Function at 0x43fda1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x864
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
push 0x206
mov word [ebp - 0x210], ax
mov esi, ecx
lea eax, [ebp - 0x20e]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x834]
call fcn.0041deb3
lea ecx, [ebp - 0x854]
call fcn.0041deb3
lea ecx, [ebp - 0x844]
call fcn.0041deb3
lea ecx, [ebp - 0x858]
call fcn.0041deb3
lea ecx, [ebp - 0x850]
call fcn.0041deb3
lea ecx, [ebp - 0x84c]
call fcn.0041deb3
mov eax, 0x40fdd8
mov dword [ebp - 0x82c], edi
mov ecx, esi
mov dword [ebp - 0x838], eax
mov dword [ebp - 0x860], eax
call fcn.004403aa
push 0x208
lea ebx, [esi + 0x28]
push edi
push ebx
mov dword [ebp - 0x85c], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esi + 0x230]
mov dword [ebp - 0x864], eax
push 0x208
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x330]
mov edi, 0x11c
push edi
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x330], edi
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
lea edx, [ebp - 0x82c]
mov ecx, eax
call fcn.004302be
test eax, eax
jne 0x43febb
mov esi, dword [ebp - 0x82c]
mov ecx, esi
call fcn.0041b100
jmp 0x440349
xor eax, eax
cmp byte [ebp - 0x216], 1
setne al
inc eax
mov dword [esi + 0x18], eax
call fcn.0043fbd9
xor edi, edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], edi
call fcn.0043fc55
test eax, eax
je 0x440143
lea eax, [ebp - 0x840]
push eax
push 0x20019
push edi
push 0x40aab0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0x82c]
mov ecx, eax
call fcn.00425e30
test eax, eax
je 0x43fea9
lea eax, [ebp - 0x848]
mov dword [ebp - 0x848], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x83c]
push eax
push edi
push 0x40fde8
push dword [ebp - 0x840]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
push 0xd
pop ebx
cmp edi, 2
jne 0x43ffd7
lea eax, [ebp - 0x848]
mov dword [ebp - 0x848], 0x4f8
push eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x83c]
push eax
push 0
push 0x40fdfc
push dword [ebp - 0x840]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x43ffd7
cmp dword [ebp - 0x83c], 3
jne 0x43ffd5
cmp dword [ebp - 0x828], 0x4f8
jne 0x43ffd5
cmp word [ebp - 0x824], 4
jne 0x43ffd5
cmp word [ebp - 0x710], ax
je 0x43ffd5
lea eax, [ebp - 0x710]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x210]
call fcn.0041ff0d
mov dword [ebp - 0x83c], 1
jmp 0x43ffd7
mov edi, ebx
push dword [ebp - 0x840]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x440006
cmp dword [ebp - 0x83c], 1
jne 0x440006
lea eax, [ebp - 0x210]
mov edx, 0x104
push eax
lea ecx, [esi + 0x28]
call fcn.0041ff0d
jmp 0x440079
cmp dword [esi + 0x20], 1
jne 0x440079
test edi, edi
je 0x440012
mov ebx, edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.WDSCORE.dll_CurrentIP]
push eax
push 0x40fe20
push 0x40fb60
push 0x3d5
push 0
push 0x406890
push 0xa4000
push 0x40fe8c
push 0x40fec4
push 0x2000005
call fcn.00420037
add esp, 0xc
push eax
call dword [sym.imp.WDSCORE.dll_WdsSetupLogMessageW]
lea edx, [ebp - 0x82c]
mov ecx, edi
call fcn.00425e30
test eax, eax
je 0x43fea9
push 0x40fee8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
lea ecx, [ebp - 0x834]
call fcn.0041ffb3
cmp dword [ebp - 0x834], 0
je 0x4400e4
push 0x40ff04
push dword [ebp - 0x834]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4400e4
push 0x40ff1c
mov ecx, edi
call dword [0x46a7c8]
call edi
mov edi, eax
test edi, edi
je 0x4400e4
push edi
mov edx, 0x104
lea ecx, [esi + 0x230]
call fcn.0041ff0d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor edi, edi
jmp 0x440179
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.WDSCORE.dll_CurrentIP]
push eax
push 0x40fe20
push 0x40fb60
push 0x3f9
push 0
push 0x406890
push 0xa4000
push 0x40fe8c
push 0x40ff3c
push 0x2000006
call fcn.00420037
add esp, 0xc
push eax
call dword [sym.imp.WDSCORE.dll_WdsSetupLogMessageW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042001a
mov esi, eax
jmp 0x43feaf
call fcn.0043fd33
test eax, eax
je 0x440179
cmp byte [ebp - 0x216], 1
jne 0x440179
test dword [ebp - 0x218], 0x200
mov edx, 0x104
mov ecx, ebx
je 0x44016f
push 0x40ff60
jmp 0x440174
push 0x40ff78
call fcn.0041ff0d
lea eax, [ebp - 0x830]
mov dword [ebp - 0x830], edi
push eax
push 0x20119
push edi
push 0x413078
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x830], 0
mov edi, eax
je 0x4401b3
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x4401ca
mov dword [esi + 0x24], 1
mov dword [ebp - 0x830], 0x40ff94
jmp 0x4401db
mov dword [esi + 0x24], 2
mov dword [ebp - 0x830], 0x40ffb0
cmp dword [esi + 0x20], 1
jne 0x4401ed
mov dword [ebp - 0x838], 0x40ffd0
jmp 0x44020f
cmp dword [esi + 0x20], 2
jne 0x4401ff
mov dword [ebp - 0x838], 0x40ffd8
jmp 0x44020f
cmp dword [esi + 0x20], 3
jne 0x44020f
mov dword [ebp - 0x838], 0x40ffe4
cmp dword [esi + 0x18], 1
mov edi, 0x40ffec
je 0x44021f
mov edi, 0x410014
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x858]
push eax
lea edx, [ebp - 0x844]
lea ecx, [ebp - 0x854]
call fcn.0044542f
mov ebx, eax
test ebx, ebx
js 0x44029a
mov ebx, dword [ebp - 0x844]
push 0xffffffffffffffff
push 0x41003c
push 0xffffffffffffffff
push ebx
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 2
pop ecx
sub eax, ecx
jne 0x440274
mov dword [esi + 0x1c], ecx
jmp 0x440296
push 0xffffffffffffffff
push 0x410050
push 0xffffffffffffffff
push ebx
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec eax
dec eax
jne 0x440296
mov dword [esi + 0x1c], 1
xor esi, esi
jmp 0x4402e6
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.WDSCORE.dll_CurrentIP]
push eax
push 0x40fe20
push 0x40fb60
push 0x44b
push esi
push 0x406890
push 0xa4000
push ebx
push 0x41005c
push 0x2000000
call fcn.00420037
add esp, 0xc
push eax
call dword [sym.imp.WDSCORE.dll_WdsSetupLogMessageW]
mov ebx, dword [ebp - 0x860]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.WDSCORE.dll_CurrentIP]
push eax
push 0x40fe20
push 0x40fb60
push 0x455
push esi
push 0x406890
push 0xa4000
push dword [ebp - 0x830]
push edi
push dword [ebp - 0x838]
push dword [ebp - 0x864]
push ebx
push dword [ebp - 0x85c]
push 0x410098
push 0x4000000
call fcn.00420037
add esp, 0x20
push eax
call dword [sym.imp.WDSCORE.dll_WdsSetupLogMessageW]
mov esi, dword [ebp - 0x82c]
mov ecx, esi
call fcn.0041b049
lea ecx, [ebp - 0x84c]
call fcn.0041b11d
lea ecx, [ebp - 0x850]
call fcn.0041b11d
lea ecx, [ebp - 0x858]
call fcn.0041b11d
lea ecx, [ebp - 0x844]
call fcn.0041b11d
lea ecx, [ebp - 0x854]
call fcn.0041b11d
lea ecx, [ebp - 0x834]
call fcn.0041da76
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00445fe0
mov esp, ebp
pop ebp
ret