Function at 0x10043090
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1006d97f
call fcn.10055640
sub esp, 0x95c
mov ecx, dword [ebp + 0xc]
push esi
call fcn.1003576a
push 9
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionPerflib
lea eax, [ebp - 0x968]
push str._s_03x
push eax
call fcn.10056928
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push 0x20019
xor esi, esi
push esi
lea eax, [ebp - 0x968]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004314b
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push esi
mov esi, str.Counters
push esi
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10043140
push dword [ebp - 0x10]
call fcn.1005983e
mov ebx, eax
test ebx, ebx
pop ecx
je 0x10043140
push dword [ebp - 0x10]
push 0
push ebx
call fcn.10055e00
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push 0
push esi
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x10043158
push ebx
call fcn.10057a3f
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
or dword [ebp - 0x18], 0xffffffff
lea eax, [ebp - 0x968]
push 0x10074514
push eax
mov esi, ebx
call fcn.100564d6
xor edi, edi
cmp word [ebx], di
pop ecx
jmp 0x1004320e
cmp esi, ebx
jbe 0x10043193
lea edi, [esi - 4]
jmp 0x10043185
dec edi
dec edi
movzx eax, word [edi]
push eax
call fcn.10056a4a
test eax, eax
pop ecx
jne 0x10043183
push str.process
push esi
call fcn.10055ede
test eax, eax
pop ecx
pop ecx
jne 0x100431cc
lea edi, [esi - 4]
jmp 0x100431ab
dec edi
dec edi
movzx eax, word [edi]
push eax
call fcn.10056a4a
test eax, eax
pop ecx
jne 0x100431a9
add edi, 2
lea eax, [ebp - 0x968]
push edi
push eax
call fcn.100564d6
pop ecx
jmp 0x100431fe
push str.id_process
push esi
call fcn.10055ede
test eax, eax
pop ecx
pop ecx
jne 0x100431ff
lea edi, [esi - 4]
jmp 0x100431e4
dec edi
dec edi
movzx eax, word [edi]
push eax
call fcn.10056a4a
test eax, eax
pop ecx
jne 0x100431e2
add edi, 2
push edi
call fcn.10056569
mov dword [ebp - 0x18], eax
pop ecx
push esi
call fcn.1005565f
lea esi, [esi + eax*2 + 2]
xor edi, edi
cmp word [esi], di
pop ecx
jne 0x1004317a
push ebx
call fcn.10057a3f
lea eax, [ebp - 0x968]
push eax
call fcn.1005565f
test eax, eax
pop ecx
pop ecx
jbe 0x10043140
mov eax, 0xc800
push eax
mov dword [ebp - 0x10], eax
call fcn.1005983e
mov ebx, eax
cmp ebx, edi
pop ecx
mov dword [ebp - 0x1c], ebx
je 0x10043140
push dword [ebp - 0x10]
push edi
push ebx
call fcn.10055e00
add esp, 0xc
mov esi, reloc.OLEAUT32.dll_SysReAllocStringLen
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push edi
lea eax, [ebp - 0x968]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x100432ab
cmp dword [ebp - 0x10], edi
jbe 0x1004341b
cmp word [ebx], 0x50
jne 0x1004341b
cmp word [ebx + 2], 0x45
jne 0x1004341b
cmp word [ebx + 4], 0x52
jne 0x1004341b
cmp word [ebx + 6], 0x46
je 0x100432db
cmp eax, 0xea
jne 0x1004341b
add dword [ebp - 0x10], 0x6400
push dword [ebp - 0x10]
push ebx
call fcn.10059be5
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push edi
push eax
call fcn.10055e00
mov ebx, dword [ebp - 0x1c]
add esp, 0x14
jmp 0x1004325f
mov eax, dword [ebx + 0x18]
add eax, ebx
je 0x10043401
mov ecx, dword [eax + 8]
add ecx, eax
je 0x10043401
mov edx, dword [eax + 0x20]
xor esi, esi
cmp edx, edi
mov dword [ebp - 0x24], edi
jbe 0x10043315
mov edi, dword [ecx + 4]
cmp edi, dword [ebp - 0x18]
je 0x1004330f
add ecx, 0x28
inc esi
cmp esi, edx
jb 0x100432fd
jmp 0x10043315
mov ecx, dword [ecx + 0x24]
mov dword [ebp - 0x24], ecx
mov esi, dword [eax + 4]
push dword [ebp + 8]
mov edi, dword [eax + 0x28]
lea ecx, [ebp - 0x5c]
add esi, eax
call fcn.10005748
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x40]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1000583a
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.1000289a
cmp edi, ebx
jbe 0x100433e0
mov dword [ebp - 0x18], edi
mov eax, dword [esi + 0x10]
push ebx
push ebx
push 0x109
lea ecx, [ebp - 0x168]
push ecx
push 0xffffffffffffffff
add eax, esi
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, dword [esi]
add edi, esi
cmp eax, ebx
je 0x100433d3
lea eax, [ebp - 0x168]
push eax
call fcn.100561b0
test eax, eax
pop ecx
jbe 0x100433d3
push 4
lea eax, [ebp - 0x168]
push str..exe
push eax
call fcn.10059ab0
mov eax, dword [ebp - 0x3c]
add esp, 0xc
cmp dword [ebp - 0x28], 0x10
jae 0x100433ae
lea eax, [ebp - 0x3c]
push dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.1006782c
add esp, 0xc
test eax, eax
jne 0x100433d3
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
add eax, edi
push eax
call fcn.1003dce1
mov esi, dword [edi]
add esi, edi
dec dword [ebp - 0x18]
jne 0x10043355
push dword [ebp - 0x1c]
call fcn.10057a3f
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
lea ecx, [ebp - 0x40]
call fcn.10002e29
jmp 0x10043149
push ebx
call fcn.10057a3f
pop ecx
push dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push esi
call edi
jmp 0x10043149
cmp ebx, edi
je 0x10043408
jmp 0x10043401