Function at 0x443a60
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
xor esi, esi
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 4
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov edi, ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
inc esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x104
push ecx
jmp 0x443d12
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test ecx, ecx
je 0x443cf0
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test eax, eax
je 0x443ce2
cmp eax, 2
jbe 0x443c5b
cmp eax, 3
je 0x443bc2
jbe 0x443ce2
cmp eax, 5
jbe 0x443b75
cmp eax, 7
jne 0x443ce2
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
pop ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
test eax, eax
je 0x443ce2
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor eax, eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x443c34
push dword [ebp - 0x418]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
jmp 0x443c10
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor eax, eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 4
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x443ce6
push 4
lea eax, reloc.ADVAPI32.dll_TraceMessage
jmp 0x443cc1
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
pop ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
test eax, eax
je 0x443ce2
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor eax, eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x443c34
push dword [ebp - 0x418]
push dword [ebp - 0x424]
push dword [ebp - 0x420]
xor eax, eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x443c34
xor eax, eax
mov esi, eax
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
je 0x443ce6
push dword [ebp - 0x424]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
xor eax, eax
pop ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
jmp 0x443ce6
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor eax, eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x443ce6
lea ecx, reloc.ADVAPI32.dll_TraceMessage
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x428]
jne 0x443ca0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x420]
xor eax, eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x443ce6
xor eax, eax
mov esi, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x104
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
inc edi
xor ecx, ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x104
test eax, eax
je 0x443adb
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
push ebx
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x443e24
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor ecx, ecx
push 0x20019
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x438]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x443dee
xor ecx, ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
push 0x2001f
push ecx
push ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x443dde
push dword [ebp - 0x430]
push dword [ebp - 0x428]
call fcn.00443a60
test eax, eax
jne 0x443dd4
mov esi, eax
push dword [ebp - 0x430]
call ebx
jmp 0x443de2
xor eax, eax
mov esi, eax
push dword [ebp - 0x428]
call ebx
xor eax, eax
jmp 0x443df2
xor eax, eax
mov esi, eax
push eax
push eax
push eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
inc edi
push edi
push dword [ebp - 0x438]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x443d61
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 8