Function at 0x43e0b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
call section..text
add eax, 0x51615
mov dword [0x401450], eax
mov eax, dword [0x401450]
push eax
call fcn.0043e460
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0043e480
add esp, 4
mov dword [0x40145c], eax
mov dword [0x401460], 0
mov dword [0x401464], 1
push 0x401468
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x401468
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x401468
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x401468
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x401468
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x401468
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x401468
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x401468
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 0x1019
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x43e16a
call entry0
mov edx, dword [str.softwareclassesjjjerface00000613_0000_0010_8000_00aa006d2ea4proxystubclsid]
mov byte [edx + 0x11], 0x49
mov eax, dword [str.softwareclassesjjjerface00000613_0000_0010_8000_00aa006d2ea4proxystubclsid]
mov byte [eax + 0x12], 0x6e
mov ecx, dword [str.softwareclassesjjjerface00000613_0000_0010_8000_00aa006d2ea4proxystubclsid]
mov byte [ecx + 0x13], 0x74
mov edx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [0x4014ac], edx
push 0x401460
mov eax, dword [str.softwareclassesjjjerface00000613_0000_0010_8000_00aa006d2ea4proxystubclsid]
push eax
mov ecx, dword [0x401008]
push ecx
call dword [0x4014ac]
test eax, eax
je 0x43e1b6
xor eax, eax
jmp 0x43e459
push 0x401014
push 0x4014b0
push 0x401018
push 0
push 0
mov edx, dword [0x401460]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43e1e1
xor eax, eax
jmp 0x43e459
movzx eax, word [0x4014b0]
cmp eax, 0x7b
je 0x43e1f4
xor eax, eax
jmp 0x43e459
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0x23c912
mov edx, dword [ebp - 4]
sub edx, 0x23c912
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [0x401708], eax
mov dword [ebp - 0x2c], str.56498489498489
mov dword [ebp - 0x34], 3
push 0
push pe_nt_image_headers32
mov ecx, dword [ebp - 0x34]
push ecx
push 0
push 3
push 1
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x43e257
cmp dword [ebp - 0x30], 0
je 0x43e257
mov eax, 0x42
jmp 0x43e459
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1c]
jae 0x43e2c5
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [section..data]
push edx
call fcn.0043eae0
add esp, 8
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [0x401450]
add ecx, dword [0x401708]
push ecx
mov edx, dword [0x40145c]
add edx, dword [ebp - 4]
push edx
call fcn.0043ea70
add esp, 0xc
mov eax, dword [0x401004]
add eax, dword [section..data]
add eax, dword [0x401708]
mov dword [0x401708], eax
mov ecx, dword [ebp - 4]
add ecx, dword [section..data]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edx
jmp 0x43e257
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [0x40145c]
push ecx
call fcn.0043e4b0
add esp, 8
mov dword [0x401454], ebp
push 0x5b000
call fcn.0043e480
add esp, 4
mov dword [0x40170c], eax
mov dword [0x401460], 0
mov edx, dword [0x401460]
mov dword [ebp - 4], edx
mov eax, dword [0x401460]
mov dword [0x401708], eax
call fcn.0043e050
mov ecx, dword [0x401450]
push ecx
call fcn.0043e460
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
call fcn.0043e480
add esp, 4
mov dword [0x401710], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x1c]
jae 0x43e3a9
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [section..data]
push eax
call fcn.0043eae0
add esp, 8
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [0x401450]
add edx, dword [0x401708]
push edx
mov eax, dword [0x401710]
add eax, dword [ebp - 4]
push eax
call fcn.0043ea70
add esp, 0xc
mov ecx, dword [0x401004]
add ecx, dword [section..data]
add ecx, dword [0x401708]
mov dword [0x401708], ecx
mov edx, dword [ebp - 4]
add edx, dword [section..data]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
jmp 0x43e33b
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [0x401710]
push edx
call fcn.0043e4b0
add esp, 8
mov eax, dword [0x40145c]
mov ecx, dword [0x401710]
mov dword [eax], ecx
mov edx, dword [0x40145c]
push edx
mov eax, dword [0x40170c]
add eax, 0x200
push eax
call fcn.0043e090
add esp, 8
call fcn.0043e080
mov dword [0x401714], eax
mov ecx, dword [0x40170c]
sub ecx, dword [0x401714]
push ecx
mov edx, dword [0x40170c]
push edx
mov eax, dword [0x401710]
push eax
call fcn.0043e6d0
add esp, 0xc
mov ecx, dword [0x40170c]
add ecx, 0x28722
mov dword [0x401458], ecx
mov edx, dword [0x401458]
sub edx, 2
mov dword [0x401458], edx
mov dword [0x401718], 0x43e060
push 0x1a5d261e
mov esi, esi
mov eax, dword [0x401718]
mov esi, esi
mov esi, esi
mov ecx, esp
mov edx, edx
mov dword [ecx], 0
add dword [ecx], eax
mov edx, edx
ret
pop esi
mov esp, ebp
pop ebp
ret