Function at 0x43ab76
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x15c
mov eax, 0x47f836
call fcn.00450819
mov dword [ebp - 0xc4], ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xd0], esi
cmp dword [ecx], ebx
jne 0x43abbc
mov ecx, 0x278
call fcn.0040e97f
mov ecx, dword [ebp - 0xc4]
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 8
jb 0x43abd9
mov eax, dword [edi]
jmp 0x43abdb
mov eax, edi
lea edx, [ebp - 0xc0]
mov byte [ebp - 4], bl
push edx
push ebx
lea edx, [ebp - 0xbc]
push edx
push ebx
push eax
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x43ac82
push 1
push 2
lea ecx, [ebp - 0x168]
call fcn.00409bf5
lea eax, [ebp - 0x168]
mov dword [ebp - 4], 5
push str.RegQueryValueExW_failed_with
push eax
call fcn.0040b812
pop ecx
pop ecx
push ebx
lea ecx, [ebp - 0x168]
call fcn.0040a503
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x168]
call fcn.00408d5d
movzx eax, bx
push ecx
or eax, 0x80070000
mov byte [ebp - 4], 6
test ebx, ebx
push 0x28b
push str.srcwindows_registry.cpp
cmovle eax, ebx
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0040e55c
push 0x4b4724
lea eax, [ebp - 0xa8]
push eax
call fcn.00452ffc
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xb8]
call fcn.0040cf65
mov dword [ebp - 4], 0xd
mov eax, dword [ebp - 0xc0]
test eax, eax
je 0x43ad53
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0xb8]
mov byte [ebp - 4], 0x11
cmp dword [edi + 0x14], 8
jb 0x43acbe
mov edi, dword [edi]
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 0xd
push ecx
push eax
lea eax, [ebp - 0xbc]
xor ebx, ebx
push eax
mov eax, dword [ebp - 0xc4]
push ebx
push edi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x43ad4b
push 1
push 2
lea ecx, [ebp - 0x168]
call fcn.00409bf5
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 0x15
push str.RegQueryValueExW_failed_with
push eax
call fcn.0040b812
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0x168]
call fcn.0040a503
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x168]
call fcn.00408d5d
movzx eax, di
push ecx
or eax, 0x80070000
mov byte [ebp - 4], 0x16
test edi, edi
push 0x29f
push str.srcwindows_registry.cpp
cmovle eax, edi
jmp 0x43ac61
mov eax, dword [ebp - 0xc0]
jmp 0x43ad55
xor ebx, ebx
push eax
lea ecx, [ebp - 0xb8]
call fcn.00427c5a
push dword [ebp - 0xbc]
mov ecx, esi
call fcn.00439fb2
mov eax, dword [ebp - 0xbc]
xor edx, edx
inc edx
mov dword [ebp - 0xc8], edx
cmp eax, 0xb
ja case.default.0x43ad8d
movzx eax, byte [eax + 0x43b172]
jmp dword [eax*4 + 0x43b15a]
mov eax, dword [ebp - 0xb4]
mov ecx, eax
sub ecx, dword [ebp - 0xb8]
and ecx, edx
je 0x43adba
sub eax, dword [ebp - 0xb8]
sub eax, ecx
lea ecx, [ebp - 0xb8]
push eax
call fcn.00427c5a
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xb4]
mov byte [ebp - 4], 0xd
sete al
test al, al
jne case.0x43ad8d.0
mov edi, dword [ebp - 0xb4]
lea ecx, [ebp - 0xb8]
sub edi, dword [ebp - 0xb8]
lea eax, [edi - 1]
push eax
call fcn.0043b229
cmp byte [eax], 0
jne 0x43ae2a
lea eax, [edi - 2]
push eax
lea ecx, [ebp - 0xb8]
call fcn.0043b229
cmp byte [eax], 0
jne 0x43ae2a
mov byte [ebp - 4], 0xd
dec dword [ebp - 0xb4]
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
jmp 0x43ae30
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0xb8]
lea edi, [esi + 0x10]
shr eax, 1
mov ecx, edi
push ebx
push eax
call fcn.0040d0bd
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0xb8]
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0xb8]
mov byte [ebp - 4], 0x32
mov byte [ebp - 4], 0x31
mov edx, dword [esi + 0x20]
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0x35
