Function at 0x432b18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a6af7
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.0043c7d0
mov eax, dword [0x630198]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2028]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x203c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2040], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2048], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x202c], edi
mov dword [ebp - 0x204c], ebx
call fcn.00403700
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2038], ebx
mov dword [ebp - 0x2034], ebx
mov dword [ebp - 0x2030], ebx
call fcn.0042624e
test al, al
je 0x432bba
in eax, dx
into
or bl, bh
mov dh, 0x3a
loope 0x432c01
mov ch, 0x41
cdq
and esi, dword [esi + 0x73]
push ecx
aas
mov edi, dword [ebp - 0x202c]
call fcn.004261c4
test al, al
je 0x432bd9
xchg dword [edx + 0x48bcdfeb], ebp
push ds
pop eax
push cs
aaa
and al, 0xd9
ret 0x26fa
lea eax, [ebp - 0x2038]
push eax
push 0xf013f
push 0
push 0x5ab274
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x432c1f
lea eax, [ebp - 0x2028]
mov ecx, edi
push eax
call fcn.00425979
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.004254f0
mov eax, edi
jmp 0x432e2e
call fcn.0042658a
test al, al
je 0x432c38
aad 0xb7
hlt
call fcn.004262d8
test al, al
je 0x432c58
mov ch, 0x2c
dec edx
cmp dword [ebx + 0x38], ebx
test al, 0x79
add esp, ebx
mov ah, 0x44
salc
out 0x30, al
mov cl, 0x69
lodsb al, byte [esi]
mov edx, 0xec154352
call fcn.004261c4
test al, al
je 0x432c80
add bl, byte [ebx + eax*8 + 0x736ff568]
rcl byte [edi - 0x3f9c6038], cl
and eax, dword [esi - 0x12fefa80]
xor eax, dword [ebx]
cld
call 0xdbf30484
in eax, 0x17
aas
stc
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2034]
xor ebx, ebx
mov edi, 0xf013f
push ebx
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x203c]
push dword [ebp - 0x2038]
call esi
test eax, eax
je 0x432cd0
push dword [ebp - 0x2038]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
invalid
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2028]
push eax
call fcn.00425979
push ebx
jmp 0x432e1b
push ebx
lea eax, [ebp - 0x2030]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x2040]
push dword [ebp - 0x2034]
call esi
test eax, eax
je 0x432d07
push dword [ebp - 0x2034]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2030]
call esi
jmp 0x432cb8
call fcn.004262d8
test al, al
je 0x432d31
jmp 0x432caf
push 0x2000
lea eax, [ebp - 0x2010]
push ebx
push eax
call fcn.00447ad0
add esp, 0xc
mov dword [ebp - 0x2044], 0x1000
add byte [eax], dl
add byte [eax], al
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push ebx
push dword [ebp - 0x2048]
push dword [ebp - 0x2030]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2030]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2034]
call esi
push dword [ebp - 0x2038]
call esi
lea eax, [ebp - 0x2010]
push eax
call fcn.004561c7
pop ecx
test eax, eax
je 0x432cb8
call fcn.004266e3
test al, al
je 0x432dc1
or dword [0x69efa699], ebp
or eax, 0xef16d2df
fst dword [ebx]
test eax, esp
outsb dx, byte [esi]
loopne 0x432d4c
call fcn.00426659
test al, al
je 0x432de5
test dword [ebx - 0x4165b85d], eax
ror ecx, 0x13
pop edi
sub dl, byte [eax - 0x462d833f]
stc
adc eax, 0xbc9bf81a
sar byte [ebx], 0x3e
in eax, 0x6c
sar byte [ecx - 0x7e5ea07], cl
wait
mov esp, 0xe53e3bc0
insb byte es:[edi], dx
call fcn.00426614
test al, al
je 0x432e07
sbb dword [ebx + 0x1a], ecx
jnp 0x432e55
dec ebx
sbb bh, byte [ebx + 0x63]
dec ebx
jno 0x432dd8
mov ch, byte [edi]
mov ecx, 0x2f6f3e09
out dx, eax
jae 0x432ded
inc dh
inc ebx
cmp bl, byte [ebx - 0x7274a448]
aam 0xdf
invalid
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2010]
push eax
call fcn.00403700
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.004254f0
mov eax, dword [ebp - 0x202c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c551
mov esp, ebp
pop ebp
ret
or al, ch
xchg esi, eax
cmc
invalid