Function at 0x434712
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x434719
call fcn.0045e790
push 4
call sub.user32.dll_GetSysColor
mov dword [esp], eax
push 0
push 0
call fcn.004584dd
push eax
call sub.user32.dll_GetSystemMenu
mov dword [esp + 4], eax
call sub.user32.dll_CreatePopupMenu
mov dword [esp + 8], eax
call sub.user32.dll_CreatePopupMenu
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 4
cmp dword [esp + 4], 0
je 0x434787
cmp dword [esp + 8], 0
je 0x434787
cmp dword [esp + 0xc], 0
je 0x434787
mov eax, 1
jmp 0x434789
xor eax, eax
and eax, eax
je 0x434c3c
mov ebp, dword [0x473558]
cmp dword [ebp + 0xdc], 0
je 0x4347bf
push 0
mov eax, str.imdisk.cpl
push eax
mov eax, str.Imdisk
push eax
push 0xe0
push dword [esp + 0x14]
call fcn.00411b6e
mov ebp, dword [0x893880]
push dword [ebp + 0x4ac]
push 0x10
push 0
push dword [esp + 0x14]
call sub.user32.dll_AppendMenuW
mov ebp, dword [0x893880]
push dword [ebp + 0x4b0]
push 0x20
push 0
push dword [esp + 0x14]
call sub.user32.dll_AppendMenuW
mov eax, str.WimGAPI
push eax
push 0xd0
push 0
push dword [esp + 0x18]
call sub.user32.dll_AppendMenuW
mov eax, str.wimlib
push eax
push 0xc0
push 0
push dword [esp + 0x18]
call sub.user32.dll_AppendMenuW
mov ebp, dword [0x893880]
push dword [ebp + 0x4b4]
push 0xb0
push 0x400
push 0
push dword [esp + 0x14]
call sub.user32.dll_InsertMenuW
mov ebp, dword [0x893880]
push dword [ebp + 0x470]
push 0xa0
push 0x400
push 0
push dword [esp + 0x14]
call sub.user32.dll_InsertMenuW
mov ebp, dword [0x473514]
cmp dword [ebp], 0
je 0x4348a6
mov ebp, dword [0x893880]
push dword [ebp + 0x474]
push dword [esp + 0x10]
push 0x410
push 0
push dword [esp + 0x14]
call sub.user32.dll_InsertMenuW
mov ebp, dword [0x893880]
push dword [ebp + 0x428]
push dword [esp + 0xc]
push 0x410
push 0
push dword [esp + 0x14]
call sub.user32.dll_InsertMenuW
push 0
mov ebp, dword [0x4734ac]
push dword [ebp + 0x18]
mov ebp, dword [0x4734ac]
push dword [ebp + 0x18]
push 7
mov eax, 0x465b96
push eax
push dword [esp + 0x14]
call fcn.0042b522
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00424986
push 0
mov ebp, dword [0x4734ac]
push dword [ebp + 0x18]
mov ebp, dword [0x4734ac]
push dword [ebp + 0x18]
push 0x48
mov eax, 0x465b96
push eax
push dword [esp + 0x14]
call fcn.0042b522
push eax
push dword [esp + 0x14]
push dword [esp + 0x10]
call fcn.00424986
push edx
call fcn.0045e620
pop edx
push eax
push 0x3eb
mov eax, str.dmdskres.dll
push eax
call fcn.0041182b
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
push dword [esp + 0x14]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x43497c
mov edx, str.DiskMgr
lea ecx, [esp + 0x14]
call fcn.0044e008
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [0x47356c]
mov edx, dword [ebp + 0x14]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str._system32diskmgmt.msc
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00417bc9
call fcn.0044e2f0
and eax, eax
je 0x4349d9
push 0
mov eax, str.dmdskres.dll
push eax
push dword [esp + 0x1c]
push 0x40
push dword [esp + 0x14]
call fcn.00411b6e
mov ebp, dword [0x473558]
cmp dword [ebp + 0xe0], 0
je 0x434a0d
push 0x68
mov eax, 0x46105e
push eax
mov ebp, dword [0x893880]
push dword [ebp + 0x4ec]
push 0xf0
push dword [esp + 0x14]
call fcn.00411b6e
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x46605a
push eax
mov eax, str.regedit.exe
push eax
call fcn.00427c26
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
push dword [esp + 0x14]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x434a4f
mov edx, str.Regedit
lea ecx, [esp + 0x14]
call fcn.0044e008
push 0
mov eax, str.regedit.exe
push eax
push dword [esp + 0x1c]
push 0x30
push dword [esp + 0x14]
call fcn.00411b6e
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x46605a
push eax
mov eax, str.cmd.exe
push eax
call fcn.00427c26
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
push dword [esp + 0x14]
mov edx, 0x46105e
pop ecx
call fcn.0044e300
je 0x434aae
mov edx, str.Command_Prompt
lea ecx, [esp + 0x14]
call fcn.0044e008
mov edx, dword [esp + 0x14]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str._tShiftF10
push edx
call fcn.0045e6f0
lea eax, [esp + 0x18]
push eax
call fcn.0045e660
push 0
mov eax, str.cmd.exe
push eax
push dword [esp + 0x1c]
push 0x50
push dword [esp + 0x14]
call fcn.00411b6e
push 0
push 0
push 0xc00
push 0
push dword [esp + 0x14]
call sub.user32.dll_InsertMenuW
push 0x72
mov eax, 0x46105e
push eax
mov ebp, dword [0x893880]
push dword [ebp + 0x404]
push 0x90
push dword [esp + 0x14]
call fcn.00411b6e
push 0x9a
mov eax, 0x465b96
push eax
mov ebp, dword [0x893880]
push dword [ebp + 0xd0]
push 0x60
push dword [esp + 0x14]
call fcn.00411b6e
push 0x70
mov eax, 0x46105e
push eax
mov ebp, dword [0x893880]
push dword [ebp + 0xd4]
push pe_nt_image_headers32
push dword [esp + 0x14]
call fcn.00411b6e
push 0x6f
mov eax, 0x46105e
push eax
mov ebp, dword [0x893880]
push dword [ebp + 0xd8]
push 0x70
push dword [esp + 0x14]
call fcn.00411b6e
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, str.SYSTEMCURRENTCONTROLSETSERVICESVDSALIGNMENT
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
and ebx, ebx
jne 0x434c08
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0
mov eax, str.LessThan4GB
push eax
push dword [esp + 0x2c]
call sub.advapi32.dll_RegQueryValueExW
push dword [esp + 0x18]
call sub.advapi32.dll_RegCloseKey
mov ebx, dword [esp + 0x1c]
cmp ebx, 0x10000
jne 0x434c29
push 8
push 0x20
push dword [esp + 0xc]
call sub.user32.dll_CheckMenuItem
jmp 0x434c3c
push 8
push 0x10
push dword [esp + 0xc]
call sub.user32.dll_CheckMenuItem
mov ebp, dword [0x473558]
cmp dword [ebp + 0xa0], 0
je 0x434c60
push 8
push 0xc0
push dword [esp + 0xc]
call sub.user32.dll_CheckMenuItem
jmp 0x434c73
push 8
push 0xd0
push dword [esp + 0xc]
call sub.user32.dll_CheckMenuItem
mov eax, dword [esp + 4]
jmp 0x434c7b
push dword [esp + 0x14]
call fcn.0045e7f0
add esp, 0x24
pop ebx
pop ebp
ret