Function at 0x434e15
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea ecx, [ebp - 8]
mov dword [ebp - 0x18], 1
call fcn.00434b5d
xor esi, esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
call fcn.00434b5d
call dword [0x446f78]
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromCLSID]
cmp eax, esi
mov dword [ebp + 8], eax
jl 0x43502b
push ebx
push edi
push 0x41d9d0
push 0x446ed0
lea eax, [ebp + 8]
push eax
call fcn.00434cac
push eax
lea ecx, [ebp - 0x10]
call fcn.00434d04
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004039d1
push dword [ebp - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00434ddc
lea eax, [ebp - 4]
push eax
mov edi, 0x20019
push edi
push esi
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x80000002
mov dword [ebp + 8], 0x80004005
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x434f04
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 8]
call fcn.004031ad
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x4350b4
push dword [ebp - 4]
call ebx
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00434b07
mov eax, dword [ebp - 8]
cmp dword [eax - 0xc], 0
je 0x434ef7
and dword [ebp + 8], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00434ad3
cmp dword [ebp + 8], 0
jge 0x434fa5
lea ecx, [ebp + 8]
call fcn.00434b5d
push 0x4350a4
lea ecx, [ebp + 8]
call fcn.00434c63
push dword [ebp - 0xc]
lea ecx, [ebp + 8]
call fcn.00434ddc
push 0x435084
lea ecx, [ebp + 8]
call fcn.00434ddc
lea eax, [ebp - 4]
push eax
push edi
mov edi, dword [ebp + 8]
push 0
push edi
push 0x80000000
call esi
test eax, eax
je 0x434f6d
lea ecx, [edi - 0x10]
mov dword [ebp + 8], 0x80004005
call fcn.004039d1
jmp 0x435029
lea ecx, [ebp - 0x14]
mov eax, 0x104
push ecx
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 0x14], eax
call fcn.004031ad
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x4350b4
push dword [ebp - 4]
call ebx
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00434b07
lea ecx, [edi - 0x10]
call fcn.004039d1
mov edi, dword [ebp + 0xc]
and dword [ebp + 8], 0
mov ebx, 0x404ad8
mov esi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push 0x435078
push esi
call fcn.0043735b
test eax, eax
pop ecx
pop ecx
jne 0x434fd2
mov esi, 0x4350e4
jmp 0x43500d
push 0x435070
push esi
call fcn.0043735b
test eax, eax
pop ecx
pop ecx
jne 0x434fea
mov esi, 0x4350d4
jmp 0x43500d
push 0x435068
push esi
call fcn.0043735b
test eax, eax
pop ecx
pop ecx
jne 0x435002
mov esi, 0x4350c4
jmp 0x43500d
cmp dword [esi - 0xc], 0
jne 0x435014
mov esi, 0x4350f4
mov edi, dword [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
push 4
pop ecx
mov edi, ebx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x435029
mov dword [ebp + 8], 0x80004005
pop edi
pop ebx
cmp dword [ebp - 0xc], 0
pop esi
je 0x43503b
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 4], 0
je 0x43504a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004039d1
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.004039d1
mov eax, dword [ebp + 8]
leave
ret 8