Function at 0x432324
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x43232d
mov eax, dword [ebp - 4]
add esp, 0xfffffbf0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x8414], ecx
mov dword [ebp - 0x840c], ecx
mov dword [ebp - 0x8410], ecx
mov dword [ebp - 0x8404], ecx
mov dword [ebp - 0x8408], ecx
mov dword [ebp - 0x8400], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x432596
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404710
lea eax, [ebp - 0x205]
mov edx, 0x4325ac
call fcn.00409b58
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x205]
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
jne 0x432578
push ebp
push 0x432571
push dword fs:[0]
mov dword fs:[0], esp
xor esi, esi
lea eax, [ebp - 0x3fa]
xor ecx, ecx
mov edx, 0x1f5
call fcn.0040310c
mov dword [ebp - 0xc], 0x7fff
lea eax, [ebp - 0x83fa]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.0040310c
mov dword [ebp - 8], 0x1f5
xor eax, eax
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x83fa]
push edx
push edi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x3fa]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
inc esi
test ebx, ebx
jne 0x432447
lea edx, [ebp - 0x8400]
lea eax, [ebp - 0x3fa]
call fcn.00409cd4
mov eax, dword [ebp - 0x8400]
mov edx, 0x4325e8
call fcn.00404b2c
jne 0x4323c9
test ebx, ebx
jne 0x43255a
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x8408]
call fcn.00408f60
mov ecx, dword [ebp - 0x8408]
lea eax, [ebp - 0x8404]
mov edx, 0x43260c
call fcn.00404a2c
mov eax, dword [ebp - 0x8404]
call fcn.00404be0
push eax
call fcn.004208cc
lea eax, [ebp - 0x83fa]
push eax
call fcn.004208cc
mov edx, dword [ebp - 0xc]
dec edx
test edx, edx
jle 0x4324d6
lea eax, [ebp - 0x83fa]
cmp byte [eax], 0
jne 0x4324b6
cmp byte [eax + 1], 0
jne 0x4324b6
mov byte [eax], 0x3d
mov byte [eax + 1], 9
jmp 0x4324d2
mov cl, byte [eax]
test cl, cl
jne 0x4324cb
cmp byte [eax + 1], 0x21
jne 0x4324cb
mov byte [eax], 0x3d
mov byte [eax + 1], 0x21
jmp 0x4324d2
test cl, cl
jne 0x4324d2
mov byte [eax], 9
inc eax
dec edx
jne 0x4324a2
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x83fa], 0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x83fa]
call fcn.00409cd4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004049e0
lea edx, [ebp - 0x8410]
call fcn.00408e74
mov ecx, dword [ebp - 0x8410]
lea eax, [ebp - 0x840c]
mov edx, 0x432624
call fcn.00404a2c
mov eax, dword [ebp - 0x840c]
call fcn.00404be0
push eax
call fcn.004208cc
mov al, byte [0x432634]
push eax
lea eax, [ebp - 0x8414]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, 0x432640
mov edx, 0x43264c
call fcn.0040e298
mov edx, dword [ebp - 0x8414]
mov eax, dword [ebp - 4]
call fcn.00404764
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x432578
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43259d
lea eax, [ebp - 0x8414]
mov edx, 6
call fcn.00404734
ret