Function at 0x431690
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push 0x500e28
push reloc.ACLUI.dll_CreateSecurityPage
call ebx
mov esi, eax
test esi, esi
jne 0x43178e
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x500ec4
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43178e
push 0x4ffa00
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004d6355
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x20c]
push eax
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x4317ec
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4317ec
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push 0x500ed4
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x4317e4
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43195a
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4317f5
sub ecx, edx
mov edx, edi
sar ecx, 1
lea esi, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x431810
sub edx, esi
sar edx, 1
lea esi, [edx + 6]
add esi, ecx
mov dword [ebp - 0x218], esi
lea eax, [esi + esi]
push eax
call fcn.004c8d7a
add esp, 4
lea ecx, [ebp - 0x20c]
cmp word [ebp - 0x20c], 0x22
mov ebx, eax
mov dword [ebp - 0x224], ecx
jne 0x431861
lea ecx, [ebp - 0x20a]
mov eax, 0x22
mov dword [ebp - 0x224], ecx
jmp 0x431866
mov eax, 0x20
push eax
push ecx
call fcn.004c56b8
add esp, 8
mov dword [ebp - 0x220], eax
test eax, eax
je 0x431888
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x220], eax
cmp byte [ebp + 0xc], 0
je 0x43191c
lea eax, [ebp - 0x20c]
push 0x500f04
push eax
call fcn.004c580a
add esp, 8
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x43190a
mov esi, eax
mov eax, dword [ebp - 0x220]
sub esi, eax
sar esi, 1
lea ecx, [esi + 1]
push ecx
push eax
push dword [ebp - 0x218]
push ebx
call fcn.004c935f
mov eax, dword [ebp - 0x218]
sub eax, esi
inc esi
dec eax
push 0x500f10
push eax
lea eax, [ebx + esi*2]
push eax
call fcn.004c913a
mov esi, dword [ebp - 0x218]
push edi
push esi
push ebx
call fcn.004d6355
mov eax, dword [ebp - 0x21c]
add eax, 6
push eax
push esi
push ebx
call fcn.004d6355
add esp, 0x34
jmp 0x431930
push edi
push 0x500f18
push esi
push ebx
call fcn.00415290
add esp, 0x10
jmp 0x431930
mov ecx, ebx
sub ecx, edi
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [ecx + edi - 2], ax
test ax, ax
jne 0x431920
push 0
push ebx
push dword [ebp - 0x224]
call fcn.00431990
push ebx
call fcn.004c8d5f
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push 0x10
push 0x500f28
push 0x500f58
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c34b7
mov esp, ebp
pop ebp
ret