Function at 0x43a0f4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x320
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x004bf230]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0xf0], rdx
mov qword [rsp + 0xe8], rbx
xor r14d, r14d
mov qword [rsp + 0x30], r14
cmp qword [rdx + 0x20], 8
jb 0x43a153
lea r12, [rdx + 8]
mov rdx, qword [r12]
jmp 0x43a15a
lea r12, [rdx + 8]
mov rdx, r12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
je 0x43a1c5
cmp qword [rsi + 0x20], 8
jb 0x43a18f
mov rcx, qword [r12]
call fcn.00443d3c
mov ebp, 7
mov qword [rsi + 0x20], rbp
mov qword [rsi + 0x18], r14
mov word [r12], r14w
cmp qword [rbx + 0x20], 8
jb 0x43a1b1
mov rcx, qword [rbx + 8]
call fcn.00443d3c
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x18], r14
mov word [rbx + 8], r14w
xor al, al
jmp 0x43a54a
mov word [rsp + 0x100], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x102]
call fcn.00449860
mov dword [rsp + 0x3c], 0x103
mov dword [rsp + 0x38], r14d
cmp qword [rbx + 0x20], 8
jb 0x43a201
lea r13, [rbx + 8]
mov rdx, qword [r13]
jmp 0x43a208
lea r13, [rbx + 8]
mov rdx, r13
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
je 0x43a289
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rsi + 0x20], 8
jb 0x43a253
mov rcx, qword [r12]
call fcn.00443d3c
mov ebp, 7
mov qword [rsi + 0x20], rbp
mov qword [rsi + 0x18], r14
mov word [r12], r14w
cmp qword [rbx + 0x20], 8
jb 0x43a275
mov rcx, qword [r13]
call fcn.00443d3c
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x18], r14
mov word [r13], r14w
xor al, al
jmp 0x43a54a
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, 7
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x90], r14
mov word [rsp + 0x80], r14w
mov dword [rsp + 0xa0], r14d
mov dword [rsp + 0xa4], r14d
mov dword [rsp + 0xa8], r14d
mov dword [rsp + 0xac], r14d
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0xc8], r14
mov word [rsp + 0xb8], r14w
mov dword [rsp + 0xd8], r14d
mov dword [rsp + 0xdc], r14d
mov dword [rsp + 0xe0], r14d
mov dword [rsp + 0xe4], r14d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], r14
mov word [rsp + 0x48], r14w
lea rdx, [rdi + 8]
or rdi, 0xffffffffffffffff
mov r9, rdi
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.004020b0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.00439aa0
xor eax, eax
mov rcx, rdi
lea rdi, [rsp + 0x100]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xb0]
call fcn.00404e54
lea rcx, [rsp + 0xb0]
call fcn.00439b24
mov r10d, dword [rsp + 0xe4]
mov eax, dword [rsp + 0xa8]
mov ecx, dword [rsp + 0xe0]
mov edx, dword [rsp + 0xa4]
mov edi, dword [rsp + 0xdc]
mov r8d, dword [rsp + 0xa0]
mov r9d, dword [rsp + 0xd8]
cmp r8d, r9d
jne 0x43a3d5
cmp edx, edi
jne 0x43a3d5
cmp eax, ecx
jne 0x43a3d5
cmp dword [rsp + 0xac], r10d
je 0x43a4ac
cmp r8d, r9d
jb 0x43a4ac
cmp r8d, r9d
jne 0x43a409
cmp edx, edi
jb 0x43a4ac
cmp edx, edi
jne 0x43a409
cmp eax, ecx
jb 0x43a4ac
cmp eax, ecx
jne 0x43a409
cmp dword [rsp + 0xac], r10d
jb 0x43a4ac
cmp qword [rsp + 0xd0], 8
jb 0x43a421
mov rcx, qword [rsp + 0xb8]
call fcn.00443d3c
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0xc8], r14
mov word [rsp + 0xb8], r14w
cmp qword [rsp + 0x98], 8
jb 0x43a452
mov rcx, qword [rsp + 0x80]
call fcn.00443d3c
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x90], r14
mov word [rsp + 0x80], r14w
cmp qword [rsi + 0x20], 8
jb 0x43a47b
mov rcx, qword [r12]
call fcn.00443d3c
mov qword [rsi + 0x20], rbp
mov qword [rsi + 0x18], r14
mov word [r12], r14w
cmp qword [rbx + 0x20], 8
jb 0x43a498
mov rcx, qword [r13]
call fcn.00443d3c
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x18], r14
mov word [r13], r14w
xor al, al
jmp 0x43a54a
cmp qword [rsp + 0xd0], 8
jb 0x43a4c4
mov rcx, qword [rsp + 0xb8]
call fcn.00443d3c
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0xc8], r14
mov word [rsp + 0xb8], r14w
cmp qword [rsp + 0x98], 8
jb 0x43a4f5
mov rcx, qword [rsp + 0x80]
call fcn.00443d3c
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x90], r14
mov word [rsp + 0x80], r14w
cmp qword [rsi + 0x20], 8
jb 0x43a51e
mov rcx, qword [r12]
call fcn.00443d3c
mov qword [rsi + 0x20], rbp
mov qword [rsi + 0x18], r14
mov word [r12], r14w
cmp qword [rbx + 0x20], 8
jb 0x43a53b
mov rcx, qword [r13]
call fcn.00443d3c
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x18], r14
mov word [r13], r14w
mov al, 1
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.00443d60
add rsp, 0x320
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret