Function at 0x436f2d
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push esi
push edi
push eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x28], ebx
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
call fcn.00436e37
mov edi, dword [ebp - 0x24]
cmp dword [ebp - 0x18], ebx
je 0x43728e
cmp dword [ebp - 0x10], ebx
je 0x43728e
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 3
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x43728e
cmp dword [ebp + 0x10], ebx
je 0x4372ff
test edi, edi
jne 0x436fd1
cmp dword [ebp - 0x14], ebx
jne 0x436fd1
push 2
pop eax
push eax
push 0x4015c0
jmp 0x4370a9
mov ebx, dword [ebp - 0xc]
shr ebx, 1
not ebx
and ebx, 1
jne 0x436ff4
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x436ff4
inc ebx
test ebx, ebx
je 0x437283
mov eax, 0x10003
cmp dword [ebp - 0xc], eax
ja 0x437060
je 0x437027
mov eax, dword [ebp - 0xc]
sub eax, 1
je 0x437048
push 2
pop ecx
sub eax, ecx
je 0x437048
sub eax, 5
je 0x4370b0
sub eax, 0xfff9
jne 0x437080
test edi, edi
je 0x437283
mov ecx, edi
call fcn.0041f258
mov dword [ebp - 0x28], eax
xor ebx, ebx
push 4
lea eax, [ebp - 0x28]
push eax
push 4
jmp 0x4372ee
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
je 0x437285
push dword [ebp - 0x20]
push dword [ebp - 0x14]
push 3
jmp 0x4372ee
mov eax, dword [ebp - 0xc]
sub eax, 0x20000
je 0x4372c8
push 2
pop ecx
sub eax, ecx
je 0x4372c8
sub eax, 0x20006
je 0x4370b0
xor ebx, ebx
test edi, edi
je 0x437285
mov ecx, edi
push 2
pop esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x437092
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
jmp 0x4372ee
xor ebx, ebx
test edi, edi
je 0x437285
test dword [ebp - 0xc], 0x40000
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 7
je 0x437200
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x437200
cmp dword [ebp - 0x24], 7
jne 0x437200
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4370fe
mov eax, dword [ebp - 0x20]
sub ecx, edx
sar ecx, 1
shr eax, 1
add eax, 3
add eax, ecx
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0xc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x43713d
push 0xe
pop esi
jmp 0x4371fe
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
xor eax, eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4371ef
cmp ax, word [ebx]
mov edx, ebx
jmp 0x437199
push edi
push edx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4371d0
mov edx, dword [ebp - 0x1c]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x28]
jne 0x43717d
sub ecx, dword [ebp - 0x1c]
xor eax, eax
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
cmp ax, word [edx]
mov dword [ebp - 0x1c], edx
jne 0x437164
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
dec edx
push edi
call fcn.0040c010
test eax, eax
js 0x4371ef
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x28]
jne 0x4371b4
mov eax, dword [ebp - 0x1c]
sub ecx, edx
sar ecx, 1
xor edx, edx
mov word [eax + ecx*2 + 2], dx
jmp 0x4371fa
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x28]
jne 0x4371d5
sub ecx, edx
or eax, 0xffffffff
sar ecx, 1
sub eax, ecx
add dword [ebp - 0xc], eax
jmp 0x4371fa
push ebx
call fcn.00441807
xor eax, eax
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x43725e
xor ebx, ebx
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x437205
sub ecx, edx
sar ecx, 1
push 2
pop edx
lea eax, [ecx + 2]
xor ecx, ecx
mov dword [ebp - 0xc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov ebx, eax
pop ecx
test ebx, ebx
je 0x437283
mov edx, dword [ebp - 0xc]
mov ecx, ebx
push edi
dec edx
call fcn.0040c010
mov ecx, ebx
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x437248
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [ebx + ecx*2 + 2], ax
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
push ebx
push 7
xor eax, eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test ebx, ebx
je 0x437283
push ebx
call fcn.00441807
pop ecx
xor ebx, ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x10], 0
jne 0x4372b3
cmp dword [ebp - 4], 0
jne 0x4372b3
test edi, edi
jne 0x4372b3
cmp dword [ebp - 0x10], edi
je 0x4372b3
cmp dword [ebp - 0x18], edi
je 0x4372b3
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.0042268c
test esi, esi
je 0x437335
cmp dword [ebp + 0x10], 0
jne 0x437312
push 2
pop eax
cmp esi, eax
jne 0x437312
mov esi, ebx
jmp 0x437340
xor ebx, ebx
test edi, edi
je 0x437285
mov ecx, edi
push 2
pop esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x4372d6
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push esi
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x437285
cmp dword [ebp - 4], ebx
je 0x437285
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4372fb
push esi
push 0x409cac
push 2
pop ebx
push ebx
call fcn.0041ea5f
add esp, 0xc
push dword [ebp + 0xc]
push 0x409c78
push ebx
call fcn.0041ea5f
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov eax, 0x40a9f8
jne 0x437345
mov eax, 0x40a95c
push esi
push dword [ebp + 0xc]
push eax
push 0x409ce0
push 4
call fcn.0041ea5f
add esp, 0x14
cmp dword [ebp - 0x14], 0
je 0x437368
push dword [ebp - 0x14]
call fcn.00441835
pop ecx
cmp dword [ebp - 0x10], 0
je 0x437377
push dword [ebp - 0x10]
call fcn.00441807
pop ecx
cmp dword [ebp - 4], 0
je 0x437386
push dword [ebp - 4]
call fcn.00441807
pop ecx
test edi, edi
je 0x437391
push edi
call fcn.00441807
pop ecx
test esi, esi
jle 0x43739e
movzx esi, si
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc