Function at 0x433c10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4facd6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x788
push ebx
push esi
push edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x10], esp
push eax
call fcn.004ab6e0
lea ecx, [ebp - 0x4c]
push ecx
call fcn.00401350
xor esi, esi
add esp, 8
mov dword [ebp - 4], esi
mov byte [ebp - 0x594], 0
mov dword [0xe56dfc], esi
call fcn.004339f0
push 1
lea ecx, [ebp - 0x94]
call fcn.004f0653
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x94]
push edx
push 8
push str.c:endpcacheprocess_log.txt
mov byte [ebp - 4], 1
call fcn.004f0727
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], eax
cmp eax, dword [0xe56dfc]
jge 0x433f71
mov ebx, eax
lea ecx, [ebp - 0x794]
shl ebx, 4
sub ebx, eax
xor esi, esi
shl ebx, 4
sub ebx, eax
mov byte [ebp - 0x794], 0
shl ebx, 2
lea eax, [ebx + 0xd0a0d0]
push eax
push str.CLSID
push str._s_sInprocServer32
push ecx
call fcn.004f175f
add esp, 0x10
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x794]
push edx
push 0x20019
push esi
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x694]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push edx
push eax
push esi
push esi
push ecx
call edi
test eax, eax
je 0x433d31
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x694]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
push edx
push eax
push esi
push esi
push ecx
call edi
test eax, eax
jne 0x433d5f
lea edi, [ebp - 0x694]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x594]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 1
jne 0x433f65
lea edx, [ebp - 0x594]
push edx
call fcn.004fa6c0
push eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x494], 0
call fcn.00498290
add esp, 8
mov esi, eax
mov dword [ebp - 0x24], esi
push 0x5147b4
push esi
call fcn.004f2d80
push 0x5144fc
push esi
mov edi, eax
call fcn.004f2d80
add esp, 0x10
test edi, edi
jne 0x433eff
test eax, eax
jne 0x433eff
push esi
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x114]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x494]
push 0x51a44c
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x18
test eax, eax
jne 0x433e60
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x494]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x433e40
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x433e57
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
mov esi, dword [ebp - 0x24]
add esp, 0x1b4
push 0x5147ac
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x433e78
inc dword [0xe56d24]
lea ecx, [ebp - 0x494]
push ecx
lea ecx, [ebp - 0x88]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea edx, [ebx + 0xd0a2bc]
lea eax, [ebp - 0x214]
push edx
push str.CLSID
push str.HKCR_s_sInprocServer32
push eax
mov byte [ebp - 0x214], 0
call fcn.004f175f
lea ecx, [ebp - 0x214]
push ecx
call fcn.004bc2e0
add esp, 0x14
lea edx, [ebx + 0xd0a218]
push edx
call fcn.004bc2e0
mov eax, dword [0xe56cac]
add esp, 4
inc eax
mov dword [ebp - 0x20], 1
mov dword [0xe56cac], eax
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
jmp 0x433c95
push esi
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x114]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x494]
push 0x51a3f4
push eax
call fcn.004f175f
add esp, 0x18
lea ecx, [ebp - 0x494]
push ecx
lea ecx, [ebp - 0x88]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
jmp 0x433c95
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x43403d
lea edx, [ebp - 0x4c]
push 0x51a3ac
push edx
mov byte [ebp - 0x494], 0
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x494]
push eax
push 0x5190b4
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x434016
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b0]
test eax, eax
mov eax, dword [ebp + 0x1b4]
lea edx, [ebp - 0x494]
push edx
push eax
push ecx
jne 0x433ff9
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x434010
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x494]
lea ecx, [ebp - 0x88]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x94]
call fcn.004f076e
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x80]
call fcn.004f05fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret