Function at 0x43b3a3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x56dc
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
mov ebx, ecx
lea eax, [ebp - 0x2000]
pop ecx
push 0x3d0
mov esi, str.SECURITYPolicySecrets
mov dword [ebp - 0x56cc], ebx
lea edi, [ebp - 0x2018]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0x56d8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x2018]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43b416
xor eax, eax
jmp 0x43be26
xor ecx, ecx
lea eax, [ebp - 0x56d4]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x7d8]
mov dword [ebp - 0x56dc], ecx
push eax
mov edi, 0x3e8
push ecx
jmp 0x43bdfd
lea eax, [ebp - 0x7d8]
push eax
lea eax, [ebp - 0x2018]
push eax
push str._s_sCurrVal
lea eax, [ebp - 0x56c8]
push edi
push eax
call fcn.00402e0a
add esp, 0x14
mov dword [ebp - 0x56d0], 0x2710
lea eax, [ebp - 0x56d0]
lea edx, [ebp - 0x56c8]
push eax
lea eax, [ebp - 0x52e0]
push eax
call fcn.004c7bc9
pop ecx
pop ecx
test eax, eax
je 0x43bddb
mov esi, dword [ebp - 0x56d0]
mov edx, 0x3dd
lea eax, [esi - 1]
cmp eax, edx
ja 0x43bddb
mov ecx, dword [ebp - 0x52e0]
lea eax, [ecx - 1]
cmp eax, edx
ja 0x43bddb
lea eax, [esi - 0x10]
cmp ecx, eax
ja 0x43bddb
lea eax, [ebp - 0x7d8]
push str.DPAPI_SYSTEM
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
jne 0x43b559
cmp esi, 0x3c
jb 0x43bddb
push 0x64
lea eax, [ebp - 0x840]
push eax
push 0x14
pop edx
lea ecx, [ebp - 0x52cc]
call fcn.0040452e
push 0x64
lea eax, [ebp - 0x8a8]
push eax
push 0x14
pop edx
lea ecx, [ebp - 0x52b8]
call fcn.0040452e
add esp, 0x10
lea eax, [ebp - 0x840]
mov esi, 0x6c5bb9
mov ecx, ebx
push 0xffffffffffffffff
push esi
push eax
push str.Machine_Key
push str.DPAPI_SYSTEM
push esi
push 0x1fe
push 0xc
call fcn.0043ee6b
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x8a8]
push eax
push str.User_Key
push str.DPAPI_SYSTEM
push esi
push 0x1fe
jmp 0x43bd9f
lea eax, [ebp - 0x7d8]
push str.NL_KM
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
jne 0x43b5b1
mov edx, dword [ebp - 0x52e0]
lea eax, [ebp - 0x3f0]
push edi
push eax
lea ecx, [ebp - 0x52d0]
call fcn.0040452e
pop ecx
pop ecx
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x3f0]
push esi
push eax
push str.Encryption_Key
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x1ff
jmp 0x43bd9f
lea eax, [ebp - 0x7d8]
push str.DefaultPassword
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
jne 0x43b637
xor ecx, ecx
lea eax, [ebp - 0x3f0]
push ecx
push ecx
push edi
push eax
mov eax, dword [ebp - 0x52e0]
shr eax, 1
push eax
lea eax, [ebp - 0x52d0]
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x52e0]
shr eax, 1
cmp eax, edi
jae 0x43be35
lea ecx, [ebp - 0xc90]
mov byte [ebp + eax - 0x3f0], 0
call fcn.00405b2d
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x3f0]
push esi
push eax
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x200
jmp 0x43bd9f
mov esi, str._SC_
push esi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x7d8]
push esi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
jne 0x43b6fc
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x1c30]
push edi
push eax
call fcn.006494f3
movsx eax, byte [ebp - 0x1c30]
add esp, 0xc
push eax
call fcn.006509c7
lea edx, [ebp - 0xc90]
mov byte [ebp - 0x1c30], al
lea ecx, [ebp - 0x1c30]
call fcn.00405811
pop ecx
xor ecx, ecx
lea eax, [ebp - 0x3f0]
push ecx
push ecx
push edi
push eax
mov eax, dword [ebp - 0x52e0]
shr eax, 1
push eax
lea eax, [ebp - 0x52d0]
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x52e0]
shr eax, 1
cmp eax, edi
jae 0x43be35
push 0xffffffffffffffff
mov byte [ebp + eax - 0x3f0], 0
mov esi, 0x6c5bb9
push esi
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0x1c30]
push eax
push esi
push 0x201
jmp 0x43bd9f
mov esi, str.ASPNET_WP_PASSWORD
push esi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x7d8]
push esi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
jne 0x43b77f
xor ecx, ecx
lea eax, [ebp - 0x3f0]
push ecx
push ecx
push edi
push eax
mov eax, dword [ebp - 0x52e0]
shr eax, 1
push eax
lea eax, [ebp - 0x52d0]
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x52e0]
shr eax, 1
cmp eax, edi
jae 0x43be35
push 0xffffffffffffffff
mov esi, 0x6c5bb9
mov byte [ebp + eax - 0x3f0], 0
push esi
lea eax, [ebp - 0x3f0]
push eax
push str.ASPNET
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x202
jmp 0x43bd9f
mov esi, str.RasDialParams
push esi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x7d8]
push esi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
jne 0x43b93b
xor ecx, ecx
lea eax, [ebp - 0x3f0]
push ecx
push ecx
push edi
push eax
mov eax, dword [ebp - 0x52e0]
shr eax, 1
push eax
lea eax, [ebp - 0x52d0]
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x52e0]
shr eax, 1
cmp eax, edi
jae 0x43be35
xor ecx, ecx
mov byte [ebp + eax - 0x3f0], cl
mov edi, ecx
sub eax, 1
mov byte [ebp - 0x1460], cl
mov esi, ecx
mov dword [ebp - 0x56d0], eax
mov byte [ebp - 0x1078], cl
mov ebx, ecx
mov byte [ebp - 0xc90], cl
je 0x43bdd0
mov al, byte [ebp + ebx - 0x3f0]
test al, al
je 0x43b820
mov byte [ebp + esi - 0x1460], al
inc esi
jmp 0x43b8dd
inc edi
mov eax, edi
sub eax, 1
je 0x43b87d
sub eax, 5
je 0x43b84e
sub eax, 1
jne 0x43b890
mov edx, 0x3e8
cmp esi, edx
jae 0x43be35
lea eax, [ebp - 0x1460]
push eax
lea eax, [ebp - 0x1078]
jmp 0x43b868
mov edx, 0x3e8
cmp esi, edx
jae 0x43be35
lea eax, [ebp - 0x1460]
push eax
lea eax, [ebp - 0xc90]
push edx
push eax
mov byte [ebp + esi - 0x1460], cl
call fcn.006494f3
add esp, 0xc
xor ecx, ecx
jmp 0x43b890
cmp esi, 0x3e8
jae 0x43be35
mov byte [ebp + esi - 0x1460], cl
mov byte [ebp - 0x1460], cl
mov esi, ecx
cmp edi, 9
jne 0x43b8dd
push 0xffffffffffffffff
mov edi, ecx
lea eax, [ebp - 0x1078]
mov ecx, 0x6c5bb9
push ecx
push eax
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0x7d8]
push eax
push ecx
mov ecx, dword [ebp - 0x56cc]
push 0x203
push 0xc
call fcn.0043ee6b
xor ecx, ecx
mov byte [ebp - 0x1078], cl
mov byte [ebp - 0xc90], cl
inc ebx
cmp ebx, dword [ebp - 0x56d0]
jb 0x43b808
cmp byte [ebp - 0xc90], 0
je 0x43bdd0
cmp byte [ebp - 0x1078], 0
mov ebx, dword [ebp - 0x56cc]
je 0x43bdd6
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x1078]
