Function at 0x431720
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push 0x502e28
push reloc.ACLUI.dll_CreateSecurityPage
call ebx
mov esi, eax
test esi, esi
jne 0x43181e
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x502ec4
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43181e
push 0x501a00
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004d6277
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x20c]
push eax
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x43187c
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x43187c
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push 0x502ed4
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x431874
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4319ea
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431885
sub ecx, edx
mov edx, edi
sar ecx, 1
lea esi, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4318a0
sub edx, esi
sar edx, 1
lea esi, [edx + 6]
add esi, ecx
mov dword [ebp - 0x218], esi
lea eax, [esi + esi]
push eax
call fcn.004c8c9a
add esp, 4
lea ecx, [ebp - 0x20c]
cmp word [ebp - 0x20c], 0x22
mov ebx, eax
mov dword [ebp - 0x224], ecx
jne 0x4318f1
lea ecx, [ebp - 0x20a]
mov eax, 0x22
mov dword [ebp - 0x224], ecx
jmp 0x4318f6
mov eax, 0x20
push eax
push ecx
call fcn.004c55d8
add esp, 8
mov dword [ebp - 0x220], eax
test eax, eax
je 0x431918
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x220], eax
cmp byte [ebp + 0xc], 0
je 0x4319ac
lea eax, [ebp - 0x20c]
push 0x502f04
push eax
call fcn.004c5729
add esp, 8
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x43199a
mov esi, eax
mov eax, dword [ebp - 0x220]
sub esi, eax
sar esi, 1
lea ecx, [esi + 1]
push ecx
push eax
push dword [ebp - 0x218]
push ebx
call fcn.004c927f
mov eax, dword [ebp - 0x218]
sub eax, esi
inc esi
dec eax
push 0x502f10
push eax
lea eax, [ebx + esi*2]
push eax
call fcn.004c905a
mov esi, dword [ebp - 0x218]
push edi
push esi
push ebx
call fcn.004d6277
mov eax, dword [ebp - 0x21c]
add eax, 6
push eax
push esi
push ebx
call fcn.004d6277
add esp, 0x34
jmp 0x4319c0
push edi
push 0x502f18
push esi
push ebx
call fcn.00415290
add esp, 0x10
jmp 0x4319c0
mov ecx, ebx
sub ecx, edi
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [ecx + edi - 2], ax
test ax, ax
jne 0x4319b0
push 0
push ebx
push dword [ebp - 0x224]
call fcn.00431a20
push ebx
call fcn.004c8c7f
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push 0x10
push 0x502f28
push 0x502f58
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c3287
mov esp, ebp
pop ebp
ret