Function at 0x431790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e136b
mov eax, dword fs:[0]
push eax
sub esp, 0xa48
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa54], ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x800
mov dword [ebp - 0xa4c], eax
lea eax, [ebp - 0xa18]
push 0
push eax
mov dword [ebp - 0xa48], esi
mov dword [ebp - 0xa3c], 0
call fcn.004830b0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0xa40], 0x800
push 0
push eax
call fcn.004830b0
add esp, 0x18
mov dword [ebp - 0xa50], 0x208
call fcn.00473811
test al, al
je 0x431840
lodsb al, byte [esi]
xchg edi, eax
insd dword es:[edi], dx
inc esp
out 0xc0, al
iretd
call fcn.0047396a
test al, al
je 0x43185a
out dx, al
add byte [edi + 0x67], al
ret
cmp dword [esi + 0x14], 8
mov dword [ebp - 0xa44], 1
jb 0x43186c
mov esi, dword [esi]
lea eax, [ebp - 0xa3c]
push eax
push 0xf013f
push 0
push esi
push dword [ebp - 0xa4c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
call fcn.004732ad
test al, al
je 0x4318a7
dec edi
inc ebx
clc
sbb cl, byte [esi + 0x1bf82546]
sahf
mov edi, 0x59281933
xchg ebx, eax
dec ecx
stosd dword es:[edi], eax
mov dh, 0xab
call fcn.00473742
test al, al
je 0x4318cc
fucom st(1)
mov dl, 0xca
lea edi, [ecx]
mov esp, 0xa89ad079
adc eax, 0xd4399dd4
dec esi
ror dword [edx + 0xe], 0x26
and dword [edi + 0x42f6434], edx
aaa
mov byte [ebp - 0xa31], 0
test ebx, ebx
jne 0x431b88
call fcn.004732ad
test al, al
je 0x4318f9
xor al, 0x5e
popfd
mov ah, 0x54
fcom st(2)
push eax
or dword [esi + 0x26], esi
mov dword cs:[0xfe992d86], eax
mov edi, 0xe89607df
inc esp
push ds
add al, 0
call fcn.00473742
test al, al
je 0x43191e
out 0x88, eax
xor ecx, dword [esi + 0x5465a0f0]
or esi, dword [eax*8 - 0x7c1e832b]
inc ecx
lahf
invalid
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0xa44]
push eax
push 0
push 0x5e87f0
push dword [ebp - 0xa3c]
call ebx
mov ecx, str.ZhiNeng_Shell_Extension
lea eax, [ebp - 0xa18]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x431979
test dx, dx
je 0x431975
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x431979
add eax, 4
add ecx, 4
test dx, dx
jne 0x431953
xor eax, eax
jmp 0x43197e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x431b81
call fcn.0047355f
test al, al
je 0x4319aa
movsd dword es:[edi], dword [esi]
fldenv [0x32ccc409]
fdiv st(2), st(0)
movsb byte es:[edi], byte [esi]
or al, 0xe9
jb 0x43191e
fbstp tbyte [edi + 0x32]
ljmp 0x801d
push 0x800
lea eax, [ebp - 0xa18]
push 0
push eax
call fcn.004830b0
add esp, 0xc
mov dword [ebp - 0xa40], 0x800
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xa38], 0
push eax
push 0xf013f
push 0
push str.InprocServer32
push dword [ebp - 0xa3c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x431a4b
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0xa44]
push eax
push 0
push 0x5e87f0
push dword [ebp - 0xa38]
call ebx
lea eax, [ebp - 0xa50]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa44]
push eax
push 0
push str.ThreadingModel
push dword [ebp - 0xa38]
call ebx
push dword [ebp - 0xa38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
invalid
call fcn.0047337c
test al, al
je 0x431a72
loopne 0x431a17
dec eax
add edi, edx
aam 0x6d
test dword [ebp + 0x10], ecx
push edx
sub dl, byte [eax + 0x70]
push ds
lodsd eax, dword [esi]
pop esi
and bl, ch
or ch, al
fsub dword [ebp + 0x64]
or eax, 0xa3e6ccc8
add ch, al
mov dword [0x8400041a], eax
sal byte [edx + edx + 0x7a], 0x87
call fcn.0047351a
test al, al
je 0x431a8d
jp 0x431a04
xchg esp, ebx
push 0x853cd04a
push esi
imul ebx, esi, 0xd8331a5e
sub dword [edi], esi
mov ecx, dword [ebp - 0xa54]
lea eax, [ebp - 0xa30]
push eax
call fcn.00436f40
cmp dword [ebp - 0xa1c], 8
lea eax, [ebp - 0xa30]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xa18]
cmovae eax, dword [ebp - 0xa30]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x431ae6
test dx, dx
je 0x431ae2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x431ae6
add ecx, 4
add eax, 4
test dx, dx
jne 0x431ac0
xor eax, eax
jmp 0x431aeb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x431b6f
call fcn.004736fd
test al, al
je 0x431b1a
and eax, 0x6a3287bd
mov bl, 0xa3
invalid
mov ecx, str.Apartment
lea eax, [ebp - 0x218]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x431b4b
test dx, dx
je 0x431b47
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x431b4b
add eax, 4
add ecx, 4
test dx, dx
jne 0x431b25
xor eax, eax
jmp 0x431b50
sbb eax, eax
or eax, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
test eax, eax
jne 0x431b7c
call fcn.00448f80
mov byte [ebp - 0xa31], 1
jmp 0x431b88
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
call fcn.00448f80
mov byte [ebp - 0xa31], 0
call fcn.004737cc
test al, al
je 0x431ba1
mov bh, 0xeb
or al, 0xab
aad 0x82
sbb al, 0x5f
sbb dword [esi + edi + 0x7d997a43], eax
scasb al, byte es:[edi]
call fcn.004735e9
test al, al
je 0x431bc1
dec edi
mov dl, 0x53
iretd
push dword [ebp - 0xa3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0xa31]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 8