Function at 0x43fda0
Capabilities:
Disable system features via registry on windows
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b1d18
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov ebp, dword [sym.imp.user32.dll_GetDlgItem]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43fe6a
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b3014
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fe46
cmp word [esp + 0x20], 1
jne 0x43fe64
push eax
push 1
push 0xf1
push 0x2901
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43fe64
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 4
push 0
push 0x4b3014
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b1d18
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43ff04
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b3028
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fee0
cmp word [esp + 0x20], 1
jne 0x43fefe
push eax
push 1
push 0xf1
push 0x2902
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43fefe
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b3028
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b1d18
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43ff9e
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b3054
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ff7a
cmp word [esp + 0x20], 1
jne 0x43ff98
push eax
push 1
push 0xf1
push 0x2903
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43ff98
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b3054
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b1d18
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x440038
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b3078
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440014
cmp word [esp + 0x20], 1
jne 0x440032
push eax
push 1
push 0xf1
push 0x2904
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x440032
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b3078
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b1d18
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4400d2
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b30a4
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4400ae
cmp word [esp + 0x20], 1
jne 0x4400cc
push eax
push 1
push 0xf1
push 0x2905
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x4400cc
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b30a4
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
push 0x2906
push 0x4b30cc
mov edx, 0x4b15f0
mov ecx, 0x80000001
call fcn.0043d980
push 0x2907
push 0x4b30f0
mov edx, 0x4b15f0
mov ecx, 0x80000001
call fcn.0043d980
push 0x2908
push 0x4b313c
mov edx, 0x4b15f0
mov ecx, 0x80000001
call fcn.0043d980
push 0x2909
push 0x4b3154
mov edx, 0x4b1d18
mov ecx, 0x80000001
call fcn.0043d980
mov ecx, dword [esp + 0x840]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x814
ret