Function at 0x43e110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cbc93
mov eax, dword fs:[0]
push eax
sub esp, 0xce4
mov eax, dword [0x524ee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xcd4], 0
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
mov dword [ebp - 4], 0
mov dword [ebp - 0xcdc], esi
mov dword [ebp - 0xcf0], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
mov ebx, 1
push eax
mov dword [ebp - 0xcd4], ebx
call fcn.004a9c90
add esp, 0xc
mov dword [ebp - 0xcd0], 0x400
mov dword [ebp - 0xce8], 0
mov dword [ebp - 0xce4], 0
mov dword [ebp - 0xce0], 0
push ebx
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xce8]
mov dword [ebp - 4], ebx
call fcn.0040bf00
test eax, eax
jne 0x43e4f6
push str.svcVe
lea ecx, [ebp - 0xcd8]
call fcn.00401ff0
push str.rsion
push eax
lea eax, [ebp - 0xcec]
push eax
mov byte [ebp - 4], 2
call fcn.0040b6c0
add esp, 0xc
lea ecx, [ebp - 0xcd0]
push ecx
lea ecx, [ebp - 0x810]
push ecx
push dword [eax]
lea ecx, [ebp - 0xce8]
call fcn.004329f0
mov esi, dword [ebp - 0xcec]
add esi, 0xfffffff0
mov edi, eax
lea edx, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43e248
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xcd8]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43e26c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x43e29b
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xcd8]
call fcn.00401ff0
mov eax, dword [eax]
mov ebx, 3
mov dword [ebp - 0xcd4], ebx
mov byte [ebp - 0xcc9], 1
cmp dword [eax - 0xc], edi
jne 0x43e2a2
mov byte [ebp - 0xcc9], 0
or edi, 0xffffffff
test bl, 2
je 0x43e2d2
mov edx, dword [ebp - 0xcd8]
add edx, 0xfffffff0
and ebx, 0xfffffffd
mov dword [ebp - 0xcd4], ebx
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43e2d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xcc9], 0
je 0x43e30d
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43e2e4
mov esi, dword [ebp - 0xcdc]
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
mov ecx, esi
call fcn.00409670
jmp 0x43e4f6
call fcn.0043fa10
test al, al
jne 0x43e388
xor esi, esi
call fcn.004a96f9
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0xcd0], xmm0
cmp esi, 0x97
jb 0x43e318
xor ecx, ecx
lea esp, [esp]
mov eax, 0x96
cmp ecx, eax
jge 0x43e37f
lea esp, [esp]
movsd xmm0, qword [ebp + eax*8 - 0xcc8]
movsd xmm1, qword [ebp + eax*8 - 0xcd0]
comisd xmm0, xmm1
jbe 0x43e37a
movsd qword [ebp + eax*8 - 0xcc8], xmm1
movsd qword [ebp + eax*8 - 0xcd0], xmm0
dec eax
cmp eax, ecx
jg 0x43e350
inc ecx
cmp ecx, 0x97
jl 0x43e340
lea eax, [ebp - 0xcd0]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0xcd8]
push eax
push 0
push str.Version
push dword [ebp - 0xce8]
mov dword [ebp - 0xcd0], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43e496
mov eax, dword [ebp - 0xcd8]
cmp eax, 1
je 0x43e3d6
cmp eax, 2
jne 0x43e496
mov eax, dword [ebp - 0xcd0]
test eax, eax
je 0x43e3fa
test al, 1
jne 0x43e496
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x43e403
jmp 0x43e496
xor eax, eax
mov word [ebp - 0x810], ax
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xcd0], eax
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 3
test eax, 0xffff0000
jne 0x43e44b
movzx esi, ax
push 0
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x43e476
push esi
push eax
lea ecx, [ebp - 0xcd0]
call fcn.004074c0
jmp 0x43e476
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43e454
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xcd0]
call fcn.00409670
mov eax, dword [ebp - 0xcd0]
or ebx, 4
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0xcd4], ebx
mov byte [ebp - 0xcc9], 1
jne 0x43e49d
mov byte [ebp - 0xcc9], 0
test bl, 4
je 0x43e4c8
mov edx, dword [ebp - 0xcd0]
add edx, 0xfffffff0
and ebx, 0xfffffffb
mov dword [ebp - 0xcd4], ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x43e4c8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xcc9], 0
je 0x43e4f0
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43e4e0
jmp 0x43e2ef
mov esi, dword [ebp - 0xcdc]
mov eax, dword [ebp - 0xce8]
test eax, eax
je 0x43e507
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8b24
mov esp, ebp
pop ebp
ret