Function at 0x434980
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458b80
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x477070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
lea ecx, [ebp + 0x24]
cmp dword [ebp + 0x38], 8
lea eax, [ebp + 0xc]
cmovae ecx, dword [ebp + 0x24]
cmp dword [ebp + 0x20], 8
push ecx
cmovae eax, dword [ebp + 0xc]
push eax
push str.ReadRegStringValue:_Start__key:__s__value:__s
push 0x466060
push 0x477a14
call fcn.00433950
add esp, 0x14
lea ecx, [ebp - 0x20]
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
push ecx
push ebx
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x434a34
cmp dword [ebp + 0x20], 8
lea eax, [ebp + 0xc]
push edi
cmovae eax, dword [ebp + 0xc]
push ebx
push eax
push str.ReadRegStringValue:_Could_not_open_registry_key__s_with_samDesired_option__d__result_code:__ld
push 0x466060
push 0x477a14
call fcn.00433950
add esp, 0x18
jmp 0x434b8a
cmp dword [ebp + 0x38], 8
lea ecx, [ebp - 0x24]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0x24]
cmovae eax, dword [ebp + 0x24]
push ecx
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push dword [ebp - 0x20]
call ebx
mov edi, eax
test edi, edi
je 0x434a8f
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x38], 8
lea eax, [ebp + 0x24]
push edi
cmovae eax, dword [ebp + 0x24]
push eax
push str.ReadRegStringValue:_Could_not_read_registry_value__s__result_code:__ld
push 0x466060
push 0x477a14
call fcn.00433950
add esp, 0x14
jmp 0x434b8a
cmp dword [ebp - 0x18], 1
je 0x434ac2
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x18]
push str.Incorrect_registry_value_type._Got_type__ld
push 0x466060
push 0x477a14
call fcn.00433950
add esp, 0x10
mov edi, 0x4e2a
jmp 0x434b8a
mov eax, dword [ebp - 0x24]
xor ecx, ecx
push ecx
shr eax, 1
mov word [ebp - 0x3c], cx
lea ecx, [ebp - 0x3c]
push eax
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], 0
call fcn.004165c0
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
call fcn.00408770
lea ecx, [ebp - 0x3c]
call fcn.00404890
cmp dword [esi + 0x14], 8
jb 0x434b02
mov ecx, dword [esi]
jmp 0x434b04
mov ecx, esi
cmp dword [ebp + 0x38], 8
lea edx, [ebp - 0x24]
push edx
push ecx
push 0
lea eax, [ebp + 0x24]
cmovae eax, dword [ebp + 0x24]
push 0
push eax
push dword [ebp - 0x20]
call ebx
push dword [ebp - 0x20]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x434b47
push edi
push str.Could_not_read_registry_value__result_code:__ld
push 0x466060
push 0x477a14
call fcn.00433950
add esp, 0x10
jmp 0x434b8a
push 1
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
mov ecx, esi
call fcn.00401460
cmp eax, 0xffffffff
je 0x434b88
mov ecx, dword [esi + 0x10]
cmp eax, ecx
ja 0x434b7c
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 8
jb 0x434b74
mov esi, dword [esi]
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x434b88
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.00418e50
xor edi, edi
mov eax, dword [ebp + 0x20]
cmp eax, 8
jb 0x434b9f
inc eax
lea ecx, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
call fcn.00405180
mov ecx, dword [ebp + 0x38]
xor eax, eax
mov dword [ebp + 0x20], 7
mov dword [ebp + 0x1c], 0
mov word [ebp + 0xc], ax
cmp ecx, 8
jb 0x434bc8
inc ecx
push ecx
push dword [ebp + 0x24]
lea ecx, [ebp + 0x24]
call fcn.00405180
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00436666
mov esp, ebp
pop ebp
ret