cmp dword [edi + 0x14], 8
jb 0x43ae75
mov edi, dword [edi]
mov byte [ebp - 4], 0xd
test eax, eax
je case.0x43ad8d.0
push eax
push ecx
add edx, edx
mov ecx, edi
jmp 0x43b0da
mov eax, dword [ebp - 0xb4]
mov ecx, eax
sub ecx, dword [ebp - 0xb8]
and ecx, edx
je 0x43aeb2
sub eax, dword [ebp - 0xb8]
sub eax, ecx
lea ecx, [ebp - 0xb8]
push eax
call fcn.00427c5a
mov byte [ebp - 4], 0x3b
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xb4]
mov byte [ebp - 4], 0xd
sete al
test al, al
jne case.0x43ad8d.0
lea eax, [ebp - 0xa9]
mov byte [ebp - 0xa9], bl
push eax
lea ecx, [ebp - 0xb8]
call fcn.0043b25a
lea eax, [ebp - 0xa9]
mov byte [ebp - 0xa9], bl
push eax
lea ecx, [ebp - 0xb8]
call fcn.0043b25a
lea eax, [ebp - 0xa9]
mov byte [ebp - 0xa9], bl
push eax
lea ecx, [ebp - 0xb8]
call fcn.0043b25a
lea eax, [ebp - 0xa9]
mov byte [ebp - 0xa9], bl
push eax
lea ecx, [ebp - 0xb8]
call fcn.0043b25a
mov byte [ebp - 4], 0xd
mov edi, dword [ebp - 0xb8]
cmp word [edi], bx
je case.0x43ad8d.0
lea ebx, [esi + 0x28]
xor esi, esi
push edi
lea ecx, [ebp - 0x28]
call fcn.0040724b
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x3f
push eax
mov ecx, ebx
call fcn.0040e399
push esi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x40
call fcn.0040732e
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0xb8]
push eax
push edi
call fcn.004631af
pop ecx
pop ecx
lea edi, [edi + eax*2]
add edi, 2
cmp word [edi], si
jne 0x43af49
mov esi, dword [ebp - 0xcc]
jmp case.0x43ad8d.0
lea eax, [ebp - 0xb8]
push eax
lea ecx, [esi + 0x34]
call fcn.0043b17e
jmp case.0x43ad8d.0
mov edi, dword [ebp - 0xb4]
sub edi, dword [ebp - 0xb8]
cmp edi, 4
je 0x43b033
push edx
push 2
lea ecx, [ebp - 0x168]
call fcn.00409bf5
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 0x46
push str.Invalid_DWORD_size:
push eax
call fcn.0040b812
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0x168]
call fcn.0040a427
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x168]
call fcn.00408d5d
push 1
mov byte [ebp - 4], 0x47
push 0x305
push str.srcwindows_registry.cpp
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0040e6dc
push 0x4b47f0
lea eax, [ebp - 0xa8]
jmp 0x43ac7c
push 4
mov byte [ebp - 4], 0xd
lea edi, [esi + 4]
push dword [ebp - 0xb8]
mov ecx, edi
push 4
pop edx
call fcn.00439f3f
cmp dword [ebp - 0xbc], 5
pop ecx
pop ecx
jne case.0x43ad8d.0
push dword [edi]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [edi], eax
jmp case.0x43ad8d.0
mov edi, dword [ebp - 0xb4]
sub edi, dword [ebp - 0xb8]
cmp edi, 8
je 0x43b0c8
push edx
push 2
lea ecx, [ebp - 0x168]
call fcn.00409bf5
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 0x52
push str.Invalid_QWORD_size:
push eax
call fcn.0040b812
pop ecx
pop ecx
push edi
lea ecx, [ebp - 0x168]
call fcn.0040a427
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x168]
call fcn.00408d5d
push 1
mov byte [ebp - 4], 0x53
push 0x311
jmp 0x43b00f
push 8
mov byte [ebp - 4], 0xd
lea ecx, [esi + 8]
push dword [ebp - 0xb8]
push 8
pop edx
call fcn.00439f3f
pop ecx
pop ecx
lea ecx, [ebp - 0xb8]
mov dword [ebp - 4], 0x66
call fcn.0040c985
xor eax, eax
mov byte [ebp - 4], al
mov eax, esi
call fcn.004507c3
ret 8
push edx
push 2
lea ecx, [ebp - 0x168]
call fcn.00409bf5
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 0x5e
push str.Invalid_registry_value_type
push eax
call fcn.0040b812
pop ecx
pop ecx
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x168]
call fcn.0040a427
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x168]
call fcn.00408d5d
push 1
mov byte [ebp - 4], 0x5f
push 0x316
jmp 0x43b00f