push esi
push eax
lea eax, [ebp - 0xc90]
mov ecx, ebx
push eax
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x203
push 0xc
call fcn.0043ee6b
jmp 0x43bdd6
lea eax, [ebp - 0x7d8]
push str._MACHINE.ACC
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
jne 0x43bac9
push ecx
lea eax, [ebp - 0x1848]
push eax
push ecx
lea edx, [ebp - 0xc90]
call fcn.004058c3
add esp, 0xc
test eax, eax
je 0x43b9b7
lea eax, [ebp - 0x1848]
push eax
call fcn.00643470
test eax, eax
lea eax, [ebp - 0xc90]
pop ecx
push eax
je 0x43b9a7
lea eax, [ebp - 0x1848]
push eax
push 0x6c6058
lea eax, [ebp - 0x2bd0]
push edi
push eax
call fcn.00402e0a
add esp, 0x14
jmp 0x43b9b7
lea eax, [ebp - 0x2bd0]
push edi
push eax
call fcn.006494f3
add esp, 0xc
push edi
lea eax, [ebp - 0x2400]
mov ecx, 0x8002
push eax
push dword [ebp - 0x52e0]
lea edx, [ebp - 0x52d0]
call fcn.004c6ebf
add esp, 0xc
test eax, eax
je 0x43ba41
push edi
lea eax, [ebp - 0x3f0]
push eax
push 0x10
pop edx
lea ecx, [ebp - 0x2400]
call fcn.0040452e
lea eax, [ebp - 0x3f0]
push eax
push str._NTLM_HASH_
push str._s__s
lea eax, [ebp - 0x1078]
push edi
push eax
call fcn.00402e0a
add esp, 0x1c
lea eax, [ebp - 0x1078]
mov esi, 0x6c5bb9
mov ecx, ebx
push 0xffffffffffffffff
push esi
push eax
lea eax, [ebp - 0x2bd0]
push eax
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x204
push 0xc
call fcn.0043ee6b
jmp 0x43ba46
mov esi, 0x6c5bb9
push edi
lea eax, [ebp - 0x2400]
mov ecx, 0x8004
push eax
push dword [ebp - 0x52e0]
lea edx, [ebp - 0x52d0]
call fcn.004c6ebf
add esp, 0xc
test eax, eax
je 0x43bddb
push edi
lea eax, [ebp - 0x3f0]
push eax
push 0x14
pop edx
lea ecx, [ebp - 0x2400]
call fcn.0040452e
lea eax, [ebp - 0x3f0]
push eax
push str._SHA1_HASH_
push str._s__s
lea eax, [ebp - 0x1078]
push edi
push eax
call fcn.00402e0a
add esp, 0x1c
lea eax, [ebp - 0x1078]
push 0xffffffffffffffff
push esi
push eax
lea eax, [ebp - 0x2bd0]
push eax
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x204
jmp 0x43bd9f
mov esi, str.M__MSV1_0_TBAL_PRIMARY_
push esi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x7d8]
push esi
push eax
call fcn.0065106c
add esp, 0xc
test eax, eax
jne 0x43bd42
mov ax, word [ebp - 0x526c]
xor edx, edx
mov byte [ebp - 0x1848], dl
mov byte [ebp - 0xc90], dl
test ax, ax
je 0x43bb4a
push edx
push edx
push edi
movzx eax, ax
lea ecx, [ebp - 0xc90]
push ecx
shr eax, 1
lea ecx, [ebp - 0x52d0]
push eax
mov eax, dword [ebp - 0x5270]
lea eax, [ecx + eax*2]
push eax
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movzx eax, word [ebp - 0x526c]
shr eax, 1
cmp eax, edi
jae 0x43be35
xor edx, edx
mov byte [ebp + eax - 0xc90], dl
mov ax, word [ebp - 0x5274]
test ax, ax
je 0x43bbbc
push edx
push edx
push edi
movzx eax, ax
lea ecx, [ebp - 0x1848]
push ecx
shr eax, 1
lea ecx, [ebp - 0x52d0]
push eax
mov eax, dword [ebp - 0x5278]
lea eax, [ecx + eax*2]
push eax
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movzx eax, word [ebp - 0x5274]
shr eax, 1
cmp eax, edi
jae 0x43be35
mov byte [ebp + eax - 0x1848], 0
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0x1848]
