Function at 0x43e27a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x898
mov eax, 0x48659e
call fcn.00468ad7
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x8a4], ecx
cmp ebx, esi
je 0x43e26f
cmp eax, esi
je 0x43e26f
push eax
lea ecx, [ebp - 0x88c]
call fcn.00424491
xor eax, eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x840], 7
mov dword [ebp - 0x844], esi
mov word [ebp - 0x854], ax
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x890]
push eax
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x890], 0x5c
call fcn.0043d8b5
mov edi, eax
cmp edi, 0xffffffff
jne 0x43dfb4
mov edi, 0x3f2
push esi
push 1
lea ecx, [ebp - 0x854]
call fcn.0041f501
push esi
push 1
lea ecx, [ebp - 0x88c]
call fcn.0041f501
mov eax, edi
jmp 0x43e274
push 0xffffffffffffffff
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x870]
push eax
lea ecx, [ebp - 0x88c]
call fcn.00429b29
push eax
lea ecx, [ebp - 0x854]
mov byte [ebp - 4], 2
call fcn.00420041
push esi
push 1
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], 1
call fcn.0041f501
push edi
push esi
lea eax, [ebp - 0x870]
push eax
lea ecx, [ebp - 0x88c]
call fcn.00429b29
push eax
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], 3
call fcn.00420041
xor edi, edi
push esi
inc edi
push edi
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], 1
call fcn.0041f501
cmp dword [ebp - 0x878], 8
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x894], esi
jae 0x43e041
lea eax, [ebp - 0x88c]
push esi
lea ecx, [ebp - 0x894]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
je 0x43e065
mov edi, eax
jmp 0x43df91
mov ebx, dword [ebp - 0x8a4]
mov eax, dword [ebx + 8]
sub eax, esi
je 0x43e08b
dec eax
je 0x43e07f
mov edi, 0x65e
jmp 0x43df91
mov dword [ebp - 0x890], 4
jmp 0x43e091
mov dword [ebp - 0x890], edi
xor eax, eax
push 0x7fe
mov word [ebp - 0x838], ax
lea eax, [ebp - 0x836]
push esi
push eax
call fcn.00466c70
mov eax, dword [ebp - 0x854]
add esp, 0xc
cmp dword [ebp - 0x840], 8
mov dword [ebp - 0x89c], esi
mov dword [ebp - 0x8a0], 0x800
jae 0x43e0d4
lea eax, [ebp - 0x854]
lea ecx, [ebp - 0x8a0]
push ecx
lea ecx, [ebp - 0x838]
push ecx
lea ecx, [ebp - 0x89c]
push ecx
push esi
push eax
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x43e1ca
mov eax, dword [ebp - 0x890]
cmp dword [ebp - 0x89c], eax
jne 0x43e075
xor ecx, ecx
mov dword [ebp - 0x85c], 7
mov dword [ebp - 0x860], esi
mov word [ebp - 0x870], cx
mov byte [ebp - 4], 4
cmp eax, 4
jne 0x43e17a
push 9
xor eax, eax
pop ecx
push dword [ebp - 0x838]
mov word [ebp - 0x38], ax
lea edi, [ebp - 0x36]
rep stosd dword es:[edi], eax
push 0x49208c
stosw word es:[edi], ax
lea eax, [ebp - 0x38]
push 0x13
push eax
call fcn.0046bb7d
lea eax, [ebp - 0x38]
push eax
call fcn.00468f76
add esp, 0x14
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x870]
call fcn.00424413
xor edi, edi
inc edi
jmp 0x43e19e
cmp eax, edi
jne 0x43e19e
lea eax, [ebp - 0x838]
push eax
call fcn.00468f76
pop ecx
push eax
lea eax, [ebp - 0x838]
push eax
lea ecx, [ebp - 0x870]
call fcn.00424413
lea eax, [ebp - 0x870]
push ebx
push eax
call fcn.0043d9bd
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x870]
push edi
test al, al
jne 0x43e1c5
call fcn.0041f501
xor edi, edi
jmp 0x43df91
call fcn.0041f501
xor eax, eax
xor ecx, ecx
cmp dword [ebp - 0x890], 4
mov dword [ebp - 0x898], esi
jne 0x43e200
lea eax, [ebx + 0x28]
cmp dword [eax + 0x14], 8
jb 0x43e1e8
mov eax, dword [eax]
push eax
call fcn.0046bb72
pop ecx
push 4
mov dword [ebp - 0x898], eax
lea eax, [ebp - 0x898]
pop ecx
jmp 0x43e21a
cmp dword [ebp - 0x890], edi
jne 0x43e21a
lea eax, [ebx + 0x28]
cmp dword [eax + 0x14], 8
jb 0x43e213
mov eax, dword [eax]
mov ecx, dword [ebx + 0x38]
lea ecx, [ecx + ecx + 2]
cmp dword [ebp - 0x840], 8
mov edx, dword [ebp - 0x854]
jae 0x43e22f
lea edx, [ebp - 0x854]
push ecx
push eax
push dword [ebp - 0x890]
push esi
push edx
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
lea ecx, [ebp - 0x854]
call fcn.0041f501
push esi
push edi
lea ecx, [ebp - 0x88c]
call fcn.0041f501
xor eax, eax
jmp 0x43e274
mov eax, 0x3f2
call fcn.00468b5a
ret
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
sub eax, 0
je 0x43e2b5
dec eax
jne 0x43e2ae
mov eax, dword [ecx]
test eax, eax
js 0x43e2ae
cmp eax, 1
jle 0x43e29e
cmp eax, 2
jne 0x43e2ae
pop ebp
jmp 0x43df0c
push dword [ebp + 0xc]
mov edx, ecx
mov ecx, dword [ebp + 8]
call fcn.0043db9a
pop ecx
pop ebp
ret
mov eax, 0xde
pop ebp
ret
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043d5c5
add esp, 0xc
pop ebp
ret