Function at 0x43f9e0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b1918
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov ebp, dword [sym.imp.user32.dll_GetDlgItem]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43faaa
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b2e14
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fa86
cmp word [esp + 0x20], 1
jne 0x43faa4
push eax
push 1
push 0xf1
push 0x28ef
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43faa4
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 4
push 0
push 0x4b2e14
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b1d18
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fb44
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b2e2c
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fb20
cmp word [esp + 0x20], 1
jne 0x43fb3e
push eax
push 1
push 0xf1
push 0x28f0
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43fb3e
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b2e2c
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b1918
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fbde
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b2e40
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fbba
cmp word [esp + 0x20], 1
jne 0x43fbd8
push eax
push 1
push 0xf1
push 0x28f1
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43fbd8
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b2e40
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b1d18
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fc78
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b2e68
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fc54
cmp word [esp + 0x20], 1
jne 0x43fc72
push eax
push 1
push 0xf1
push 0x28f2
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43fc72
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b2e68
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b1d18
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fd12
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b2e94
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fcee
cmp word [esp + 0x20], 1
jne 0x43fd0c
push eax
push 1
push 0xf1
push 0x28f3
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43fd0c
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b2e94
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
push 0x28f4
push 0x4b2ec4
mov edx, 0x4b2ed8
mov ecx, 0x80000002
call fcn.0043d980
push 0x28f5
push 0x4b2f4c
mov edx, 0x4b2f70
mov ecx, 0x80000002
call fcn.0043d980
push 0x28f6
push 0x4b2fbc
mov edx, 0x4b2648
mov ecx, 0x80000002
call fcn.0043d980
push 0x28f7
push 0x4b2fec
mov edx, 0x4b15f0
mov ecx, 0x80000001
call fcn.0043d980
mov ecx, dword [esp + 0x840]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x814
ret