Function at 0x4327fc
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x840
mov eax, 0x5a6ac4
inc eax
or byte [eax], al
add byte [eax + 0x5a6ac4], bh
call fcn.0043caa9
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x84c], edi
call fcn.00403700
mov dword [ebp - 4], edi
mov dword [ebp - 0x838], edi
mov dword [ebp - 0x834], edi
mov dword [ebp - 0x830], edi
call fcn.00426614
test al, al
je 0x432888
push eax
jge 0x4327fd
ficom word [0x6f0f43e2]
js 0x43288f
xor byte [ecx + 0x6b8d81af], cl
invalid
lea eax, [ebp - 0x838]
mov esi, 0x20119
sbb dword [ecx], eax
add al, byte [eax]
push eax
push esi
push edi
push 0x5ab274
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4328cd
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00425979
push edi
push 1
lea ecx, [ebp - 0x828]
call fcn.004254f0
mov eax, ebx
jmp 0x432b12
call fcn.004266e3
test al, al
je 0x4328f8
adc edi, 0xea905ef9
inc byte [edi + 0x61e26cb9]
scasb al, byte es:[edi]
bound edi, qword [ecx]
lea ebp, [ecx - 0x76d1d8cc]
jecxz 0x43291d
xchg esi, eax
loop 0x4328b0
sti
xor edi, edi
mov esi, 0x20119
lea eax, [ebp - 0x834]
push eax
push esi
push edi
push dword [ebp - 0x840]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43293b
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push eax
call fcn.00425979
push edi
jmp 0x432aff
lea eax, [ebp - 0x830]
push eax
push esi
push edi
push dword [ebp - 0x844]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x432972
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
jmp 0x432923
call fcn.0042613a
test al, al
je 0x43299b
add byte [esi - 0x73], ch
popal
ret
call fcn.004265cf
test al, al
je 0x4329c2
jmp 0x8b0b7255
push 0x800
lea eax, [ebp - 0x810]
push edi
push eax
call fcn.00447ad0
add esp, 0xc
mov dword [ebp - 0x848], 0x400
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push dword [ebp - 0x83c]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042624e
test al, al
je 0x432a29
adc ebp, ecx
lodsd eax, dword [esi]
mov ebx, 0xcd7afa5d
sbb dword [esi - 4], ecx
push ebp
inc eax
loopne 0x432a6c
jge 0x432a76
call fcn.004261c4
test al, al
je 0x432a48
ljmp 0x283b:0x464dee36
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x810]
push eax
call fcn.004561c7
invalid
pop ecx
mov dword [ebp - 0x83c], eax
call fcn.0042658a
test al, al
je 0x432a8c
invalid
jnp 0x432a9c
invalid
call fcn.004262d8
test al, al
je 0x432aac
pushal
sub dh, ah
mov edi, esi
clts
xchg ebx, eax
dec edx
wait
pop eax
inc esi
jae 0x432af4
cmp dword [eax - 0x5d], esp
mov bl, 0x94
or al, byte [ecx - 0x18]
adc esi, dword [edi]
invalid
call fcn.004261c4
test al, al
je 0x432ad4
sbb ebx, dword [edx + 0x35]
push eax
mov ah, dl
xor eax, 0xb034e073
mov edx, 0xdbcbba39
jle 0x432a4c
sub ecx, esp
mov cl, 0xb5
lodsb al, byte [esi]
push esp
cmp al, 0x43
js 0x432aa7
mov bl, cl
mov ecx, 0xf7c4bd83
invalid
cmp dword [ebp - 0x83c], 0
mov ecx, dword [ebp - 0x82c]
jne 0x432af1
lea eax, [ebp - 0x828]
push eax
call fcn.00425979
jmp 0x432afd
lea eax, [ebp - 0x810]
push eax
call fcn.00403700
idiv edi
call dword [eax - 0x18]
add ecx, dword [edi*8 + 0x6a006aff]
add dword [ebp - 0x82773], ecx
invalid
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.004254f0
mov eax, dword [ebp - 0x82c]
call fcn.0043ca64
ret