Function at 0x4387f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x455524
call fcn.00454158
mov eax, 0x1005c
call fcn.0044f570
and dword [ebp - 0x1c], 0
push ebx
push esi
mov dword [ebp - 0x14], ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.00413036
and dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00413036
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00413036
mov byte [ebp - 4], 2
mov esi, str.0123456789ABCDEF
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0xc]
push 0x459596
call fcn.00415109
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xc], 0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
ja 0x43886e
lea esi, [ebx + 0x18]
jmp 0x438873
mov eax, dword [ebx + 8]
mov esi, dword [eax]
call fcn.004149b3
sub esp, 0xc
mov esi, esp
mov dword [ebp + 8], esp
push eax
call fcn.00413053
call fcn.004383b4
lea eax, [ebp + 8]
push eax
sub esp, 0xc
lea edi, [ebp - 0x34]
mov esi, esp
mov dword [ebp + 8], esp
call fcn.004130a3
lea ecx, [ebp - 0x48]
call fcn.004384b4
test al, al
jne 0x4388b2
push 0
push 2
pop eax
jmp 0x438909
xor edi, edi
cmp dword [ebp - 0x24], edi
je 0x4388d7
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
je 0x4388d2
push edi
push 3
jmp 0x4388af
mov eax, dword [ebp - 0x1c]
jmp 0x4388da
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x48]
or ecx, 0x20019
push ecx
push edi
push dword [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x438916
cmp dword [ebp - 0x24], edi
je 0x438905
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push edi
inc eax
mov ecx, dword [ebp - 0x14]
call fcn.0041da7b
jmp 0x438b69
cmp dword [ebx + 0xc], 1
ja 0x438921
lea esi, [ebx + 0x18]
jmp 0x438927
mov eax, dword [ebx + 8]
mov esi, dword [eax + 4]
push edi
push edi
lea eax, [ebp - 0x44]
push eax
push edi
call fcn.004149b3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
mov ecx, dword [ebp - 0x14]
je 0x438950
push 0
or eax, 0xffffffff
jmp 0x438b4e
mov edx, dword [ebp - 0x44]
xor esi, esi
push esi
mov eax, edx
call fcn.0041daa2
cmp edx, esi
mov dword [ebp - 0x10], 0xffff
jbe 0x438b47
cmp edx, 2
jbe 0x438af8
cmp edx, 3
je 0x438a69
push 4
pop eax
cmp edx, eax
je 0x438a16
cmp edx, 7
jne 0x438b47
cmp dword [ebx + 0xc], 1
ja 0x43899d
add ebx, 0x18
jmp 0x4389a3
mov eax, dword [ebx + 8]
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10068]
push eax
push esi
push esi
mov esi, ebx
call fcn.004149b3
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x438b43
mov edx, dword [ebp - 0x10]
mov byte [ebp + edx - 0x10068], al
cmp byte [ebp + edx - 0x10069], al
jne 0x4389dc
dec edx
mov dword [ebp - 0x10], edx
test edx, edx
jbe 0x438b32
xor eax, eax
test edx, edx
jbe 0x4389fe
lea ecx, [ebp + eax - 0x10068]
cmp byte [ecx], 0
jne 0x4389f9
mov byte [ecx], 0xa
inc eax
cmp eax, edx
jb 0x4389ea
lea eax, [ebp + eax - 0x10069]
cmp byte [eax], 0xa
jne 0x438b32
mov byte [eax], 0
jmp 0x438b32
cmp dword [ebx + 0xc], 1
mov dword [ebp - 0x10], eax
ja 0x438a24
add ebx, 0x18
jmp 0x438a2a
mov eax, dword [ebx + 8]
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push esi
mov esi, ebx
call fcn.004149b3
push eax
push dword [ebp - 0x18]
call edi
fild dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
test eax, eax
jge 0x438a51
fadd qword [0x45cb28]
mov esi, dword [ebp + 0xc]
fstp qword [ebp - 0x4c]
fld qword [ebp - 0x4c]
push ecx
push ecx
fstp qword [esp]
call fcn.004150f0
jmp 0x438b53
cmp dword [ebx + 0xc], 1
ja 0x438a74
add ebx, 0x18
jmp 0x438a7a
mov eax, dword [ebx + 8]
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10068]
push eax
push esi
push esi
mov esi, ebx
call fcn.004149b3
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x438b43
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax + 1]
push eax
call fcn.00446648
mov ebx, eax
xor edi, edi
mov byte [ebx], 0
xor esi, esi
cmp dword [ebp - 0x10], edi
pop ecx
jbe 0x438ae2
movsx eax, byte [ebp + edi - 0x10068]
mov ecx, eax
shr eax, 4
and ecx, 0xf
mov cl, byte [ebp + ecx - 0x64]
and eax, 0xf
mov al, byte [ebp + eax - 0x64]
mov byte [esi + ebx + 1], cl
mov byte [esi + ebx], al
inc esi
inc esi
inc edi
cmp edi, dword [ebp - 0x10]
jb 0x438ab8
mov byte [esi + ebx], 0
mov esi, dword [ebp + 0xc]
push ebx
call fcn.00415109
push ebx
call fcn.0044624a
pop ecx
jmp 0x438b53
cmp dword [ebx + 0xc], 1
ja 0x438b03
add ebx, 0x18
jmp 0x438b09
mov eax, dword [ebx + 8]
mov ebx, dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10068]
push eax
push esi
push esi
mov esi, ebx
call fcn.004149b3
push eax
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x438b43
mov eax, dword [ebp - 0x10]
mov byte [ebp + eax - 0x10068], 0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x10068]
push eax
call fcn.00415109
jmp 0x438b53
push 0
jmp 0x438b48
push esi
mov ecx, dword [ebp - 0x14]
push 0xfffffffffffffffe
pop eax
call fcn.0041da7b
push dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
cmp dword [ebp - 0x24], 0
je 0x438b69
push dword [ebp - 0x1c]
call esi
mov byte [ebp - 4], 1
push dword [ebp - 0x40]
call fcn.0044624a
mov byte [ebp - 4], 0
push dword [ebp - 0x34]
call fcn.0044624a
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x28]
call fcn.0044624a
mov ecx, dword [ebp - 0xc]
add esp, 0xc
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
leave
ret 8