Function at 0x43e530
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cbcec
mov eax, dword fs:[0]
push eax
sub esp, 0xd7c
mov eax, dword [0x524ee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0xd84], eax
mov dword [ebp - 0xd64], ecx
call fcn.0043fae0
test al, al
jne 0x43e5df
mov ecx, dword [0x526340]
test ecx, ecx
je 0x43e5df
mov eax, ecx
and eax, 0x80000001
jns 0x43e590
dec eax
or eax, 0xfffffffe
inc eax
jne 0x43e59d
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jmp 0x43e5a4
lea ecx, [ecx*2 + 1]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*2]
sub edx, eax
mov dword [0x526340], ecx
sub edx, 0
je 0x43e5ce
sub edx, 2
je 0x43e5d1
dec edx
je 0x43e5d2
jmp 0x43e5db
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x526340], ecx
test ecx, ecx
jne 0x43e582
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xd70], eax
mov dword [ebp - 4], 0
call fcn.0043fa60
test al, al
jne 0x43e610
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x526340], eax
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.004a9c90
add esp, 0xc
call fcn.0043f940
mov esi, dword [0x526340]
test al, al
jne 0x43e659
mov eax, esi
sub eax, 0
je 0x43e64e
dec eax
je 0x43e64a
inc esi
jmp 0x43e653
xor esi, esi
jmp 0x43e653
mov esi, 2
mov dword [0x526340], esi
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x11
idiv ecx
cmp edx, 3
jne 0x43e6fb
xor edx, edx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, esi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
inc edx
add esi, eax
cmp edx, 0x100
jl 0x43e678
mov dword [0x526340], esi
mov dword [ebp - 0xd80], 0
mov dword [ebp - 0xd7c], 0
mov dword [ebp - 0xd78], 0
mov eax, dword [0x524ab0]
mov ecx, 0x524ab0
mov byte [ebp - 4], 1
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xd68], eax
mov eax, str.SOFTWAREWow6432NodeMicr
mov byte [ebp - 4], 2
test eax, 0xffff0000
jne 0x43e764
movzx esi, ax
push 0
push esi
call fcn.00403b10
add esp, 8
test eax, eax
je 0x43e776
push esi
push eax
lea ecx, [ebp - 0xd68]
call fcn.004074c0
jmp 0x43e776
push 0x19
push str.SOFTWAREWow6432NodeMicr
lea ecx, [ebp - 0xd68]
call fcn.00409670
push 0x17
push str.osoftInternet_Explorer
lea ecx, [ebp - 0xd68]
mov byte [ebp - 4], 3
call fcn.0040b920
mov esi, dword [ebp - 0xd68]
mov ecx, 1
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
or eax, ecx
jge 0x43e7b4
push 0
lea ecx, [ebp - 0xd68]
call fcn.004085d0
mov esi, dword [ebp - 0xd68]
push 1
push esi
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xd80]
call fcn.0040bf00
or edi, 0xffffffff
test eax, eax
jne 0x43ea5f
mov ebx, dword [ebp - 0xd80]
lea eax, [ebp - 0xd6c]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0xd60]
push eax
push 0
push str.svcVersion
push ebx
mov dword [ebp - 0xd6c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43e834
mov eax, dword [ebp - 0xd60]
cmp eax, 1
je 0x43e819
cmp eax, 2
jne 0x43e834
mov eax, dword [ebp - 0xd6c]
test eax, eax
je 0x43e890
test al, 1
jne 0x43e834
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x43e899
mov ecx, dword [ebp - 0xd64]
mov byte [ebp - 0xd59], 0
test cl, 1
je 0x43e86e
mov edx, dword [ebp - 0xd60]
and ecx, 0xfffffffe
add edx, 0xfffffff0
mov dword [ebp - 0xd64], ecx
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43e86e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd59], 0
je 0x43e8cd
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43e880
jmp 0x43ea2b
xor eax, eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xd60]
call fcn.00401ff0
mov eax, dword [eax]
mov ecx, 1
cmp dword [eax - 0xc], 0
mov dword [ebp - 0xd64], ecx
je 0x43e83a
mov byte [ebp - 0xd59], cl
jmp 0x43e841
lea eax, [ebp - 0xd60]
push eax
lea eax, [ebp - 0x810]
push eax
push str.Version
lea ecx, [ebp - 0xd80]
mov dword [ebp - 0xd60], 0x400
call fcn.004329f0
mov dword [ebp - 0xd74], eax
call fcn.0043fa60
test al, al
jne 0x43e9a2
xor ecx, ecx
mov dword [ebp - 0xd6c], ecx
lea esi, [ebp - 0xd58]
jmp 0x43e920
xor eax, eax
mov dword [ebp - 0xd60], eax
jmp 0x43e930
mov edi, dword [0x526340]
inc eax
mov dword [ebp - 0xd88], eax
mov eax, edi
cdq
inc ecx
idiv ecx
mov eax, edi
mov ecx, edi
mov edi, dword [ebp - 0xd88]
sub ecx, dword [ebp - 0xd6c]
mov ebx, edx
cdq
imul ebx, ecx
idiv edi
add ebx, eax
sub ebx, dword [ebp - 0xd60]
push ebx
push 0x4dfc48
call fcn.004aa80e
mov ecx, dword [ebp - 0xd6c]
mov eax, edi
add esp, 8
add esi, 4
mov dword [ebp - 0xd60], edi
cmp eax, 0x1a
jl 0x43e930
inc ecx
mov dword [ebp - 0xd6c], ecx
cmp ecx, 0xd
jl 0x43e920
mov esi, dword [ebp - 0xd68]
mov ebx, dword [ebp - 0xd80]
or edi, 0xffffffff
cmp dword [ebp - 0xd74], 0
jne 0x43e9d7
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xd74]
call fcn.00401ff0
mov ecx, dword [ebp - 0xd64]
mov eax, dword [eax]
or ecx, 2
cmp dword [eax - 0xc], 0
je 0x43e9dd
mov byte [ebp - 0xd59], 1
jmp 0x43e9e4
mov ecx, dword [ebp - 0xd64]
mov byte [ebp - 0xd59], 0
test cl, 2
je 0x43ea08
mov edx, dword [ebp - 0xd74]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43ea08
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd59], 0
je 0x43ea42
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43ea20
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xd70]
call fcn.00409670
test ebx, ebx
je 0x43ea55
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0xd80], ebx
mov dword [ebp - 0xd7c], 0
mov edi, dword [ebp - 0xd70]
add edi, 0xfffffff0
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x43ea8b
cmp ecx, dword [edi]
jne 0x43ea8b
mov ebx, edi
mov ecx, 1
lock xadd dword [eax], ecx
jmp 0x43eac8
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov ebx, eax
test ebx, ebx
jne 0x43ea9f
call fcn.00409970
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.004a98f5
add esp, 0x10
mov ecx, dword [ebp - 0xd84]
lea eax, [ebx + 0x10]
add esi, 0xfffffff0
mov dword [ecx], eax
or ebx, 0xffffffff
mov byte [ebp - 4], 1
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43eaf3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xd80]
test eax, eax
je 0x43eb04
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x43eb1f
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0xd84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a8b24
mov esp, ebp
pop ebp
ret