Function at 0x431f1b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2f0
mov eax, dword [0x4a0cb8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x2c4], eax
push 1
xor ebx, ebx
push ecx
mov byte [edi], bl
lea ecx, [ebp - 0x2bc]
mov byte [eax], bl
call fcn.0042d342
cmp dword [ebp - 0x220], ebx
je 0x45717d
mov esi, 0xc8
lea eax, [ebp - 0x124]
push esi
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x2cc], esi
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x2c0], 1
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x2c0]
push eax
push 0x407730
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
mov esi, eax
test esi, esi
jne 0x4571d3
cmp dword [ebp - 0x2c0], 1
jne 0x45720d
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x2ec]
push eax
lea edx, [ebp - 0x2e8]
lea ecx, [ebp - 0x124]
call fcn.00433b96
mov dword [ebp - 0x2dc], eax
test eax, eax
js 0x45718f
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x20
push eax
push 0x407704
push 1
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetNLSVersionEx]
test eax, eax
je 0x45722d
cmp dword [ebp - 0x2e8], 6
jne 0x4320c3
mov eax, dword [ebp - 0x2ec]
cmp eax, dword [ebp - 0x218]
jne 0x4320c3
push 0x10
mov esi, 0x408f24
lea eax, [ebp - 0x1fc]
push esi
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x432072
push 0x10
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x1fc]
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4320c3
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x2c8], eax
ja 0x4320c3
mov ecx, dword [ebp - 0x2c4]
mov byte [ecx], 1
jb 0x43211e
push 0x10
lea eax, [ebp - 0x1fc]
push esi
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x43211e
lea ecx, [ebp - 0x2bc]
call fcn.0042535f
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b590
leave
ret 4
xor eax, eax
mov word [ebp - 0x1ec], ax
mov word [ebp - 0x5c], ax
lea eax, [ebp - 0x5c]
push 0x28
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x214]
lea eax, [ebp - 0x1ec]
push dword [ebp - 0x218]
push 6
push 0x40dfa0
push 0x64
push eax
call fcn.0041d6f4
add esp, 0x1c
lea edx, [ebp - 0x1ec]
lea ecx, [ebp - 0x124]
call fcn.0046f78f
jmp 0x4320a5
mov byte [edi], 1
jmp 0x4320a5
mov ecx, dword [ebp + 4]
push 0x40a488
push 0x52
pop edx
call fcn.00469ce1
jmp 0x4571be
mov ecx, dword [ebp + 4]
push eax
push 0x40a488
push 0x74
pop edx
call fcn.0045e47c
lea edx, [ebp - 0x2dc]
mov byte [edi], 1
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0x2e0], 3
call fcn.0046f7ff
lea ecx, [ebp - 0x2bc]
call fcn.0042535f
mov eax, 0x80004005
jmp 0x4320b2
jg 0x4571d9
mov ecx, esi
jmp 0x4571e2
movzx ecx, si
or ecx, 0x80070000
mov dword [ebp - 0x2d0], ecx
lea edx, [ebp - 0x2d0]
lea ecx, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 1
call fcn.0046f7ff
cmp esi, 2
jne 0x4571be
mov byte [edi], 1
jmp 0x4571be
lea edx, [ebp - 0x2c0]
mov byte [edi], 1
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 2
call fcn.0046f7ff
jmp 0x4571be
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x45723f
movzx eax, ax
or eax, 0x80070000
lea edx, [ebp - 0x2e4]
mov dword [ebp - 0x2e4], eax
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], 4
call fcn.0046f7ff
mov ebx, 0x80004005
jmp 0x4320a5