Function at 0x43f840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x647468
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x758898]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x148]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43f880
sub eax, esi
je 0x43fa0a
push 0x5c
push edx
call fcn.006229e0
add esp, 8
mov esi, eax
test esi, esi
je 0x43f8a3
inc esi
jmp 0x43f8a9
mov esi, dword [edi + 0x148]
push 0xb
push str.firefox.exe
push esi
call fcn.0062797f
add esp, 0xc
test eax, eax
jne 0x43fa94
test dword [edi + 0x17c], 0x100000
jne 0x43fa0a
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x11], bl
mov eax, dword [edi + 0x1bc]
push str.Firefox_
push eax
call fcn.006218e0
add esp, 8
test eax, eax
je 0x43f927
add eax, 8
lea ecx, [ebp - 0x18]
push ecx
push 0x67942c
push eax
call fcn.00621c2e
add esp, 0xc
cmp eax, 1
jne 0x43f927
cmp dword [ebp - 0x18], 7
jle 0x43f916
mov ebx, eax
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
cmp edi, 1
jle 0x43f92a
mov byte [ebp - 0x11], 1
jmp 0x43fa2a
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
push ecx
push str._ld__ld__ld
mov edx, dword [0x75dd94]
push edx
call fcn.00621c2e
add esp, 0x14
cmp eax, 3
jne 0x43f9a3
lea eax, [ebp - 0x34]
push eax
call fcn.0043c2a0
lea ecx, [ebp - 0x34]
call fcn.0043ba60
mov esi, eax
mov ecx, 0xfffff830
sub ecx, dword [ebp - 0x18]
add esi, ecx
imul esi, esi, 0x16d
lea ecx, [ebp - 0x34]
call fcn.0043ba90
sub eax, dword [ebp - 0x20]
mov edx, eax
shl edx, 4
sub edx, eax
add edx, edx
sub edx, dword [ebp - 0x24]
add esi, edx
lea ecx, [ebp - 0x34]
call fcn.0043bac0
add eax, esi
cmp eax, 0x2d
jbe 0x43f9a3
mov byte [ebp - 0x11], 1
jmp 0x43fa2a
lea ecx, [ebp - 0x18]
call fcn.00402510
mov byte [ebp - 4], 1
test ebx, ebx
mov eax, str.bShFF8Tip
jne 0x43f9bd
mov eax, str.bShFFTip
push edi
push eax
push 0x68164c
lea eax, [ebp - 0x18]
push eax
call fcn.00402f80
add esp, 0x10
mov dword [ebp - 0x24], 4
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43fa1e
cmp dword [ebp - 0x20], 1
jne 0x43fa1e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402580
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402580
test ebx, ebx
je 0x43fa61
cmp byte [ebp - 0x11], 0
je 0x43fa37
or edi, 8
push 0
push 0
push 0
push 0
push edi
push 0x43f730
call fcn.005ffc0d
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x11], 0
je 0x43fa6a
or edi, 8
push 0
push 0
push 0
push 0
push edi
push 0x43f700
call fcn.005ffc0d
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
push str.chrome.exe
push esi
call fcn.00624cad
add esp, 0xc
test eax, eax
jne 0x43fb53
test dword [edi + 0x17c], 0x100000
jne 0x43fa0a
mov esi, dword [ebp + 0xc]
cmp esi, 1
setg al
test al, al
jne 0x43fb26
lea ecx, [ebp - 0x18]
call fcn.00402510
mov byte [ebp - 4], 2
push esi
push str.bShChrIntTip2__ld
lea edx, [ebp - 0x18]
push edx
call fcn.00402f80
add esp, 0xc
mov dword [ebp - 0x20], 4
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [0x75dbe4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43fb18
cmp dword [ebp - 0x24], 1
je 0x43f9fe
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402580
jmp 0x43fb29
or esi, 8
push 0
push 0
push 0
push 0
push esi
push 0x43f780
call fcn.005ffc0d
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 9
push str.opera.exe
push esi
call fcn.00624cad
add esp, 0xc
test eax, eax
jne 0x43fc13
test dword [edi + 0x17c], 0x100000
jne 0x43fa0a
mov esi, dword [ebp + 0xc]
cmp esi, 1
setg al
test al, al
jne 0x43fbe6
lea ecx, [ebp - 0x18]
call fcn.00402510
mov byte [ebp - 4], 3
push esi
push str.bShOperaIntTip__ld
lea ecx, [ebp - 0x18]
push ecx
call fcn.00402f80
add esp, 0xc
mov dword [ebp - 0x28], 4
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x24]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [0x75dbe4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43fbd8
cmp dword [ebp - 0x24], 1
je 0x43f9fe
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402580
jmp 0x43fbe9
or esi, 8
push 0
push 0
push 0
push 0
push esi
push 0x43f7b0
call fcn.005ffc0d
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x13
push str.MicrosoftEdgeCP.exe
push esi
call fcn.00624cad
add esp, 0xc
test eax, eax
jne 0x43fcd3
test dword [edi + 0x17c], 0x100000
jne 0x43fa0a
mov esi, dword [ebp + 0xc]
cmp esi, 1
setg al
test al, al
jne 0x43fca6
lea ecx, [ebp - 0x18]
call fcn.00402510
mov ebx, 4
mov byte [ebp - 4], bl
push esi
push str.bShEdgeIntTip__ld
lea eax, [ebp - 0x18]
push eax
call fcn.00402f80
add esp, 0xc
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x28]
push edx
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43fc98
cmp dword [ebp - 0x28], 1
je 0x43f9fe
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402580
jmp 0x43fca9
or esi, 8
push 0
push 0
push 0
push 0
push esi
push 0x43f7e0
call fcn.005ffc0d
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x13
push str.msedge.exe
push esi
call fcn.00624cad
add esp, 0xc
test eax, eax
jne 0x43fd92
test dword [edi + 0x17c], 0x100000
jne 0x43fa0a
mov esi, dword [ebp + 0xc]
cmp esi, 1
setg al
test al, al
jne 0x43fd65
lea ecx, [ebp - 0x18]
call fcn.00402510
mov byte [ebp - 4], 5
push esi
push str.bShEdgeChIntTip__ld
lea edx, [ebp - 0x18]
push edx
call fcn.00402f80
add esp, 0xc
mov dword [ebp - 0x30], 4
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [0x75dbe4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43fd57
cmp dword [ebp - 0x2c], 1
je 0x43f9fe
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00402580
jmp 0x43fd68
or esi, 8
push 0
push 0
push 0
push 0
push esi
push 0x43f810
call fcn.005ffc0d
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret