ecx]
jmp 0x4b1cce
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x278]
push edx
push eax
call fcn.00405080
lea ecx, [ebp - 0x338]
call fcn.004aae80
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x4b1d0e
mov eax, dword [ecx]
jmp 0x4b1d10
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0x278]
push edx
push eax
call fcn.00405080
lea ecx, [ebp - 0x350]
call fcn.004aafe0
mov dword [ebp - 0x24c], 0xf
mov dword [ebp - 0x250], 0
mov byte [ebp - 0x260], 0
test edi, edi
mov byte [ebp - 4], 8
lea edi, [ebp - 0x248]
je 0x4b1edd
cmp dword [ebp - 0x234], 8
cmovae edi, dword [ebp - 0x248]
test edi, edi
jne 0x4b1d76
mov dword [ebp - 0x354], edi
jmp 0x4b1dc1
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b1d80
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4b1da6
mov dword [ebp - 0x354], 0
jmp 0x4b1dc1
add esi, esi
mov eax, esi
call fcn.004e1f90
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00418070
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x21c], 8
lea edi, [ebp - 0x230]
cmovae edi, dword [ebp - 0x230]
test edi, edi
je 0x4b1e15
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b1de0
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4b1dfe
xor edi, edi
jmp 0x4b1e15
add esi, esi
mov eax, esi
call fcn.004e1f90
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00418070
mov edi, eax
push dword [ebp - 0x354]
lea ecx, [ebp - 0x308]
call fcn.004a6310
mov esi, eax
push edi
lea ecx, [ebp - 0x2f0]
mov byte [ebp - 4], 9
call fcn.004a6310
push eax
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xa
push str._cncrypt__r_nAddRegcncrypt_reg_r_n_r_n_cncrypt_reg__r_nHKR___
push eax
call fcn.0040ecc0
push str.__0x00010008__
push eax
lea eax, [ebp - 0x2c0]
mov byte [ebp - 4], 0xb
push eax
call fcn.004a5dd0
push esi
push eax
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 0xc
push eax
call fcn.004a5d60
push 0x52bf70
push eax
lea eax, [ebp - 0x290]
mov byte [ebp - 4], 0xd
push eax
call fcn.004a5dd0
add esp, 0x30
lea ecx, [ebp - 0x260]
push eax
call fcn.00495b80
lea ecx, [ebp - 0x290]
call fcn.0040f9a0
lea ecx, [ebp - 0x2a8]
call fcn.0040f9a0
lea ecx, [ebp - 0x2c0]
call fcn.0040f9a0
lea ecx, [ebp - 0x2d8]
call fcn.0040f9a0
lea ecx, [ebp - 0x2f0]
call fcn.0040f9a0
lea ecx, [ebp - 0x308]
jmp 0x4b2058
cmp dword [ebp - 0x234], 8
cmovae edi, dword [ebp - 0x248]
test edi, edi
jne 0x4b1ef7
mov dword [ebp - 0x354], edi
jmp 0x4b1f41
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b1f00
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4b1f26
mov dword [ebp - 0x354], 0
jmp 0x4b1f41
add esi, esi
mov eax, esi
call fcn.004e1f90
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00418070
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x21c], 8
lea edi, [ebp - 0x230]
cmovae edi, dword [ebp - 0x230]
test edi, edi
je 0x4b1f95
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b1f60
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4b1f7e
xor edi, edi
jmp 0x4b1f95
add esi, esi
mov eax, esi
call fcn.004e1f90
mov eax, esp
push 3
push esi
push edi
push eax
call fcn.00418070
mov edi, eax
push dword [ebp - 0x354]
lea ecx, [ebp - 0x290]
call fcn.004a6310
mov esi, eax
push edi
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0xe
call fcn.004a6310
push eax
lea eax, [ebp - 0x2c0]
mov byte [ebp - 4], 0xf
push str._cncrypt__r_nDelRegcncrypt_reg_r_n_r_n_cncrypt_reg__r_nHKR___
push eax
call fcn.0040ecc0
push str.__0x00018002__
push eax
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0x10
push eax
call fcn.004a5dd0
push esi
push eax
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 0x11
push eax
call fcn.004a5d60
push 0x52bf70
push eax
lea eax, [ebp - 0x308]
mov byte [ebp - 4], 0x12
push eax
call fcn.004a5dd0
add esp, 0x30
lea ecx, [ebp - 0x260]
push eax
call fcn.00495b80
lea ecx, [ebp - 0x308]
call fcn.0040f9a0
lea ecx, [ebp - 0x2f0]
call fcn.0040f9a0
lea ecx, [ebp - 0x2d8]
call fcn.0040f9a0
lea ecx, [ebp - 0x2c0]
call fcn.0040f9a0
lea ecx, [ebp - 0x2a8]
call fcn.0040f9a0
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 8
call fcn.0040f9a0
cmp dword [ebp - 0x24c], 0x10
lea eax, [ebp - 0x260]
push dword [ebp - 0x250]
cmovae eax, dword [ebp - 0x260]
lea ecx, [ebp - 0x338]
push eax
call fcn.004b4320
cmp dword [ebp - 0x334], 0
je 0x4b20af
cmp dword [ebp - 0x338], 0
jne 0x4b20a5
push dword [ebp - 0x328]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x334], 0
cmp dword [ebp - 0x264], 8
lea eax, [ebp - 0x278]
push 0
cmovae eax, dword [ebp - 0x278]
push 3
push 0
push eax
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
cmp eax, 0xffffffff
jne 0x4b20f8
mov dword [ebp - method.CnCrypt::SystemException.virtual_0], vtable.CnCrypt::SystemException.0
call ebx
mov dword [ebp - 0x35c], eax
lea eax, [ebp - 0x360]
push 0x5511e0
push eax
call fcn.004e3ce5
mov dword [ebp - 0x354], eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x358]
mov byte [ebp - 4], 0x13
push 4
push 0x51a1d0
push eax
mov eax, dword [ebp - 0x35c]
push dword [eax]
call dword [sym.imp.SETUPAPI.dll_SetupInstallFromInfSectionW]
test eax, eax
jne 0x4b2151
mov dword [ebp - method.CnCrypt::SystemException.virtual_0], vtable.CnCrypt::SystemException.0
call ebx
mov dword [ebp - 0x35c], eax
lea eax, [ebp - 0x360]
push 0x5511e0
push eax
call fcn.004e3ce5
lea ecx, [ebp - 0x354]
call fcn.004ab880
lea ecx, [ebp - 0x260]
call fcn.0040f9a0
lea ecx, [ebp - 0x350]
call fcn.004ab820
lea ecx, [ebp - 0x338]
call fcn.004ab720
lea ecx, [ebp - 0x278]
call fcn.00495b40
lea ecx, [ebp - 0x364]
call fcn.004ab810
lea ecx, [ebp - 0x230]
call fcn.00495b40
lea ecx, [ebp - 0x248]
call fcn.00495b40
lea esp, [ebp - 0x378]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 0xc
push 0x5541c4
lea eax, [ebp - 0x368]
mov dword [ebp - method.CnCrypt::ParameterIncorrect.virtual_0], vtable.CnCrypt::ParameterIncorrect.0
push eax
mov dword [ebp - 0x364], str.CnCrypt::BootEncryption::RegisterFilter:1856
call fcn.004e3ce5
int3