Function at 0x437c30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4bde0c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test al, 1
jne 0x437c73
or eax, 1
mov dword [0x4bde08], 0
push 0x48d9a0
mov dword [0x4bde0c], eax
call fcn.0046fe79
add esp, 4
mov ecx, 0x4bde08
call fcn.0046a870
test eax, eax
jne 0x437d25
push 0x498f30
mov ecx, 0x4bde08
call fcn.0046a240
lea eax, [ebp - 0x408]
mov dword [ebp - 0x408], 0
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x437d25
lea eax, [ebp - 0x410]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push 1
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x437d19
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x40c], 0
push eax
push dword [ebp - 0x404]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x437d19
push dword [ebp - 0x40c]
mov ecx, 0x4bde08
call fcn.0046a240
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x408]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [0x4bde10], 0
jne 0x437dc7
lea eax, [ebp - 0x410]
push eax
push 1
push 0
push 0x4a25dc
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x437da9
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x408], 0xffffffff
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], 4
push eax
push 0
push 0
push 0x4a25f8
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x408]
cmp eax, 0xffffffff
je 0x437da9
push eax
push 0x4a2608
push 4
push 0x4bde10
call fcn.00431470
add esp, 0x10
cmp word [0x4bde10], 0
jne 0x437dc7
push 0x4a2614
push 4
push 0x4bde10
call fcn.0046f05c
add esp, 0xc
cmp word [edi], 0xa
jbe 0x437f8f
push 0xa
push 0x4a2618
push esi
call fcn.0046ffcb
add esp, 0xc
test eax, eax
jne 0x437f8f
cmp word [edi], 0x11
jb 0x437eac
push 7
lea eax, [esi + 0x14]
push 0x4a2630
push eax
call fcn.0046ffcb
add esp, 0xc
test eax, eax
jne 0x437eac
cmp word [edi], 0x44
jb 0x437e37
push 0x33
lea eax, [esi + 0x22]
push 0x4a2640
push eax
call fcn.0046ffcb
add esp, 0xc
test eax, eax
jne 0x437e37
push 0x49c690
push 0x44
jmp 0x437f83
cmp word [edi], 0x22
jb 0x437e60
push 0x11
lea eax, [esi + 0x22]
push 0x4a26a8
push eax
call fcn.0046ffcb
add esp, 0xc
test eax, eax
jne 0x437e60
push 0x49c6c8
push 0x22
jmp 0x437f83
cmp word [edi], 0x26
jb 0x437ea0
push 0x12
lea eax, [esi + 0x22]
push 0x4a26cc
push eax
call fcn.0046ffcb
add esp, 0xc
test eax, eax
jne 0x437ea0
push 3
lea eax, [esi + 0x46]
push 0x4bde10
push eax
call fcn.0047277b
add esp, 0xc
test eax, eax
jne 0x437ea0
push 0x4a26f4
push 0x26
jmp 0x437f83
push 0x49c628
push 0x11
jmp 0x437f83
cmp word [edi], 0xe
jb 0x437f8f
push 4
lea eax, [esi + 0x14]
push 0x4a2730
push eax
call fcn.0046ffcb
add esp, 0xc
test eax, eax
jne 0x437f8f
mov ecx, 0x4bde08
call fcn.0046a870
movzx ecx, word [edi]
add eax, 0xf
cmp ecx, eax
jb 0x437f7c
cmp word [esi + 0x1c], 0x5c
jne 0x437f7c
mov ecx, 0x4bde08
call fcn.0046a870
push eax
mov ecx, 0x4bde08
call fcn.0046a2c0
push eax
lea eax, [esi + 0x1e]
push eax
call fcn.0046ffcb
add esp, 0xc
test eax, eax
jne 0x437f7c
mov ecx, 0x4bde08
call fcn.0046a870
movzx ecx, word [edi]
add eax, 0x17
cmp ecx, eax
jb 0x437f67
push 8
push 0x4a273c
mov ecx, 0x4bde08
call fcn.0046a870
add eax, 0xf
lea eax, [esi + eax*2]
push eax
call fcn.0046ffcb
add esp, 0xc
test eax, eax
jne 0x437f67
push 0x4a2750
mov ecx, 0x4bde08
call fcn.0046a870
add eax, 0x17
push eax
jmp 0x437f83
push 0x49c65c
mov ecx, 0x4bde08
call fcn.0046a870
add eax, 0xf
push eax
jmp 0x437f83
push 0x49c6fc
push 0xe
push 0
push edi
push esi
call fcn.004372a0
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046f8ce
mov esp, ebp
pop ebp
ret