push eax
push 0x6c643c
lea eax, [ebp - 0x2bd0]
push edi
push eax
call fcn.00402e0a
add esp, 0x14
jmp 0x43bbd3
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0x2bd0]
push edi
push eax
call fcn.006494f3
add esp, 0xc
mov al, byte [ebp - 0x52c8]
test al, 1
je 0x43bc48
push edi
lea eax, [ebp - 0x3f0]
push eax
push 0x10
pop edx
lea ecx, [ebp - 0x52c0]
call fcn.0040452e
lea eax, [ebp - 0x3f0]
push eax
push str._NTLM_HASH_
push str._s__s
lea eax, [ebp - 0x1078]
push edi
push eax
call fcn.00402e0a
add esp, 0x1c
lea eax, [ebp - 0x1078]
mov esi, 0x6c5bb9
mov ecx, ebx
push 0xffffffffffffffff
push esi
push eax
lea eax, [ebp - 0x2bd0]
push eax
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x205
push 0xc
call fcn.0043ee6b
mov al, byte [ebp - 0x52c8]
jmp 0x43bc4d
mov esi, 0x6c5bb9
test al, 2
je 0x43bcb5
push edi
lea eax, [ebp - 0x3f0]
push eax
push 0x10
pop edx
lea ecx, [ebp - 0x52b0]
call fcn.0040452e
lea eax, [ebp - 0x3f0]
push eax
push str._LM_HASH_
push str._s__s
lea eax, [ebp - 0x1078]
push edi
push eax
call fcn.00402e0a
add esp, 0x1c
lea eax, [ebp - 0x1078]
mov ecx, ebx
push 0xffffffffffffffff
push esi
push eax
lea eax, [ebp - 0x2bd0]
push eax
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x205
push 0xc
call fcn.0043ee6b
mov al, byte [ebp - 0x52c8]
test al, 4
je 0x43bd1d
push edi
lea eax, [ebp - 0x3f0]
push eax
push 0x14
pop edx
lea ecx, [ebp - 0x52a0]
call fcn.0040452e
lea eax, [ebp - 0x3f0]
push eax
push str._SHA1_HASH_
push str._s__s
lea eax, [ebp - 0x1078]
push edi
push eax
call fcn.00402e0a
add esp, 0x1c
lea eax, [ebp - 0x1078]
mov ecx, ebx
push 0xffffffffffffffff
push esi
push eax
lea eax, [ebp - 0x2bd0]
push eax
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x205
push 0xc
call fcn.0043ee6b
mov al, byte [ebp - 0x52c8]
test al, 8
je 0x43bddb
push edi
lea eax, [ebp - 0x3f0]
push eax
push 0x10
pop edx
lea ecx, [ebp - 0x528c]
call fcn.0040452e
pop ecx
pop ecx
jmp 0x43bddb
mov esi, str.M__CLOUDAP_TBAL_
push esi
call fcn.00643470
pop ecx
push eax
lea eax, [ebp - 0x7d8]
push esi
push eax
call fcn.0065106c
mov edx, dword [ebp - 0x52e0]
lea ecx, [ebp - 0x52d0]
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x3f0]
push edi
push eax
jne 0x43bdaa
call fcn.0040452e
pop ecx
pop ecx
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x3f0]
push esi
push eax
push str.Encryption_Key
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x206
push 0xc
mov ecx, ebx
call fcn.0043ee6b
jmp 0x43bddb
call fcn.0040452e
pop ecx
pop ecx
push 0xffffffffffffffff
mov esi, 0x6c5bb9
lea eax, [ebp - 0x3f0]
push esi
push eax
push esi
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x1fd
jmp 0x43bd9f
mov ebx, dword [ebp - 0x56cc]
mov edi, 0x3e8
mov eax, dword [ebp - 0x56dc]
inc eax
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x56d4]
mov dword [ebp - 0x56dc], eax
push ecx
lea ecx, [ebp - 0x7d8]
push ecx
push eax
push dword [ebp - 0x56d8]
mov dword [ebp - 0x56d4], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x43b43b
push dword [ebp - 0x56d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
call fcn.00612782
int3