Function at 0x43688c
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push esi
push edi
push eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x28], ebx
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
call fcn.00436796
mov edi, dword [ebp - 0x24]
cmp dword [ebp - 0x18], ebx
je 0x436bed
cmp dword [ebp - 0x10], ebx
je 0x436bed
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 3
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x436bed
cmp dword [ebp + 0x10], ebx
je 0x436c5e
test edi, edi
jne 0x436930
cmp dword [ebp - 0x14], ebx
jne 0x436930
push 2
pop eax
push eax
push 0x4015d0
jmp 0x436a08
mov ebx, dword [ebp - 0xc]
shr ebx, 1
not ebx
and ebx, 1
jne 0x436953
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x436953
inc ebx
test ebx, ebx
je 0x436be2
mov eax, 0x10003
cmp dword [ebp - 0xc], eax
ja 0x4369bf
je 0x436986
mov eax, dword [ebp - 0xc]
sub eax, 1
je 0x4369a7
push 2
pop ecx
sub eax, ecx
je 0x4369a7
sub eax, 5
je 0x436a0f
sub eax, 0xfff9
jne 0x4369df
test edi, edi
je 0x436be2
mov ecx, edi
call fcn.0041f003
mov dword [ebp - 0x28], eax
xor ebx, ebx
push 4
lea eax, [ebp - 0x28]
push eax
push 4
jmp 0x436c4d
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
je 0x436be4
push dword [ebp - 0x20]
push dword [ebp - 0x14]
push 3
jmp 0x436c4d
mov eax, dword [ebp - 0xc]
sub eax, 0x20000
je 0x436c27
push 2
pop ecx
sub eax, ecx
je 0x436c27
sub eax, 0x20006
je 0x436a0f
xor ebx, ebx
test edi, edi
je 0x436be4
mov ecx, edi
push 2
pop esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x4369f1
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
jmp 0x436c4d
xor ebx, ebx
test edi, edi
je 0x436be4
test dword [ebp - 0xc], 0x40000
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 7
je 0x436b5f
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x436b5f
cmp dword [ebp - 0x24], 7
jne 0x436b5f
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
ret
jne 0x436a5d
mov eax, dword [ebp - 0x20]
sub ecx, edx
sar ecx, 1
shr eax, 1
add eax, 3
add eax, ecx
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0xc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00440dea
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x436a9c
push 0xe
pop esi
jmp 0x436b5d
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
xor eax, eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x436b4e
cmp ax, word [ebx]
mov edx, ebx
jmp 0x436af8
push edi
push edx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x436b2f
mov edx, dword [ebp - 0x1c]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x28]
jne 0x436adc
sub ecx, dword [ebp - 0x1c]
xor eax, eax
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
cmp ax, word [edx]
mov dword [ebp - 0x1c], edx
jne 0x436ac3
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
dec edx
push edi
call fcn.0040c040
test eax, eax
js 0x436b4e
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x28]
jne 0x436b13
mov eax, dword [ebp - 0x1c]
sub ecx, edx
sar ecx, 1
xor edx, edx
mov word [eax + ecx*2 + 2], dx
jmp 0x436b59
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x28]
jne 0x436b34
sub ecx, edx
or eax, 0xffffffff
sar ecx, 1
sub eax, ecx
add dword [ebp - 0xc], eax
jmp 0x436b59
push ebx
call fcn.00440db7
xor eax, eax
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x436bbd
xor ebx, ebx
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x436b64
sub ecx, edx
sar ecx, 1
push 2
pop edx
lea eax, [ecx + 2]
xor ecx, ecx
mov dword [ebp - 0xc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00440dea
mov ebx, eax
pop ecx
test ebx, ebx
je 0x436be2
mov edx, dword [ebp - 0xc]
mov ecx, ebx
push edi
dec edx
call fcn.0040c040
mov ecx, ebx
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x436ba7
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [ebx + ecx*2 + 2], ax
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
push ebx
push 7
xor eax, eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test ebx, ebx
je 0x436be2
push ebx
call fcn.00440db7
pop ecx
xor ebx, ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x10], 0
jne 0x436c12
cmp dword [ebp - 4], 0
jne 0x436c12
test edi, edi
jne 0x436c12
cmp dword [ebp - 0x10], edi
je 0x436c12
cmp dword [ebp - 0x18], edi
je 0x436c12
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.004223c1
test esi, esi
je 0x436c94
cmp dword [ebp + 0x10], 0
jne 0x436c71
push 2
pop eax
cmp esi, eax
jne 0x436c71
mov esi, ebx
jmp 0x436c9f
xor ebx, ebx
test edi, edi
je 0x436be4
mov ecx, edi
push 2
pop esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x436c35
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push esi
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x436be4
cmp dword [ebp - 4], ebx
je 0x436be4
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x436c5a
push esi
push 0x409cbc
push 2
pop ebx
push ebx
call fcn.0041e83a
add esp, 0xc
push dword [ebp + 0xc]
push 0x409c88
push ebx
call fcn.0041e83a
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov eax, 0x40aa08
jne 0x436ca4
mov eax, 0x40a96c
push esi
push dword [ebp + 0xc]
push eax
push 0x409cf0
push 4
call fcn.0041e83a
add esp, 0x14
cmp dword [ebp - 0x14], 0
je 0x436cc7
push dword [ebp - 0x14]
call fcn.00440de5
pop ecx
cmp dword [ebp - 0x10], 0
je 0x436cd6
push dword [ebp - 0x10]
call fcn.00440db7
pop ecx
cmp dword [ebp - 4], 0
je 0x436ce5
push dword [ebp - 4]
call fcn.00440db7
pop ecx
test edi, edi
je 0x436cf0
push edi
call fcn.00440db7
pop ecx
test esi, esi
jle 0x436cfd
movzx esi, si
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc