Function at 0x43f0ce
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d4
mov eax, dword [0x4a13b4]
xor eax, esp
mov dword [esp + 0x2d0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x24], eax
push 1
xor ebx, ebx
push ecx
mov byte [edi], bl
lea ecx, [esp + 0x60]
mov byte [eax], bl
call fcn.0044117d
cmp dword [esp + 0xf4], ebx
jne 0x43f134
mov ecx, dword [ebp + 4]
push 0x40872c
push 0x56
pop edx
call fcn.0047b157
lea ecx, [esp + 0x58]
call fcn.004233f9
mov eax, 0x80004005
jmp 0x43f363
mov esi, 0xc8
lea eax, [esp + 0x148]
push esi
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [esp + 0x18], esi
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 1
push eax
lea eax, [esp + 0x14c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x40876c
push ebx
push dword [esp + 0x108]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
mov esi, eax
test esi, esi
je 0x43f1b6
jle 0x43f18c
movzx eax, si
or eax, 0x80070000
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 1
call fcn.0043ef32
cmp esi, 2
jne 0x43f121
mov byte [edi], 1
jmp 0x43f121
cmp dword [esp + 0x14], 1
je 0x43f1da
lea edx, [esp + 0x14]
mov byte [edi], 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 2
call fcn.0043ef32
jmp 0x43f121
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x28]
lea ecx, [esp + 0x154]
call fcn.0043f703
mov dword [esp + 0x10], eax
test eax, eax
jns 0x43f22f
mov ecx, dword [ebp + 4]
push eax
push 0x40872c
push 0x78
pop edx
call fcn.00475b3c
lea edx, [esp + 0x10]
mov byte [edi], 1
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 3
call fcn.0043ef32
jmp 0x43f121
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0x20
push eax
push 0x408798
push 1
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetNLSVersionEx]
test eax, eax
jne 0x43f282
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x43f25f
movzx eax, ax
or eax, 0x80070000
lea edx, [esp + 0x10]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 4
call fcn.0043ef32
mov ebx, 0x80004005
jmp 0x43f358
cmp dword [esp + 0x1c], 9
jne 0x43f2f5
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x3c]
jne 0x43f2f5
push 0x10
mov esi, 0x405474
lea eax, [esp + 0x2c]
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
je 0x43f2c9
lea edx, [esp + 0x28]
mov ecx, ebx
mov eax, dword [edx + ecx*4]
lea esi, [esp + 0x48]
cmp eax, dword [esi + ecx*4]
mov esi, 0x405474
jne 0x43f2f5
inc ecx
cmp ecx, 4
jne 0x43f2b2
mov eax, dword [esp + 0x40]
cmp dword [esp + 0xc], eax
ja 0x43f2f5
mov ecx, dword [esp + 0x24]
mov byte [ecx], 1
jb 0x43f2f0
lea edx, [esp + 0x28]
mov ecx, ebx
mov eax, dword [edx + ecx*4]
cmp eax, dword [esi + ecx*4]
jne 0x43f358
inc ecx
cmp ecx, 4
jne 0x43f2e2
mov byte [edi], 1
jmp 0x43f358
xor eax, eax
mov word [esp + 0x210], ax
mov word [esp + 0xf8], ax
lea eax, [esp + 0xf8]
push 0x28
push eax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
lea eax, [esp + 0xf8]
push eax
push dword [esp + 0x44]
lea eax, [esp + 0x218]
push dword [esp + 0x44]
push 9
push 0x4087c4
push 0x64
push eax
call fcn.0042f13a
add esp, 0x1c
lea edx, [esp + 0x210]
lea ecx, [esp + 0x148]
call fcn.0043eec0
lea ecx, [esp + 0x58]
call fcn.004233f9
mov eax, ebx
mov ecx, dword [esp + 0x2dc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042bef0
mov esp, ebp
pop ebp
ret 4