Function at 0x43b530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24c
mov eax, dword [0x448010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push str.detoured.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x43b66a
push str._etoured.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x43b66a
push str.nvd3d9wrap.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x43b66a
push str.nvdxgiwrap.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x43b66a
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov bl, 1
test eax, eax
je 0x43b5ba
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043c380
mov eax, ebx
add esp, 0x24c
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43b5e7
mov bl, 1
jmp 0x43b5a3
movzx eax, word [0x43fd88]
movsd xmm0, qword [0x43fd80]
movsd xmm2, qword [0x43fd78]
movsd xmm1, qword [0x43fd70]
mov ecx, dword [ebp - 0x248]
lea ebx, [ebp - 0x24c]
mov dword [ebp - 0x24c], 0
mov word [ebp - 0x14], ax
movsd qword [ebp - 0x1c], xmm0
movsd qword [ebp - 0x24], xmm2
movsd qword [ebp - 0x2c], xmm1
lea eax, [ebp - 0x2c]
push ebx
push 0
push 0
push 0
push eax
mov dword [ebp - 0x258], ecx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
test eax, eax
je 0x43b671
cmp dword [ebp - 0x258], 0
je 0x43b662
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x43b5e3
xor ebx, ebx
jmp 0x43b5a3
mov esi, dword [ebp - 0x24c]
inc esi
and esi, 0xfffffffe
push esi
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov edi, eax
push esi
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push ebx
mov dword [ebp - 0x254], edi
push edi
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
test eax, eax
je 0x43b6cf
push dword [ebp - 0x254]
call dword [sym.imp.mozglue.dll_free]
add esp, 4
cmp dword [ebp - 0x258], 0
jne 0x43b656
jmp 0x43b662
movzx eax, word [0x43fd8e]
mov dword [ebp - 0x250], 0
lea ecx, [ebp - 0x244]
mov word [ebp - 0x240], ax
mov eax, dword [0x43fd8a]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x250]
push eax
push ecx
push dword [ebp - 0x254]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
xor esi, esi
test eax, eax
je 0x43b6b5
mov edi, eax
lea ebx, [ebp - 0x22c]
jmp 0x43b742
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x244]
push eax
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
mov edi, eax
test eax, eax
je 0x43b6b5
push 0x200
push 0
push ebx
call sub.ntdll.dll_memset
add esp, 0xc
push 0
push 0
push 0x100
push ebx
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
add esp, 0x24
test eax, eax
jne 0x43b71f
movsd xmm0, qword [0x43fd96]
movsd xmm1, qword [0x43fd90]
movsd qword [ebp - 0x236], xmm0
movsd qword [ebp - 0x23c], xmm1
push 7
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x43b71f
mov esi, 1
jmp 0x43b6b5