Function at 0x43e915
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x43e91b
call fcn.00489ac0
push dword [esp + 0x5c]
call fcn.004446d0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00444000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00444000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00444000
push dword [esp]
call fcn.00440052
push dword [esp + 8]
mov edx, 0x56146c
pop ecx
call fcn.00444660
je 0x43e9c8
cmp dword [0x1c5328c], 0
je 0x43e9ac
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x1c532a4]
or ebx, 0xf003f
push ebx
push 0
push dword [0x1c5326c]
push dword [0x1c53288]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x43e9c6
lea eax, [esp + 0x10]
push eax
push dword [0x1c5326c]
push dword [0x1c53288]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x43ea2d
lea eax, [esp + 0x18]
push eax
push dword [0x1c53288]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x1c5328c], 0
je 0x43ea15
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x1c532a4]
or ebx, 0xf003f
push ebx
push 0
push dword [0x1c5326c]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x43ea2d
lea eax, [esp + 0x10]
push eax
push dword [0x1c5326c]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x43ed07
mov dword [esp + 0x1c], 0x400
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
push dword [esp + 0x24]
call fcn.00486f00
lea eax, [esp + 0x24]
push eax
call fcn.004899c0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x43ed07
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x43eb0e
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43eafb
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00487830
lea eax, [esp + 0x30]
push eax
call fcn.004899c0
jmp 0x43eb09
mov edx, 0x560098
lea ecx, [esp + 0x2c]
call fcn.00444008
jmp 0x43ed06
mov ebx, 2
cmp ebx, dword [esp]
jne 0x43eb83
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43eb70
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00487830
lea eax, [esp + 0x30]
push eax
call fcn.004899c0
jmp 0x43eb7e
mov edx, 0x560098
lea ecx, [esp + 0x2c]
call fcn.00444008
jmp 0x43ed06
mov ebx, 4
cmp ebx, dword [esp]
jne 0x43ebf5
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43ebe2
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.004872f0
lea eax, [esp + 0x30]
push eax
call fcn.004899c0
jmp 0x43ebf0
mov edx, 0x561530
lea ecx, [esp + 0x2c]
call fcn.00444008
jmp 0x43ed06
mov ebx, 3
cmp ebx, dword [esp]
jne 0x43ed06
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.00488740
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43ed06
mov edx, 0x560098
lea ecx, [esp + 0x2c]
call fcn.00444008
mov dword [esp + 0x44], 0
jmp 0x43ec60
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x43ecfd
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.00444610
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x43ecba
mov edx, dword [esp + 0x2c]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
mov edx, 0x561530
push edx
call fcn.00489960
lea eax, [esp + 0x30]
push eax
call fcn.004899c0
mov edx, dword [esp + 0x2c]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489920
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.00487f40
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004899c0
inc dword [esp + 0x44]
jno 0x43ec60
push dword [esp + 0x3c]
call fcn.00488760
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.00489920
pop edx
push eax
push edx
call fcn.00489960
pop eax
push eax
call fcn.004446a0
pop edx
add eax, edx
jmp 0x43ed38
push dword [esp + 8]
call fcn.00489b20
push dword [esp + 0x20]
call fcn.00489b20
push dword [esp]
call fcn.00489b20
push dword [esp + 4]
call fcn.00489b20
push dword [esp + 0x28]
call fcn.00489b20
add esp, 0x48
pop ebx
ret 0xc