Function at 0x43b532
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x43b538
call fcn.0047f360
push dword [esp + 0x5c]
call fcn.0043d330
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.0043d000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.0043d000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.0043d000
push dword [esp]
call fcn.0043bdfc
push dword [esp + 8]
mov edx, 0x53d1c6
pop ecx
call fcn.0043d2c0
je 0x43b5e5
cmp dword [0x9d7f58], 0
je 0x43b5c9
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x9d7f5c]
or ebx, 0xf003f
push ebx
push 0
push dword [0x9d7f4c]
push dword [0x9d7f54]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x43b5e3
lea eax, [esp + 0x10]
push eax
push dword [0x9d7f4c]
push dword [0x9d7f54]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x43b64a
lea eax, [esp + 0x18]
push eax
push dword [0x9d7f54]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x9d7f58], 0
je 0x43b632
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x9d7f5c]
or ebx, 0xf003f
push ebx
push 0
push dword [0x9d7f4c]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x43b64a
lea eax, [esp + 0x10]
push eax
push dword [0x9d7f4c]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x43b924
mov dword [esp + 0x1c], 0x400
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
push dword [esp + 0x24]
call fcn.0047cca0
lea eax, [esp + 0x24]
push eax
call fcn.0047f260
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x43b924
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x43b72b
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43b718
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0047dcb0
lea eax, [esp + 0x30]
push eax
call fcn.0047f260
jmp 0x43b726
mov edx, 0x53c098
lea ecx, [esp + 0x2c]
call fcn.0043d008
jmp 0x43b923
mov ebx, 2
cmp ebx, dword [esp]
jne 0x43b7a0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43b78d
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0047dcb0
lea eax, [esp + 0x30]
push eax
call fcn.0047f260
jmp 0x43b79b
mov edx, 0x53c098
lea ecx, [esp + 0x2c]
call fcn.0043d008
jmp 0x43b923
mov ebx, 4
cmp ebx, dword [esp]
jne 0x43b812
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43b7ff
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.0047d090
lea eax, [esp + 0x30]
push eax
call fcn.0047f260
jmp 0x43b80d
mov edx, 0x53d254
lea ecx, [esp + 0x2c]
call fcn.0043d008
jmp 0x43b923
mov ebx, 3
cmp ebx, dword [esp]
jne 0x43b923
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.0047e080
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x43b923
mov edx, 0x53c098
lea ecx, [esp + 0x2c]
call fcn.0043d008
mov dword [esp + 0x44], 0
jmp 0x43b87d
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x43b91a
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.0043d2a0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x43b8d7
mov edx, dword [esp + 0x2c]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
mov edx, 0x53d254
push edx
call fcn.0047f200
lea eax, [esp + 0x30]
push eax
call fcn.0047f260
mov edx, dword [esp + 0x2c]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f1c0
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.0047d6b0
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.0047f260
inc dword [esp + 0x44]
jno 0x43b87d
push dword [esp + 0x3c]
call fcn.0047e0a0
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.0047f1c0
pop edx
push eax
push edx
call fcn.0047f200
pop eax
push eax
call fcn.0043d300
pop edx
add eax, edx
jmp 0x43b955
push dword [esp + 8]
call fcn.0047f3c0
push dword [esp + 0x20]
call fcn.0047f3c0
push dword [esp]
call fcn.0047f3c0
push dword [esp + 4]
call fcn.0047f3c0
push dword [esp + 0x28]
call fcn.0047f3c0
add esp, 0x48
pop ebx
ret 0xc