Function at 0x43ae60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x50a0ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x280
push ebx
push ebp
push esi
mov dword [esp + 0x14], ecx
xor ebp, ebp
push edi
push ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0x104
call fcn.0040d5f0
mov eax, dword [esp + 0x2a0]
mov dword [esp + 0x298], ebp
cmp eax, ebp
je 0x43aebb
lea ecx, [esp + 0x28]
call fcn.004dd5ee
cmp eax, 1
jne 0x43b00e
lea eax, [esp + 0x14]
mov ebp, 1
push eax
call fcn.004ab8b0
push eax
mov byte [esp + 0x2a0], 1
call fcn.004aca00
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x298], 0
call fcn.004e1e27
lea ecx, [esp + 0x20]
push 0xf0c1
push ecx
call fcn.004b0bf0
mov esi, eax
lea edx, [esp + 0x2c]
push 0xf0be
push edx
mov byte [esp + 0x2a8], 2
call fcn.004b0bf0
mov edi, eax
lea eax, [esp + 0x24]
mov bl, 3
push eax
mov byte [esp + 0x2ac], bl
call fcn.004ab8b0
push ebp
push esi
push edi
push eax
mov byte [esp + 0x2bc], 4
call fcn.004ac440
add esp, 0x24
lea ecx, [esp + 0x14]
mov byte [esp + 0x298], bl
call fcn.004e1e27
lea ecx, [esp + 0x24]
mov byte [esp + 0x298], 2
call fcn.004e1e27
lea ecx, [esp + 0x20]
mov byte [esp + 0x298], 0
call fcn.004e1e27
call fcn.004aceb0
mov eax, dword [esp + 0x2a0]
test eax, eax
je 0x43b062
push 0x560154
lea ecx, [esp + 0x18]
call fcn.004e1e9b
push 0xffffffffffffffff
mov bl, 5
push 0x23
push 0xefdd
mov byte [esp + 0x2a4], bl
call fcn.0041b900
add esp, 0xc
cmp eax, 6
jne 0x43afce
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004ac420
add esp, 4
mov byte [esp + 0x298], 0
lea ecx, [esp + 0x14]
jmp 0x43b05d
cmp eax, 7
jne 0x43b000
lea edx, [esp + 0x20]
push edx
call fcn.004226f0
mov eax, dword [eax]
mov byte [esp + 0x29c], 6
push eax
call fcn.004ac420
add esp, 8
lea ecx, [esp + 0x20]
mov byte [esp + 0x298], bl
call fcn.004e1e27
mov byte [esp + 0x298], 0
lea ecx, [esp + 0x14]
jmp 0x43b05d
cmp eax, 2
jne 0x43b023
mov dword [esp + 0x298], 7
jmp 0x43b415
lea eax, [esp + 0x14]
push eax
call fcn.004226f0
mov ecx, dword [esp + 0x18]
mov byte [esp + 0x29c], 8
push ecx
call fcn.004ac420
lea edx, [esp + 0x1c]
push edx
call fcn.004aca00
add esp, 0xc
call fcn.004ad050
mov byte [esp + 0x298], 0
lea ecx, [esp + 0x14]
call fcn.004e1e27
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0x10]
push eax
push 0x560128
push SysFreeString
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x43b0a9
mov ecx, dword [esp + 0x10]
push 0x12
push 0x560114
push 1
push 0
push 0x5705d0
push ecx
call esi
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
jmp 0x43b0af
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0x5600e4
push SysFreeString
call ebx
test eax, eax
jne 0x43b0e1
mov ecx, dword [esp + 0x10]
push 0x12
push 0x560114
push 1
push eax
push 0x5705d0
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov ecx, dword [esp + 0x18]
push ebp
push 0x5600c4
call fcn.0043b550
lea eax, [esp + 0x10]
push eax
push 0x560098
push SysFreeString
call ebx
test eax, eax
jne 0x43b15e
test ebp, ebp
je 0x43b121
mov ecx, dword [esp + 0x10]
push 0x12
push 0x560114
push 1
push eax
push 0x5705d0
push ecx
call esi
jmp 0x43b157
push 0x55c7c0
lea ecx, [esp + 0x24]
call fcn.004e1e9b
mov edx, dword [eax]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
lea eax, [eax + eax + 2]
push eax
push 0x55c7c0
push 1
push 0
push 0x5705d0
push ecx
call esi
lea ecx, [esp + 0x20]
call fcn.004e1e27
mov edx, dword [esp + 0x10]
push edx
call edi
mov ecx, dword [esp + 0x18]
push ebp
push 0x560068
call fcn.0043b550
lea eax, [esp + 0x10]
push eax
push 0x56003c
push SysFreeString
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x43b1e8
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x88]
push ecx
push edx
push 0
push 0
push 0x5705d0
push eax
mov dword [esp + 0x34], 0x208
call edi
lea ecx, [esp + 0x88]
push 0x560028
push ecx
call ebx
test eax, eax
je 0x43b1dd
mov edx, dword [esp + 0x10]
push 0x14
push 0x560028
push 1
push 0
push 0x5705d0
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0x55fff8
push SysFreeString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x43b263
mov ecx, dword [esp + 0x10]
mov word [esp + 0x88], ax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x88]
push edx
push eax
push 0
push 0
push 0x5705d0
push ecx
mov dword [esp + 0x34], 0x208
call edi
lea edx, [esp + 0x88]
push 0x560028
push edx
call ebx
test eax, eax
je 0x43b258
mov eax, dword [esp + 0x10]
push 0x14
push 0x560028
push 1
push 0
push 0x5705d0
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
push ebp
push 0x55ffd8
call fcn.0043b550
mov ecx, dword [esp + 0x18]
push ebp
push 0x55ffc0
call fcn.0043b550
mov ecx, dword [esp + 0x18]
push ebp
push 0x55ffa4
call fcn.0043b550
mov ecx, dword [esp + 0x18]
push ebp
push 0x55ff84
call fcn.0043b550
mov ecx, dword [esp + 0x18]
push ebp
push 0x55ff6c
call fcn.0043b550
mov ecx, dword [esp + 0x18]
push ebp
push 0x55ff54
call fcn.0043b550
mov ecx, dword [esp + 0x18]
push ebp
push 0x55ff40
call fcn.0043b550
test ebp, ebp
je 0x43b3ee
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea edx, [esp + 0x10]
push edx
push 0x55ff10
push SysFreeString
call ebp
test eax, eax
jne 0x43b360
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x88]
push eax
push ecx
push 0
push 0
push 0x5705d0
push edx
mov dword [esp + 0x34], 0x208
call edi
lea eax, [esp + 0x88]
push 0x560114
push eax
call ebx
test eax, eax
je 0x43b33e
mov ecx, dword [esp + 0x10]
push 0x12
push 0x560114
push 1
push 0
push 0x5705d0
push ecx
call esi
mov edx, dword [esp + 0x10]
push 0x14
push 0x55fefc
push 1
push 0
push 0x55fee0
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0x55feb0
push SysFreeString
call ebp
test eax, eax
jne 0x43b3ee
mov ecx, dword [esp + 0x10]
mov word [esp + 0x88], ax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x88]
push edx
push eax
push 0
push 0
push 0x5705d0
push ecx
mov dword [esp + 0x34], 0x208
call edi
lea edx, [esp + 0x88]
push 0x560114
push edx
call ebx
test eax, eax
je 0x43b3cc
mov eax, dword [esp + 0x10]
push 0x12
push 0x560114
push 1
push 0
push 0x5705d0
push eax
call esi
mov ecx, dword [esp + 0x10]
push 0x14
push 0x55fefc
push 1
push 0
push 0x55fee0
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2a0]
test eax, eax
je 0x43b40a
push 0xffffffffffffffff
push 0
push 0xefd1
call fcn.0041b900
add esp, 0xc
mov dword [esp + 0x298], 9
lea ecx, [esp + 0x84]
call fcn.004e1e27
lea ecx, [esp + 0x28]
mov dword [esp + 0x298], 0xffffffff
call fcn.004dd134
mov ecx, dword [esp + 0x290]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28c
ret 4