Function at 0x434c97
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
push 0xb8
mov eax, 0x4ac857
call fcn.004a7770
mov edi, ecx
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xc0], edi
and dword [ebp - 0xbc], 0
call fcn.0040d765
xor esi, esi
lea ecx, [ebp - 0xb4]
inc esi
mov dword [ebp - 0xbc], esi
call fcn.0040d765
mov dword [ebp - 4], esi
and dword [ebp - 0xac], 0
mov byte [ebp - 4], 2
mov esi, 0xf84651f2
mov dword [ebp - 0xa8], 0xb2fd92d0
mov edx, 0xebc27c29
mov dword [ebp - 0xa4], 0x5df9c1f0
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xa8], 0xf5187ac3
mov dword [ebp - 0xa4], 0x1873c641
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0xa8], 0xfe6cb1d9
mov dword [ebp - 0xa4], 0x4f972069
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0xa8], 0xee05fff9
mov dword [ebp - 0xa4], 0xbc440432
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0xa8], 0x9b3b0273
mov dword [ebp - 0xa4], 0x279161b3
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0xa8], 0x9fd936c
mov dword [ebp - 0xa4], 0xce39f699
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0xa8], 0x94201d0b
mov dword [ebp - 0xa4], 0x4edb134f
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], edx
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0xa8], 0xb29292a3
mov dword [ebp - 0xa4], 0x5d8dc196
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], 0xf5797ab4
mov dword [ebp - 0xa4], 0x1816c633
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], 0xfe07b185
mov dword [ebp - 0xa4], 0x4ff92000
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xa8], 0xee76ff9e
mov dword [ebp - 0xa4], 0xbc22045d
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], 0x9b670207
mov dword [ebp - 0xa4], 0x27ff61d2
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], 0x9949318
mov dword [ebp - 0xa4], 0xce50f6ef
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], 0x94551d79
mov dword [ebp - 0xa4], 0x4edb133c
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0xa4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xa4], edx
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa4]
movaps xmm1, xmmword [ebp - 0xa0]
pxor xmm1, xmmword [ebp - 0x60]
movaps xmmword [ebp - 0xa0], xmm1
movaps xmm1, xmmword [ebp - 0x90]
pxor xmm1, xmmword [ebp - 0x50]
movaps xmmword [ebp - 0x90], xmm1
movaps xmm1, xmmword [ebp - 0x80]
pxor xmm1, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x80], xmm1
movaps xmm1, xmmword [ebp - 0x70]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0xb0]
pxor xmm1, xmmword [ebp - 0x30]
push eax
movaps xmmword [ebp - 0x70], xmm1
call fcn.0040d6dc
push ecx
push dword [eax]
push ecx
lea ecx, [ebp - 0xac]
call fcn.00434320
mov ecx, dword [ebp - 0xb0]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.0040bb70
test esi, esi
je 0x4350a3
xor esi, esi
and dword [ebp - 0xb0], esi
cmp dword [ebp - 0xac], esi
je 0x4350b8
lea eax, [ebp - 0xb0]
push eax
push esi
lea eax, [ebp - 0xb8]
push eax
push esi
push str.ProgramPath
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0xb8], 1
je 0x43501a
cmp dword [ebp - 0xb8], 2
jne 0x4350a3
lea ecx, [ebp - 0xb4]
call fcn.0040d870
mov eax, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb4]
shr eax, 1
inc eax
push eax
call fcn.0040e373
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xa4], eax
push ecx
push eax
lea eax, [ebp - 0xb8]
push eax
push 0
push str.ProgramPath
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43507d
mov eax, dword [ebp - 0xb0]
xor edx, edx
mov ecx, dword [ebp - 0xa4]
xor esi, esi
shr eax, 1
inc esi
mov word [ecx + eax*2], dx
push 0xffffffffffffffff
lea ecx, [ebp - 0xb4]
call fcn.00412b02
test esi, esi
je 0x4350a3
lea eax, [ebp - 0xb4]
mov ecx, edi
push eax
call fcn.0040e019
mov ecx, edi
call fcn.00434ad2
cmp dword [ebp - 0xac], 0
je 0x4350b8
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xb4]
and dword [ebp - 0xac], 0
add ecx, 0xfffffff0
call fcn.0040bb70
mov eax, edi
mov ecx, dword [ebp - 0x14]
call fcn.004a774e
ret