Function at 0x43db20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3e68
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x64c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x144], ecx
mov eax, 0x50
xor ebx, ebx
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x148], eax
call fcn.00405800
mov ecx, eax
test ecx, ecx
je 0x43e095
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x14c], edi
mov dword [ebp - 4], ebx
call fcn.00405800
mov ecx, eax
test ecx, ecx
je 0x43e09f
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x138], esi
mov byte [ebp - 4], 1
call fcn.00405800
mov ecx, eax
test ecx, ecx
je 0x43e0a9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x134], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x144], ebx
je 0x43e021
mov dword [ebp - 0x140], ebx
call fcn.00405800
mov ecx, eax
test ecx, ecx
je 0x43e0b3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.0040e020
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
jb 0x43dc22
mov eax, dword [eax]
push dword [0x65cb40]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.00408c40
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.00408a60
mov esi, dword [ebp - 0x13c]
lea ecx, [ebp - 0x15c]
push 1
push esi
push reloc.WS2_32.dll_accept
call fcn.00405670
mov ecx, dword [ebp - 0x15c]
test eax, eax
jne 0x43dc96
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 4
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x164]
push eax
push 0
push str.Proxy_Mode
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x13c], eax
test ecx, ecx
je 0x43dcad
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43dcc9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
dec eax
cmp eax, 3
ja case.default.0x43dcdf
jmp dword [eax*4 + 0x43e0d4]
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.0043d370
mov esi, dword [ebp - 0x148]
mov eax, dword [ebp - 0x140]
jmp 0x43de38
mov dword [ebp - 0x140], 0x50
call fcn.00405800
mov ecx, eax
test ecx, ecx
je 0x43e0bd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.0040e020
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], 8
jb 0x43dd6e
mov eax, dword [eax]
push dword [0x65cb40]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.00408c40
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.00408a60
mov esi, dword [ebp - 0x148]
lea ecx, [ebp - 0x15c]
push 1
push esi
push reloc.WS2_32.dll_accept
call fcn.00405670
mov edi, dword [ebp - 0x15c]
test eax, eax
jne 0x43ddf9
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 4
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x148]
push eax
push 0
push 0x638600
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ddf9
cmp dword [ebp - 0x148], 4
mov eax, 0x50
cmove eax, dword [ebp - 0x140]
mov dword [ebp - 0x160], eax
test edi, edi
je 0x43de04
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43de20
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14c]
push eax
call fcn.0043cec0
mov eax, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x160]
mov edi, dword [ebp - 0x14c]
cmp dword [edi - 0xc], 0
je case.default.0x43dcdf
sub eax, 2
je 0x43de56
sub eax, 1
jne 0x43de72
push 5
jmp 0x43de58
push 0
push 0x65
push dword [ebp - 0x144]
call fcn.00488e20
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne case.default.0x43dcdf
push esi
push 0x3b
push dword [ebp - 0x144]
call fcn.00488e20
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne case.default.0x43dcdf
push 3
lea eax, [ebp - 0xa8]
push edi
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xac], eax
call fcn.00409120
mov byte [ebp - 4], 9
push dword [ebp - 0xac]
push 0x2714
push dword [ebp - 0x144]
call fcn.00488e20
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x43dff8
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0043d0a0
test eax, eax
je 0x43dff8
call fcn.00405800
mov ecx, eax
test ecx, ecx
je 0x43e0c7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x13c]
push dword [ebp - 0x134]
mov esi, dword [ebp - 0x138]
push esi
push str._s:_s
push eax
call fcn.00408c40
push 1
push 0x6f
push dword [ebp - 0x144]
call fcn.00488e20
mov ebx, eax
add esp, 0x1c
test ebx, ebx
je 0x43df88
mov byte [ebp - 4], 9
or eax, 0xffffffff
mov edx, dword [ebp - 0x13c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43df62
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
cmp eax, ecx
je 0x43e01b
push eax
call fcn.005a8164
add esp, 4
jmp 0x43e01b
mov esi, dword [ebp - 0x13c]
lea eax, [ebp - 0x12c]
push 3
push esi
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x130], eax
call fcn.00409120
push dword [ebp - 0x130]
push 0x2716
push dword [ebp - 0x144]
call fcn.00488e20
mov ebx, eax
lea ecx, [ebp - 0x12c]
mov eax, dword [ebp - 0x130]
add esp, 0xc
cmp eax, ecx
je 0x43dfdc
push eax
call fcn.005a8164
add esp, 4
or eax, 0xffffffff
mov byte [ebp - 4], 9
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43dff8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
cmp eax, ecx
je case.default.0x43dcdf
push eax
call fcn.005a8164
add esp, 4
mov esi, dword [ebp - 0x138]
mov eax, dword [ebp - 0x134]
lea edx, [eax - 0x10]
mov byte [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43e03d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43e05b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x43e077
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00483ab6
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00405600
push 0x80004005
call fcn.00405600
push 0x80004005
call fcn.00405600
push 0x80004005
call fcn.00405600
push 0x80004005
call fcn.00405600
push 0x80004005
call fcn.00405600
nop dword [eax]
out 0xdc, al
inc ebx
add byte [ecx], dl
fld qword [ebx]
adc ebp, ebx
inc ebx
add byte [ecx], dl
fld qword [ebx]
int3