Function at 0x43a670
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x490
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
test rsi, rsi
jne 0x43a7e0
xor rsi, rsi
mov rcx, rbx
mov edx, esi
lea r8, [rbp + 0x27e]
mov r9d, 0x20a
call sub.advapi32.dll_RegEnumKeyW
mov edi, eax
test edi, edi
je 0x43a6c4
cmp edi, 0x103
jne 0x43a7da
xor rdi, rdi
jmp 0x43a7da
cmp word [rbp + 0x27e], 0x2e
je 0x43a7bb
lea rcx, [rbp + 0x27e]
call fcn.00429e60
mov r13d, eax
lea rcx, [rbp + 0x27e]
lea rdx, [0x0043a94c]
call fcn.00429ea0
lea rcx, [rbp + 0x74]
lea rdx, [0x0043a974]
call fcn.00429e80
mov rcx, rbx
lea rdx, [rbp + 0x27e]
lea r8, [rbp + 0x488]
call sub.advapi32.dll_RegOpenKeyW
mov edi, eax
test edi, edi
jne 0x43a76f
mov r13d, r13d
mov word [rbp + r13*2 + 0x27e], 0
mov dword [rbp + 0x70], 0x20a
mov rcx, qword [rbp + 0x488]
lea rdx, [0x0043a9b4]
xor r8, r8
lea r9, [rbp + 0x6c]
lea rax, [rbp + 0x74]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
mov rcx, qword [rbp + 0x488]
call sub.advapi32.dll_RegCloseKey_1
test edi, edi
jne 0x43a7bb
mov ecx, 2
mov eax, dword [rbp + 0x70]
xor edx, edx
div ecx
mov eax, eax
mov word [rbp + rax*2 + 0x72], 0
lea rax, [rbp + 0x27e]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0xa
lea rax, [rbp + 0x74]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0xa
lea rcx, [0x0043a9b6]
lea rdx, [rbp + 0x40]
mov r8d, 1
call fcn.0042f420
mov rax, qword [0x0048a318]
cmp dword [rax], 0
je 0x43a7d2
mov eax, 1
jmp 0x43a93b
add esi, 1
jmp 0x43a692
nop
jmp 0x43a939
cmp word [rsi], 0x2e
jne 0x43a812
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x0043a9d4]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00471010
mov eax, 0x7b
jmp 0x43a93b
mov rcx, rsi
xor rdx, rdx
call fcn.00471a00
mov rsi, rax
mov rcx, rsi
mov dx, 0x20
call fcn.00429df0
test rax, rax
je 0x43a836
mov word [rax], 0
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [rbp + 0x27e]
lea rdx, [0x0043aa58]
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00429f90
mov rcx, rbx
lea rdx, [rbp + 0x27e]
lea r8, [rbp + 0x488]
call sub.advapi32.dll_RegOpenKeyW
mov edi, eax
test edi, edi
je 0x43a89c
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x0043a9d4]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00471010
mov eax, edi
jmp 0x43a93b
mov dword [rbp + 0x70], 0x20a
mov rcx, qword [rbp + 0x488]
lea rdx, [0x0043a9b4]
xor r8, r8
lea r9, [rbp + 0x6c]
lea rax, [rbp + 0x74]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, eax
test edi, edi
jne 0x43a918
mov ecx, 2
mov eax, dword [rbp + 0x70]
xor edx, edx
div ecx
mov eax, eax
mov word [rbp + rax*2 + 0x72], 0
mov qword [rbp + 0x40], rsi
mov byte [rbp + 0x48], 0xa
lea rax, [rbp + 0x74]
mov qword [rbp + 0x50], rax
mov byte [rbp + 0x58], 0xa
lea rcx, [0x0043a9b6]
lea rdx, [rbp + 0x40]
mov r8d, 1
call fcn.0042f420
jmp 0x43a939
mov qword [rbp + 0x30], rsi
mov byte [rbp + 0x38], 0xa
lea rcx, [0x0043a9d4]
mov edx, 1
lea r8, [rbp + 0x30]
xor r9, r9
call fcn.00471010
mov eax, edi
lea rsp, [rbp + 0x490]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret