Function at 0x4311cd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp dword [0x443534], 0xffffffff
push edi
mov dword [ebp - 0x41c], esi
jne 0x431201
push ecx
push 3
pop edx
call fcn.0041e530
push 3
mov edx, 0x407ff4
pop ecx
call fcn.0041e988
cmp dword [ebx + 0x10], esi
je 0x43121d
push dword [ebx + 0x10]
mov ecx, ebx
call fcn.00430fc2
lea eax, [ebp - 0x41c]
push eax
push 1
push esi
push 0x401680
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 4
pop edi
test eax, eax
jne 0x43150c
lea eax, [ebp - 0x424]
mov dword [ebp - 0x428], esi
push eax
lea eax, [ebp - 0x428]
mov dword [ebp - 0x420], edi
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], edi
push eax
push esi
push 0x408020
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4313be
cmp dword [ebp - 0x428], 1
jne 0x4313be
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push 0x408058
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4313be
cmp dword [ebp - 0x420], 1
jne 0x4313be
mov edi, dword [ebx + 8]
lea eax, [ebp - 0x210]
mov ecx, 0x4015c0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43130a
test dx, dx
je 0x431306
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43130a
add eax, 4
add ecx, 4
test dx, dx
jne 0x4312e4
mov eax, esi
jmp 0x43130f
sbb eax, eax
or eax, 1
test eax, eax
je 0x4313a8
jmp 0x431341
mov eax, dword [edi]
test eax, eax
je 0x431345
mov eax, dword [eax]
test eax, eax
jne 0x43132a
mov eax, 0x4015c0
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x43135f
mov edi, dword [edi + 4]
test edi, edi
jne 0x431319
push 0xb8
call fcn.0041fb3c
pop ecx
test eax, eax
je 0x43136d
mov ecx, eax
call fcn.0042dc33
mov edi, eax
jmp 0x43136f
mov eax, dword [edi]
mov dword [eax + 0x8c], 1
jmp 0x4313a8
mov edi, esi
test edi, edi
je 0x4313a8
lea edx, [ebp - 0x210]
mov ecx, edi
call fcn.0041ede1
mov dword [edi + 0x8c], 1
test eax, eax
jne 0x43139a
push edi
mov ecx, ebx
call fcn.0042f118
test eax, eax
je 0x4313a8
mov ecx, edi
call fcn.0041fb3c
push edi
call fcn.00441835
pop ecx
lea eax, [ebp - 0x210]
push eax
push 0x40808c
push 3
call fcn.0041ea5f
add esp, 0xc
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push 0x401f7c
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4314fd
cmp dword [ebp - 0x420], 1
jne 0x4314fd
mov edi, dword [ebx + 8]
lea eax, [ebp - 0x210]
mov ecx, 0x4015c0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x431438
test dx, dx
je 0x431434
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x431438
add eax, 4
add ecx, 4
test dx, dx
jne 0x431412
mov eax, esi
jmp 0x43143d
sbb eax, eax
or eax, 1
test eax, eax
je 0x4314e7
jmp 0x43146f
mov eax, dword [edi]
test eax, eax
je 0x431473
mov eax, dword [eax]
test eax, eax
jne 0x431458
mov eax, 0x4015c0
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x43148d
mov edi, dword [edi + 4]
test edi, edi
jne 0x431447
push 0xb8
call fcn.0044180c
pop ecx
test eax, eax
je 0x43149b
mov ecx, eax
call fcn.0042dc33
mov edi, eax
jmp 0x43149d
mov eax, dword [edi]
mov dword [eax + 0x90], 1
jmp 0x4314e7
mov edi, esi
test edi, edi
je 0x4314e7
lea edx, [ebp - 0x210]
mov ecx, edi
call fcn.0041ede1
mov dword [edi + 0x90], 1
test eax, eax
jne 0x4314d9
push esi
mov ecx, edi
call fcn.0042e161
test eax, eax
je 0x4314d2
push edi
mov ecx, ebx
call fcn.0042f118
jmp 0x4314d5
xor eax, eax
inc eax
test eax, eax
je 0x4314e7
mov ecx, edi
call fcn.0042dcee
push edi
call fcn.00441835
pop ecx
lea eax, [ebp - 0x210]
push eax
push 0x4080ac
push 3
call fcn.0041ea5f
add esp, 0xc
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
pop edi
lea eax, [ebp - 0x41c]
push eax
push 1
push esi
push 0x401680
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43165e
lea eax, [ebp - 0x420]
mov dword [ebp - 0x428], edi
push eax
lea eax, [ebp - 0x418]
mov dword [ebp - 0x420], 0x208
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push 0x4080cc
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x431652
cmp dword [ebp - 0x428], 1
jne 0x431652
mov ecx, 0x4015c0
lea eax, [ebp - 0x418]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4315a9
test dx, dx
je 0x4315a5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4315a9
add eax, edi
add ecx, edi
test dx, dx
jne 0x431585
mov eax, esi
jmp 0x4315ae
sbb eax, eax
or eax, 1
test eax, eax
je 0x431652
mov edi, dword [ebx + 8]
jmp 0x4315e7
mov eax, dword [edi]
test eax, eax
je 0x4315eb
mov eax, dword [eax]
test eax, eax
jne 0x4315cc
mov eax, 0x4015c0
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x43166f
mov edi, dword [edi + 4]
test edi, edi
jne 0x4315bb
push 0xb8
call fcn.0044180c
pop ecx
test eax, eax
je 0x431603
mov ecx, eax
call fcn.0042dc33
mov esi, eax
test esi, esi
je 0x43163c
lea edx, [ebp - 0x418]
mov ecx, esi
call fcn.0041ede1
mov dword [esi + 0x94], 1
test eax, eax
jne 0x43162e
push esi
mov ecx, ebx
call fcn.0042f118
test eax, eax
je 0x43163c
mov ecx, esi
call fcn.0042dcee
push esi
call fcn.00441835
pop ecx
lea eax, [ebp - 0x418]
push eax
push 0x4080f8
push 3
call fcn.0041ea5f
add esp, 0xc
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov dword [eax + 0x94], 1
jmp 0x43163c