Function at 0x43fe30
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc980
call fcn.004646d0
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push str.BCD00000000Objects
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x43fe82
xor eax, eax
jmp 0x440325
mov word [ebp - 0x230], 0
push 0x206
push 0
lea ecx, [ebp - 0x22e]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x440], 0
push 0x1fc
push 0
lea edx, [ebp - 0x43e]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], 0xff
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0xc], 0
je 0x440323
mov byte [ebp - 0xc650], 0
push 0x3ffe
push 0
lea edx, [ebp - 0xc64f]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0xc658], 0x3fff
mov word [ebp - 0x8650], 0
push 0x1fc
push 0
lea eax, [ebp - 0x864e]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x844c], 0xff
mov word [ebp - 0x8448], 0
push 0x7ffc
push 0
lea ecx, [ebp - 0x8446]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x444], 0x3fff
mov dword [ebp - 0xc654], 0
mov dword [ebp - 0xc660], 1
mov dword [ebp - 0xc65c], 0
mov dword [ebp - 0xc664], 0
mov dword [ebp - 0xc668], 0
jmp 0x43ffda
mov edx, dword [ebp - 0xc664]
add edx, 1
mov dword [ebp - 0xc664], edx
mov eax, dword [ebp - 0xc664]
cmp eax, dword [ebp - 0xc]
jae 0x44015b
cmp dword [ebp - 0xc668], 0
jne 0x44015b
cmp dword [ebp - 0xc65c], 0
jne 0x44015b
mov word [ebp - 0x8650], 0
mov dword [ebp - 0x844c], 0xff
mov dword [ebp - 0xc658], 0x3fff
mov ecx, dword [ebp - 0x844c]
push ecx
lea edx, [ebp - 0x8650]
push edx
mov eax, dword [ebp - 0xc664]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0xc668], eax
cmp dword [ebp - 0xc668], 0
jne 0x440156
mov word [ebp - 0x8448], 0
mov dword [ebp - 0x444], 0x3fff
push str.Elements12000004
push 0xff
lea edx, [ebp - 0x8650]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0xc654]
push eax
lea ecx, [ebp - 0x8650]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x440156
mov byte [ebp - 0xc650], 0
mov dword [ebp - 0xc658], 0x3fff
lea eax, [ebp - 0xc658]
push eax
lea ecx, [ebp - 0xc650]
push ecx
lea edx, [ebp - 0xc660]
push edx
push 0
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x8448]
push ecx
push 0
mov edx, dword [ebp - 0xc654]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x440149
push str.Windows_Recovery_Environment
lea eax, [ebp - 0xc650]
push eax
call dword [sym.imp.MSVCR80.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x44011a
push str.Windows_Recovery
lea ecx, [ebp - 0xc650]
push ecx
call dword [sym.imp.MSVCR80.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x440149
mov word [ebp - 0x8606], 0
lea edx, [ebp - 0x864e]
push edx
push 0x104
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
mov dword [ebp - 0xc65c], 1
mov ecx, dword [ebp - 0xc654]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43ffcb
cmp dword [ebp - 0xc65c], 0
je 0x440323
mov word [ebp - 0xc870], 0
push 0x206
push 0
lea edx, [ebp - 0xc86e]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0xc870]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov word [ebp - 0xc86c], 0
push 0x469410
push 0x104
lea ecx, [ebp - 0xc870]
push ecx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea edx, [ebp - 0x230]
push edx
push 0x104
lea eax, [ebp - 0xc870]
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0x469428
push 0x104
lea ecx, [ebp - 0xc870]
push ecx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push bind
lea edx, [ebp - 0xc870]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc874], eax
cmp dword [ebp - 0xc874], 0xffffffff
jne 0x4402ec
mov byte [ebp - 0xc980], 0
push 0x103
push 0
lea eax, [ebp - 0xc97f]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0xc980]
push ecx
call fcn.0043e5c0
add esp, 8
push 0x104
lea edx, [ebp - 0xc980]
push edx
push 0x104
lea eax, [ebp - 0xc870]
push eax
lea ecx, [ebp - 0x238]
push ecx
call dword [sym.imp.MSVCR80.dll_mbstowcs_s]
add esp, 0x14
push 0x469440
push 0x104
lea edx, [ebp - 0xc870]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push 0x104
lea ecx, [ebp - 0xc870]
push ecx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0x469458
push 0x104
lea edx, [ebp - 0xc870]
push edx
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0
push 0
push 3
push 0
push 3
push bind
lea eax, [ebp - 0xc870]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc874], eax
cmp dword [ebp - 0xc874], 0xffffffff
je 0x440323
lea ecx, [ebp - 0xc870]
push ecx
push 0x104
push 0xc9b030
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
mov edx, dword [ebp - 0xc874]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x440325
xor eax, eax
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret