Function at 0x43af84
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x65d4
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
mov dword [ebp - 0x65d4], ecx
xor edx, edx
push 0xa
pop ecx
call fcn.00404481
pop ecx
test al, al
je 0x43b38c
push 7
pop ecx
mov esi, str.SAMSAMDomainsAccountUsers
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x65c4]
xor ebx, ebx
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x24]
movsw word es:[edi], word [esi]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43b38c
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x65bc]
mov dword [ebp - 0x65c8], ebx
push eax
lea eax, [ebp - 0x7f8]
mov dword [ebp - 0x65bc], 0x3e8
push eax
push ebx
push dword [ebp - 0x65c4]
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43b377
lea eax, [ebp - 0x7f8]
push str.Names
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
je 0x43b345
lea eax, [ebp - 0x65d0]
push eax
lea eax, [ebp - 0x7f8]
push 0x6ccd68
push eax
call fcn.00404468
add esp, 0xc
lea eax, [ebp - 0x7f8]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x6c643c
lea eax, [ebp - 0x13b0]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x14
lea eax, [ebp - 0x65c0]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x13b0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43b345
lea eax, [ebp - 0x65bc]
mov dword [ebp - 0x65bc], 0x2710
push eax
lea eax, [ebp - 0x3ea8]
push eax
lea eax, [ebp - 0x65cc]
push eax
push 0
push str.ResetData
push dword [ebp - 0x65c0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x43b0ee
push dword [ebp - 0x65c0]
call ebx
jmp 0x43b345
xor ecx, ecx
lea eax, [ebp - 0x65b8]
push ecx
push ecx
push 0x2710
push eax
mov eax, dword [ebp - 0x65bc]
shr eax, 1
push eax
lea eax, [ebp - 0x3ea8]
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x65bc]
shr eax, 1
cmp eax, 0x2710
jae 0x43b39d
mov byte [ebp + eax - 0x65b8], 0
lea eax, [ebp - 0x65bc]
push eax
lea eax, [ebp - 0x3ea8]
mov dword [ebp - 0x65bc], 0x2710
push eax
lea eax, [ebp - 0x65cc]
push eax
push 0
push 0x6ccd6c
push dword [ebp - 0x65c0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x65c0]
mov esi, eax
call ebx
test esi, esi
lea eax, [ebp - 0x410]
mov esi, 0x3e8
jne 0x43b1d0
xor ecx, ecx
lea edx, [ebp - 0x3ddc]
push ecx
push ecx
push esi
push eax
mov eax, dword [ebp - 0x3e98]
shr eax, 1
push eax
mov eax, dword [ebp - 0x3e9c]
add eax, edx
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x3e98]
shr eax, 1
cmp eax, esi
jae 0x43b39d
mov byte [ebp + eax - 0x410], 0
movsx eax, byte [ebp - 0x410]
push eax
call fcn.006509c7
pop ecx
mov byte [ebp - 0x410], al
jmp 0x43b1df
push str.Unknown
push esi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
call fcn.00643470
cmp eax, 0x3b6
lea eax, [ebp - 0x410]
pop ecx
jae 0x43b217
push dword [ebp - 0x65d0]
push eax
push str._s___d_
lea eax, [ebp - 0xbe0]
push esi
push eax
call fcn.00402e0a
add esp, 0x14
jmp 0x43b228
push eax
lea eax, [ebp - 0xbe0]
push esi
push eax
call fcn.006494f3
add esp, 0xc
lea ecx, [ebp - 0x65b8]
call fcn.004046b4
lea eax, [ebp - 0x65b8]
push str.question:
push eax
call fcn.00639500
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x43b345
mov ebx, dword [ebp - 0x65d4]
push str.question:
call fcn.00643470
pop ecx
add esi, eax
push 0x2c
push esi
call fcn.006393d0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x43b339
mov ecx, edi
lea eax, [ebp - 0xfc8]
sub ecx, esi
push ecx
push esi
push 0x3e8
push eax
call fcn.00650b7d
push str.answer:
push edi
call fcn.00639500
mov esi, eax
add esp, 0x18
test esi, esi
je 0x43b339
push str.answer:
call fcn.00643470
pop ecx
add esi, eax
push 0x7d
push esi
call fcn.006393d0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x43b339
mov ecx, edi
lea eax, [ebp - 0x1798]
sub ecx, esi
push ecx
push esi
push 0x3e8
push eax
call fcn.00650b7d
lea eax, [ebp - 0xfc8]
inc edi
push 0x92
push eax
call fcn.006393d0
add esp, 0x18
test eax, eax
je 0x43b2f6
mov byte [eax], 0x27
push 0xffffffffffffffff
mov ecx, 0x6c5bb9
lea eax, [ebp - 0x1798]
push ecx
push eax
lea eax, [ebp - 0xbe0]
push eax
lea eax, [ebp - 0xfc8]
push eax
push ecx
push 0x209
push 0xc
mov ecx, ebx
call fcn.0043ee6b
push str.question:
push edi
call fcn.00639500
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x43b256
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x65c8]
xor eax, eax
mov dword [ebp - 0x65bc], 0x3e8
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x65bc]
inc edi
push eax
lea eax, [ebp - 0x7f8]
mov dword [ebp - 0x65c8], edi
push eax
push edi
push dword [ebp - 0x65c4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x43b029
push dword [ebp - 0x65c4]
call ebx
xor eax, eax
inc eax
jmp 0x43b38e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
call fcn.00612782
int3