Function at 0x43882b
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x455564
call fcn.00454198
mov eax, 0x1005c
call fcn.0044f5b0
and dword [ebp - 0x1c], 0
push ebx
push esi
mov dword [ebp - 0x14], ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.00412fe7
and dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00412fe7
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00412fe7
mov byte [ebp - 4], 2
mov esi, str.0123456789ABCDEF
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0xc]
push 0x459596
call fcn.0041512a
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xc], 0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
ja 0x4388a1
lea esi, [ebx + 0x18]
jmp 0x4388a6
mov eax, dword [ebx + 8]
mov esi, dword [eax]
call fcn.004149d4
sub esp, 0xc
mov esi, esp
mov dword [ebp + 8], esp
push eax
call fcn.00413004
call fcn.004383e7
lea eax, [ebp + 8]
push eax
sub esp, 0xc
lea edi, [ebp - 0x34]
mov esi, esp
mov dword [ebp + 8], esp
call fcn.00413054
lea ecx, [ebp - 0x48]
call fcn.004384e7
test al, al
jne 0x4388e5
push 0
push 2
pop eax
jmp 0x43893c
xor edi, edi
cmp dword [ebp - 0x24], edi
je 0x43890a
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
je 0x438905
push edi
push 3
jmp 0x4388e2
mov eax, dword [ebp - 0x1c]
jmp 0x43890d
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x48]
or ecx, 0x20019
push ecx
push edi
push dword [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x438949
cmp dword [ebp - 0x24], edi
je 0x438938
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push edi
inc eax
mov ecx, dword [ebp - 0x14]
call fcn.0041da9c
jmp 0x438b9c
cmp dword [ebx + 0xc], 1
ja 0x438954
lea esi, [ebx + 0x18]
jmp 0x43895a
mov eax, dword [ebx + 8]
mov esi, dword [eax + 4]
push edi
push edi
lea eax, [ebp - 0x44]
push eax
push edi
call fcn.004149d4
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
mov ecx, dword [ebp - 0x14]
je 0x438983
push 0
or eax, 0xffffffff
jmp 0x438b81
mov edx, dword [ebp - 0x44]
xor esi, esi
push esi
mov eax, edx
call fcn.0041dac3
cmp edx, esi
mov dword [ebp - 0x10], 0xffff
jbe 0x438b7a
cmp edx, 2
jbe 0x438b2b
cmp edx, 3
je 0x438a9c
push 4
pop eax
cmp edx, eax
je 0x438a49
cmp edx, 7
jne 0x438b7a
cmp dword [ebx + 0xc], 1
ja 0x4389d0
add ebx, 0x18
jmp 0x4389d6
mov eax, dword [ebx + 8]
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10068]
push eax
push esi
push esi
mov esi, ebx
call fcn.004149d4
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x438b76
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x10068], al
cmp byte [ebp + edx - 0x10069], al
jne 0x438a0f
dec edx
mov dword [ebp - 0x10], edx
test edx, edx
jbe 0x438b65
xor eax, eax
test edx, edx
jbe 0x438a31
lea ecx, [ebp + eax - 0x10068]
cmp byte [ecx], 0
jne 0x438a2c
mov byte [ecx], 0xa
inc eax
cmp eax, edx
jb 0x438a1d
lea eax, [ebp + eax - 0x10069]
cmp byte [eax], 0xa
jne 0x438b65
mov byte [eax], 0
jmp 0x438b65
cmp dword [ebx + 0xc], 1
mov dword [ebp - 0x10], eax
ja 0x438a57
add ebx, 0x18
jmp 0x438a5d
mov eax, dword [ebx + 8]
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push esi
mov esi, ebx
call fcn.004149d4
push eax
push dword [ebp - 0x18]
call edi
fild dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
test eax, eax
jge 0x438a84
fadd qword [0x45cb20]
mov esi, dword [ebp + 0xc]
fstp qword [ebp - 0x4c]
fld qword [ebp - 0x4c]
push ecx
push ecx
fstp qword [esp]
call fcn.00415111
jmp 0x438b86
cmp dword [ebx + 0xc], 1
ja 0x438aa7
add ebx, 0x18
jmp 0x438aad
mov eax, dword [ebx + 8]
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10068]
push eax
push esi
push esi
mov esi, ebx
call fcn.004149d4
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x438b76
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax + 1]
push eax
call fcn.00446688
mov ebx, eax
xor edi, edi
mov byte [ebx], 0
xor esi, esi
cmp dword [ebp - 0x10], edi
pop ecx
jbe 0x438b15
movsx eax, byte [ebp + edi - 0x10068]
mov ecx, eax
shr eax, 4
and ecx, 0xf
mov cl, byte [ebp + ecx - 0x64]
and eax, 0xf
mov al, byte [ebp + eax - 0x64]
mov byte [esi + ebx + 1], cl
mov byte [esi + ebx], al
inc esi
inc esi
inc edi
cmp edi, dword [ebp - 0x10]
jb 0x438aeb
mov byte [esi + ebx], 0
mov esi, dword [ebp + 0xc]
push ebx
call fcn.0041512a
push ebx
call fcn.0044627e
pop ecx
jmp 0x438b86
cmp dword [ebx + 0xc], 1
ja 0x438b36
add ebx, 0x18
jmp 0x438b3c
mov eax, dword [ebx + 8]
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10068]
push eax
push esi
push esi
mov esi, ebx
call fcn.004149d4
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x438b76
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x10068], 0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x10068]
push eax
call fcn.0041512a
jmp 0x438b86
push 0
jmp 0x438b7b
push esi
mov ecx, dword [ebp - 0x14]
push 0xfffffffffffffffe
pop eax
call fcn.0041da9c
push dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
cmp dword [ebp - 0x24], 0
je 0x438b9c
push dword [ebp - 0x1c]
call esi
mov byte [ebp - 4], 1
push dword [ebp - 0x40]
call fcn.0044627e
mov byte [ebp - 4], 0
push dword [ebp - 0x34]
call fcn.0044627e
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x28]
call fcn.0044627e
mov ecx, dword [ebp - 0xc]
add esp, 0xc
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
leave
ret 8