Function at 0x43ef6e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x43ef74
call fcn.00483040
push dword [esp + 0x5c]
call fcn.00440330
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00440000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00440000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00440000
push dword [esp]
call fcn.0043f838
push dword [esp + 8]
mov edx, 0x54123a
pop ecx
call fcn.004402c0
je 0x43f021
cmp dword [0x1dec2c4], 0
je 0x43f005
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x1dec2c8]
or ebx, 0xf003f
push ebx
push 0
push dword [0x1dec2b8]
push dword [0x1dec2c0]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x43f01f
lea eax, [esp + 0x10]
push eax
push dword [0x1dec2b8]
push dword [0x1dec2c0]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x43f086
lea eax, [esp + 0x18]
push eax
push dword [0x1dec2c0]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x1dec2c4], 0
je 0x43f06e
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x1dec2c8]
or ebx, 0xf003f
push ebx
push 0
push dword [0x1dec2b8]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x43f086
lea eax, [esp + 0x10]
push eax
push dword [0x1dec2b8]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x43f360
mov dword [esp + 0x1c], 0x400
push edx
call fcn.00482ea0
pop edx
push eax
push edx
call fcn.00482ea0
pop edx
push eax
push dword [esp + 0x24]
call fcn.00480920
lea eax, [esp + 0x24]
push eax
call fcn.00482f40
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x43f360
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x43f167
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43f154
push edx
call fcn.00482ea0
pop edx
push eax
push edx
call fcn.00482ea0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00481930
lea eax, [esp + 0x30]
push eax
call fcn.00482f40
jmp 0x43f162
mov edx, 0x540098
lea ecx, [esp + 0x2c]
call fcn.00440008
jmp 0x43f35f
mov ebx, 2
cmp ebx, dword [esp]
jne 0x43f1dc
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43f1c9
push edx
call fcn.00482ea0
pop edx
push eax
push edx
call fcn.00482ea0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00481930
lea eax, [esp + 0x30]
push eax
call fcn.00482f40
jmp 0x43f1d7
mov edx, 0x540098
lea ecx, [esp + 0x2c]
call fcn.00440008
jmp 0x43f35f
mov ebx, 4
cmp ebx, dword [esp]
jne 0x43f24e
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43f23b
push edx
call fcn.00482ea0
pop edx
push eax
push edx
call fcn.00482ea0
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.00480d10
lea eax, [esp + 0x30]
push eax
call fcn.00482f40
jmp 0x43f249
mov edx, 0x5412c8
lea ecx, [esp + 0x2c]
call fcn.00440008
jmp 0x43f35f
mov ebx, 3
cmp ebx, dword [esp]
jne 0x43f35f
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.00481d60
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43f35f
mov edx, 0x540098
lea ecx, [esp + 0x2c]
call fcn.00440008
mov dword [esp + 0x44], 0
jmp 0x43f2b9
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x43f356
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.004402a0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x43f313
mov edx, dword [esp + 0x2c]
push edx
call fcn.00482ea0
pop edx
push eax
push edx
call fcn.00482ee0
mov edx, 0x5412c8
push edx
call fcn.00482ee0
lea eax, [esp + 0x30]
push eax
call fcn.00482f40
mov edx, dword [esp + 0x2c]
push edx
call fcn.00482ea0
pop edx
push eax
push edx
call fcn.00482ee0
push edx
call fcn.00482ea0
pop edx
push eax
push edx
call fcn.00482ea0
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.00481330
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.00482f40
inc dword [esp + 0x44]
jno 0x43f2b9
push dword [esp + 0x3c]
call fcn.00481d80
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.00482ea0
pop edx
push eax
push edx
call fcn.00482ee0
pop eax
push eax
call fcn.00440300
pop edx
add eax, edx
jmp 0x43f391
push dword [esp + 8]
call fcn.004830a0
push dword [esp + 0x20]
call fcn.004830a0
push dword [esp]
call fcn.004830a0
push dword [esp + 4]
call fcn.004830a0
push dword [esp + 0x28]
call fcn.004830a0
add esp, 0x48
pop ebx
ret 0xc