Function at 0x4389f9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3c4c
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 5
mov dword [ebp - 0x3c40], ecx
lea eax, [ebp - 0xd3c]
pop ecx
push 0x50
mov ebx, str.SOFTWARETeamViewer
lea edi, [ebp - 0xd50]
mov esi, ebx
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0xcd8]
mov esi, ebx
lea edi, [ebp - 0xcec]
push 5
pop ecx
push 0x50
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0xc88]
mov ebx, str.SOFTWARETeamViewerTemp
lea eax, [ebp - 0xc6f]
mov esi, ebx
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x4b
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0xc24]
mov esi, ebx
lea eax, [ebp - 0xc0b]
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x4b
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0xbc0]
mov ebx, str.SOFTWARETeamViewerVersion15
lea eax, [ebp - 0xba2]
mov esi, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0xb5c]
mov esi, ebx
lea eax, [ebp - 0xb3e]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
add esp, 0xc
mov ebx, str.SOFTWARETeamViewerVersion14
mov esi, ebx
push 7
pop ecx
lea edi, [ebp - 0xaf8]
rep movsd dword es:[edi], dword [esi]
push 0x46
lea eax, [ebp - 0xada]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0xa94]
mov esi, ebx
lea eax, [ebp - 0xa76]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0xa30]
mov ebx, str.SOFTWARETeamViewerVersion13
lea eax, [ebp - 0xa12]
mov esi, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x9cc]
mov esi, ebx
lea eax, [ebp - 0x9ae]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x968]
mov ebx, str.SOFTWARETeamViewerVersion12
lea eax, [ebp - 0x94a]
mov esi, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x904]
mov esi, ebx
lea eax, [ebp - 0x8e6]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x8a0]
mov ebx, str.SOFTWARETeamViewerVersion11
lea eax, [ebp - 0x882]
mov esi, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
movsw word es:[edi], word [esi]
push eax
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x83c]
mov esi, ebx
lea eax, [ebp - 0x81e]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x7d8]
mov ebx, str.SOFTWARETeamViewerVersion10
lea eax, [ebp - 0x7ba]
mov esi, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x774]
mov esi, ebx
lea eax, [ebp - 0x756]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x710]
mov ebx, str.SOFTWARETeamViewerVersion9
lea eax, [ebp - 0x6f3]
mov esi, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x47
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x6ac]
mov esi, ebx
lea eax, [ebp - 0x68f]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x47
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x648]
mov ebx, str.SOFTWARETeamViewerVersion8
lea eax, [ebp - 0x62b]
mov esi, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x47
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
mov esi, ebx
push 7
pop ecx
lea edi, [ebp - 0x5e4]
rep movsd dword es:[edi], dword [esi]
push 0x47
lea eax, [ebp - 0x5c7]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x580]
mov ebx, str.SOFTWARETeamViewerVersion7
lea eax, [ebp - 0x563]
mov esi, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x47
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x51c]
mov esi, ebx
lea eax, [ebp - 0x4ff]
xor ebx, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x47
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.006390b0
mov esi, str.OptionsPasswordAES
lea edi, [ebp - 0x260]
add esp, 0xc
lea eax, [ebp - 0x24d]
movsd dword es:[edi], dword [esi]
push 0x51
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0x1e8]
mov esi, str.SecurityPasswordAES
lea edi, [ebp - 0x1fc]
push 5
pop ecx
push 0x50
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x198]
mov esi, str.SecurityPasswordExported
lea eax, [ebp - 0x17f]
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x4b
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.006390b0
mov esi, str.PermanentPassword
lea edi, [ebp - 0x134]
add esp, 0xc
movsd dword es:[edi], dword [esi]
push 0x52
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x122]
push eax
call fcn.006390b0
mov esi, str.ServerPasswordAES
lea edi, [ebp - 0xd0]
add esp, 0xc
lea eax, [ebp - 0xbe]
movsd dword es:[edi], dword [esi]
push 0x52
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.006390b0
mov esi, str.ProxyPasswordAES
lea edi, [ebp - 0x6c]
add esp, 0xc
lea eax, [ebp - 0x5b]
movsd dword es:[edi], dword [esi]
push 0x53
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.006390b0
mov esi, str.Options_Password
lea edi, [ebp - 0x4b8]
add esp, 0xc
lea eax, [ebp - 0x4a7]
movsd dword es:[edi], dword [esi]
push 0x53
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0x440]
mov ebx, str.Unattended_Password
lea edi, [ebp - 0x454]
mov esi, ebx
push 5
pop ecx
push 0x50
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x3f0]
mov esi, str.Exported_Unattended_Password
lea eax, [ebp - 0x3d3]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x47
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0x378]
mov esi, ebx
lea edi, [ebp - 0x38c]
xor ebx, ebx
push 5
pop ecx
push 0x50
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.006390b0
add esp, 0xc
push 6
pop ecx
push 0x4c
lea eax, [ebp - 0x310]
mov esi, str.Backend_Server_Password
lea edi, [ebp - 0x328]
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.006390b0
add esp, 0xc
lea edi, [ebp - 0x2c4]
mov esi, str.Proxy_Server_Password
lea eax, [ebp - 0x2ae]
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x4e
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.006390b0
mov esi, dword [ebp - 0x3c40]
lea edi, [ebp - 0xd50]
add esp, 0xc
mov dword [ebp - 0x3c44], ebx
test bl, 1
jne 0x438ef9
cmp dword [esi + 0x5b87c], 0
je 0x439043
mov eax, 0x20119
jmp 0x438efe
mov eax, 0x20019
lea ecx, [ebp - 0x3c3c]
push ecx
push eax
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x439043
mov ebx, dword [ebp - 0x3c40]
xor esi, esi
lea eax, [ebp - 0x3c34]
mov dword [ebp - 0x3c34], 0x2710
push eax
lea eax, [ebp - 0x3c30]
push eax
lea eax, [ebp - 0x3c48]
push eax
push 0
lea eax, [ebp - 0x260]
add eax, esi
push eax
push dword [ebp - 0x3c3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43901c
push ecx
lea eax, [ebp - 0x1520]
push eax
push dword [ebp - 0x3c34]
lea eax, [ebp - 0x3c30]
push eax
call fcn.00438888
test eax, eax
je 0x43901c
lea eax, [ebp - 0x3c34]
mov dword [ebp - 0x3c34], 4
push eax
lea eax, [ebp - 0x3c38]
xor ecx, ecx
push eax
lea eax, [ebp - 0x3c48]
mov byte [ebp - 0x1138], cl
push eax
push ecx
push str.ClientID
push dword [ebp - 0x3c3c]
mov dword [ebp - 0x3c38], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x438fee
cmp dword [ebp - 0x3c38], eax
je 0x438fee
push dword [ebp - 0x3c38]
lea eax, [ebp - 0x1138]
push str.ID_u
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x10
push 0xffffffffffffffff
mov ecx, 0x6c5bb9
lea eax, [ebp - 0x1520]
push ecx
push eax
lea eax, [ebp - 0x1138]
push eax
lea eax, [ebp - 0x4b8]
add eax, esi
push eax
push ecx
push 0x2da
push 7
mov ecx, ebx
call fcn.0043ee6b
add esi, 0x64
cmp esi, 0x258
jb 0x438f24
push dword [ebp - 0x3c3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x3c44]
mov esi, dword [ebp - 0x3c40]
inc ebx
add edi, 0x64
mov dword [ebp - 0x3c44], ebx
cmp ebx, 0x16
jb 0x438ee0
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.006122f0
leave
ret