Function at 0x43bc00
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4cf028
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x4fcb54]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
xor ebp, ebp
mov dword [esp + 0x10], ebp
mov dword [esi + 0x28], ebp
call fcn.00484590
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x43bc4b
push 0x80004005
call fcn.004021e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], ebp
cmp dword [esi + 0x24], ebp
jne 0x43bc87
push 0xf003f
push ebp
mov ecx, esi
call fcn.0043ab50
test eax, eax
jne 0x43bc87
push 9
push ebp
mov ecx, esi
call fcn.0043ab50
test eax, eax
je 0x43bdca
mov dword [esp + 0x14], 0x12c
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x12c
or eax, ecx
jge 0x43bcb5
push 0x12c
lea ecx, [esp + 0x14]
call fcn.00402260
mov edi, dword [esp + 0x10]
mov edx, dword [esi + 0x24]
push ebp
push ebp
push ebp
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea ecx, [esp + 0x24]
push ecx
push edi
push ebx
push edx
call ebp
xor ecx, ecx
cmp eax, ecx
je 0x43bcde
and eax, 0xffff
or eax, 0x80070000
jmp 0x43bce0
xor eax, eax
mov dword [esi + 0x28], eax
and eax, 0xffff
cmp eax, 0xea
jne 0x43bd6d
cmp dword [edi - 8], ecx
jl 0x43bdb5
lea eax, [esp + 0x18]
push eax
push ecx
push ecx
mov dword [edi - 0xc], ecx
push ecx
mov byte [edi], cl
mov dword [esp + 0x28], ecx
call fcn.0043b940
cmp dword [esi + 0x28], 0
jl 0x43bd1a
mov eax, dword [esp + 0x18]
jmp 0x43bd1d
or eax, 0xffffffff
lea edx, [eax + 1]
mov dword [esp + 0x14], edx
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x43bd43
push edx
lea ecx, [esp + 0x14]
call fcn.00402260
mov edi, dword [esp + 0x10]
mov edx, dword [esi + 0x24]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
push edi
push ebx
push edx
call ebp
test eax, eax
je 0x43bd68
and eax, 0xffff
or eax, 0x80070000
jmp 0x43bd6a
xor eax, eax
mov dword [esi + 0x28], eax
xor eax, eax
cmp dword [esi + 0x28], eax
jl 0x43bdbf
cmp edi, eax
je 0x43bd8d
mov eax, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x43bd80
sub eax, edx
js 0x43bdb5
cmp eax, dword [edi - 8]
jg 0x43bdb5
mov dword [edi - 0xc], eax
mov byte [eax + edi], 0
cmp dword [edi - 0xc], 0
jne 0x43bdca
push 6
push 0x4df3c8
lea ecx, [esp + 0x18]
call fcn.00402430
mov edi, dword [esp + 0x10]
jmp 0x43bdca
push 0x80070057
call fcn.004021e0
cmp dword [edi - 8], eax
jl 0x43bdb5
mov dword [edi - 0xc], eax
mov byte [edi], 0
cmp dword [esi + 0x28], 0
jl 0x43be1d
lea esi, [edi - 0x10]
push esi
call fcn.00402860
mov edi, dword [esp + 0x30]
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov dword [esp + 0x24], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43be06
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 4
mov esi, dword [esp + 0x2c]
push 0x4dfd54
mov ecx, esi
call fcn.00402520
lea eax, [edi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43be51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 4