Function at 0x438770
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x134
mov eax, dword [0x78e580]
xor eax, esp
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x14c]
push ebx
mov edx, dword [esp + 0x144]
push ebp
mov ebp, dword [esp + 0x150]
mov ebx, dword [esp + 0x144]
mov dword [esp + 0x10], eax
push esi
mov eax, dword [ebp]
mov esi, dword [esp + 0x150]
push edi
mov edi, dword [esp + 0x160]
mov eax, dword [eax + 4]
and eax, 0xffffff00
mov dword [esp + 0x14], edi
shl eax, 0xa
test eax, eax
mov dword [esp + 0x24], ebx
lea eax, [ecx + 1]
mov dword [esp + 0x38], edx
cmovle eax, ecx
mov dword [esp + 0x30], esi
xor edi, edi
mov dword [esp + 0x20], eax
push edi
push esi
push edx
push 0x501a18
call fcn.0044956b
mov esi, eax
push ebp
mov dword [esp + 0x48], esi
call fcn.004655bb
push eax
push ebp
push esi
push str.registry_cache_update:__s._Node__x_has__i_children_n
call fcn.0040138c
push edi
push 0x4386af
push 3
push ebp
call fcn.004653a2
add esp, 0x34
mov dword [esp + 0x10], 0x81
lea eax, [esp + 0x10]
push edi
push edi
push edi
push edi
push eax
lea eax, [esp + 0x50]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, dword [esp + 0x14]
xor esi, esi
inc esi
mov dword [esp + 0x2c], esi
test eax, eax
jne 0x438934
xor edi, edi
lea eax, [esp + 0x28]
push eax
push 0x20019
push edi
lea eax, [esp + 0x48]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x438905
push edi
push edi
push edi
lea eax, [esp + 0x48]
push 0xffffffffffffffff
push eax
call fcn.0044b6eb
mov edi, eax
add esp, 0x14
test edi, edi
je 0x438903
push edi
push ebp
call fcn.0043852e
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x4388ab
push dword [esp + 0x20]
push eax
push eax
push edi
push ebp
call fcn.004383b2
add esp, 0x14
mov ebx, eax
push 0
push edi
push dword [esp + 0x38]
push 0x501a18
call fcn.0044956b
push dword [esp + 0x24]
mov esi, eax
push dword [esp + 0x34]
push ebx
push esi
push dword [esp + 0x58]
push dword [esp + 0x4c]
push dword [esp + 0x40]
call fcn.00438770
push esi
call fcn.00441dce
mov eax, dword [ebx]
push edi
or dword [eax + 4], 0x80000000
call fcn.00441dce
add esp, 0x34
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x2c]
xor edi, edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x81
push eax
lea eax, [esp + 0x50]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
mov dword [esp + 0x2c], esi
test eax, eax
je 0x438853
mov edi, dword [esp + 0x14]
cmp eax, 0x103
je 0x438948
push str.gregistrybackend:_error_enumerating_subkeys_for_cache.
push eax
call fcn.004377ee
pop ecx
pop ecx
xor esi, esi
mov dword [esp + 0x10], 0x81
push esi
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x50]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
inc ebx
jmp 0x438a80
push esi
push esi
push esi
lea eax, [esp + 0x48]
push 0xffffffffffffffff
push eax
call fcn.0044b6eb
mov esi, eax
add esp, 0x14
test esi, esi
je 0x438a55
cmp byte [esi], 0
je 0x438a55
push esi
push ebp
call fcn.0043852e
mov edi, eax
lea eax, [esp + 0x20]
push eax
push esi
push dword [esp + 0x44]
push dword [esp + 0x38]
call fcn.00438b6a
add esp, 0x18
test eax, eax
je 0x438a51
push edi
push esi
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.00438c74
pop ecx
pop ecx
push eax
push str._tgot_value__s_for__s__node__x_n
call fcn.0040138c
add esp, 0x10
test edi, edi
jne 0x4389fc
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push esi
push ebp
call fcn.004383b2
mov edi, eax
add esp, 0x14
xor eax, eax
inc eax
jmp 0x438a0d
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edi
call fcn.00438acf
add esp, 0xc
mov ecx, dword [edi]
mov edi, dword [esp + 0x14]
or dword [ecx + 4], 0x80000000
test eax, eax
je 0x438a55
test edi, edi
je 0x438a55
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x438a33
push esi
call fcn.00447c7a
pop ecx
jmp 0x438a44
push 0
push esi
push eax
push 0x501a18
call fcn.0044956b
add esp, 0x10
push eax
push dword [edi + 8]
call fcn.0044c720
pop ecx
pop ecx
jmp 0x438a55
mov edi, dword [esp + 0x14]
push esi
call fcn.00441dce
pop ecx
xor esi, esi
mov dword [esp + 0x10], 0x81
push esi
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x50]
push eax
push ebx
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc ebx
test eax, eax
je 0x438970
cmp eax, 0x103
je 0x438a9c
push str.gregistrybackend:_error_enumerating_values_for_cache
push eax
call fcn.004377ee
pop ecx
pop ecx
push edi
push 0x43870e
push 3
push ebp
call fcn.004653a2
push dword [esp + 0x44]
call fcn.00441dce
mov ecx, dword [esp + 0x154]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b5ec4
add esp, 0x134
ret