Function at 0x437e84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword fs:[0]
push 0xffffffffffffffff
push 0x438153
push edx
mov dword fs:[0], esp
sub esp, 8
sub esp, 0x13c
mov dword [ebp - 0x148], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14c], esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x124]
mov dword [edi], 0
mov dword [edi + 4], 0
push dword [ebp + 0x10]
mov dword [ebp - 0x12c], 0xffffffff
push dword [ebp + 0xc]
call fcn.004173fc
mov dword [ebp - 4], 0
push 0x100
mov ecx, 0x46dc30
push ecx
call fcn.00437640
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
add eax, eax
mov dword [ebp - 0x140], edx
call fcn.004284c4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x124]
call fcn.00417340
lea edx, [ebp - 0x12c]
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x12c]
push ecx
push 0
push eax
push esi
call sub.ADVAPI32.DLL_RegQueryValueExW
mov ebx, eax
add esp, 8
cmp ebx, 0xea
jne 0x437fa0
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x1c]
shr edx, 1
push edx
mov ecx, 0x46dc30
push ecx
call fcn.00410cd0
lea eax, [ebp - 0x124]
call fcn.00417340
lea edx, [ebp - 0x12c]
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x12c]
push ecx
push 0
push eax
push esi
call sub.ADVAPI32.DLL_RegQueryValueExW
mov ebx, eax
add esp, 0xc
jmp 0x437fbf
test ebx, ebx
jne 0x437fbf
lea edx, [ebp - 0x144]
push edx
mov ecx, dword [ebp - 0x1c]
shr ecx, 1
push ecx
mov edx, 0x46dc30
push edx
call fcn.00410cd0
add esp, 0xc
push ebx
mov edx, 0x438160
xor eax, eax
push edx
mov ecx, 0x428748
push eax
mov eax, 0x261
push ecx
push 0x16
call fcn.0043719c
cmp dword [ebp - 0x12c], 7
sete dl
mov ecx, 0x43816c
push edx
xor eax, eax
push ecx
push eax
call fcn.004044f4
mov edx, dword [ebp - 0x12c]
cmp edx, dword [ebp - 0x18]
sete cl
mov edx, 0x4381a4
push ecx
xor eax, eax
push edx
push eax
call fcn.004044f4
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x144]
dec edx
push edx
mov edx, 0x46dc30
push edx
call fcn.00410cd0
add esp, 0xc
cmp dword [ebp - 0x144], 0
je 0x438073
mov ecx, dword [ebp - 0x144]
mov edx, dword [ebp - 0x140]
lea edx, [edx + ecx*2]
cmp word [edx - 2], 0
mov esi, dword [ebp - 0x144]
jne 0x438073
lea eax, [ebp - 0x144]
mov esi, 0x46dc30
push eax
mov ebx, dword [ebp - 0x144]
lea ecx, [ebx - 1]
push ecx
push esi
call fcn.00410cd0
add esp, 0xc
push dword [ebp - 0x140]
mov edx, 0x40a7f4
mov eax, 1
push dword [ebp - 0x144]
push edx
push eax
call fcn.004495d4
mov ecx, 0x466660
push edi
mov dword [ebp - 0x13c], eax
push dword [ebp - 0x13c]
mov dword [ebp - 0x138], edx
push ecx
call fcn.00412b28
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [ebp - 0x134], eax
xor ebx, ebx
mov dword [ebp - 0x130], edx
add esp, 0xc
cmp dword [ebp - 0x134], ebx
je 0x4380f7
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x138]
lea esi, [ecx + ebx*8]
push dword [edx + ebx*8 + 4]
mov edi, ebx
push dword [edx + ebx*8]
call fcn.00437604
inc ebx
mov dword [esi], eax
mov dword [esi + 4], edx
cmp ebx, dword [ebp - 0x134]
jb 0x4380cc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc]
push 0xffffffffffffffff
push ecx
push 0x4710f0
call fcn.004156d8
add esp, 0xc
call fcn.0043811b
jmp 0x43812e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ebx, dword [ebp - 0x150]
mov esi, dword [ebp - 0x14c]
mov edi, dword [ebp - 0x148]
mov esp, ebp
pop ebp
ret 0x10