Function at 0x43b072
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 4], 0
push ebx
push esi
lea ecx, [ebp - 0x1c]
call fcn.004636d2
push 4
pop ebx
or word [ebp - 0x14], bx
lea eax, [ebp - 0x1c]
push eax
call fcn.0043ae8d
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
js 0x43b0dd
lea eax, [ebp - 4]
push eax
push 3
push 0
push dword [ebp - 0x1c]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43b0dd
push 0x41bf18
push dword [ebp - 4]
call esi
push 0x41bf34
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 3
push eax
push eax
push eax
push 0x401478
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43b28a
and dword [ebp - 8], eax
and dword [ebp - 0xc], eax
push 0x41bf18
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call esi
push 0x41bf34
push dword [ebp - 4]
call esi
push 0x41beb0
push dword [ebp - 4]
call esi
cmp dword [0x4685f4], 0
jne 0x43b13a
and dword [0x46844c], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x41bed0
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x43b16c
cmp dword [ebp - 8], ebx
jne 0x43b16c
mov eax, dword [ebp - 0xc]
mov dword [0x468454], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x41bfec
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x43b1a5
cmp dword [ebp - 8], ebx
jne 0x43b197
mov al, byte [ebp - 0xc]
and al, 1
jmp 0x43b1a0
cmp dword [ebp - 8], 3
jne 0x43b1a5
mov al, byte [ebp - 0xc]
mov byte [0x468460], al
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x41bef4
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x43b1d1
cmp dword [ebp - 8], ebx
jne 0x43b1d1
mov eax, dword [ebp - 0xc]
mov dword [0x468568], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x41bf5c
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x43b1fd
cmp dword [ebp - 8], ebx
jne 0x43b1fd
mov eax, dword [ebp - 0xc]
mov dword [0x468450], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x41bf7c
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x43b229
cmp dword [ebp - 8], ebx
jne 0x43b229
mov eax, dword [ebp - 0xc]
mov dword [0x46856c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x41bfa4
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x43b255
cmp dword [ebp - 8], ebx
jne 0x43b255
mov eax, dword [ebp - 0xc]
mov dword [0x46845c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x41bfc4
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x43b281
cmp dword [ebp - 8], ebx
jne 0x43b281
mov eax, dword [ebp - 0xc]
mov dword [0x468448], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00441f05
lea eax, [ebp - 0x1c]
call fcn.00463afc
pop esi
pop ebx
leave
ret