Function at 0x43e930
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e7e83
mov eax, dword fs:[0]
push eax
sub esp, 0x4d8
mov eax, dword [0x6a8a44]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4e4], ecx
mov dword [ebp - 0x4b4], 0
lea eax, [ebp - 0x4b4]
push eax
push 0x109
push 0
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x470]
push edx
call fcn.005b64c1
add esp, 8
mov dword [ebp - 0x4c4], eax
mov ecx, dword [ebp - 0x4c4]
call fcn.00402820
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x4c8], eax
lea ecx, [ebp - 0x470]
call fcn.00402750
cmp dword [ebp - 0x4c8], 0
je 0x43e9c9
xor eax, eax
jmp 0x43f071
mov dword [ebp - 0x4b8], 0
jmp 0x43e9e4
mov ecx, dword [ebp - 0x4b8]
add ecx, 1
mov dword [ebp - 0x4b8], ecx
mov ecx, dword [ebp + 0x14]
call fcn.004497c0
cmp dword [ebp - 0x4b8], eax
jae 0x43f05f
mov edx, dword [ebp - 0x4b8]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.00449bb0
mov dword [ebp - 0x4a8], eax
mov ecx, dword [ebp - 0x4a8]
call fcn.00449260
movzx eax, al
test eax, eax
jne 0x43ea31
mov ecx, dword [ebp - 0x4a8]
call fcn.004494c0
movzx ecx, al
test ecx, ecx
jne 0x43ea36
jmp 0x43f05f
push 0x5efd5c
mov ecx, dword [ebp - 0x4a8]
call fcn.00449d90
mov dword [ebp - 0x4bc], eax
push 0x5efd60
mov ecx, dword [ebp - 0x4a8]
call fcn.00449d90
mov dword [ebp - 0x4ac], eax
push 0x5efd68
mov ecx, dword [ebp - 0x4a8]
call fcn.00449d90
mov dword [ebp - 0x4b0], eax
mov ecx, dword [ebp - 0x4bc]
call fcn.00449260
movzx edx, al
test edx, edx
jne 0x43ea9c
mov ecx, dword [ebp - 0x4bc]
call fcn.00449430
movzx eax, al
test eax, eax
jne 0x43eaa1
jmp 0x43f05f
mov ecx, dword [ebp - 0x4ac]
call fcn.00449260
movzx ecx, al
test ecx, ecx
jne 0x43eac5
mov ecx, dword [ebp - 0x4ac]
call fcn.00449430
movzx edx, al
test edx, edx
jne 0x43eaee
mov ecx, dword [ebp - 0x4b0]
call fcn.00449260
movzx eax, al
test eax, eax
jne 0x43eaee
mov ecx, dword [ebp - 0x4b0]
call fcn.00449430
movzx ecx, al
test ecx, ecx
je 0x43eaee
jmp 0x43f05f
lea edx, [ebp - 0x488]
push edx
mov ecx, dword [ebp - 0x4bc]
call fcn.004488b0
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x4d0]
push ecx
lea edx, [ebp - 0x440]
push edx
call fcn.005b64c1
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x488]
call fcn.00420fa0
mov ecx, dword [ebp - 0x4ac]
call fcn.00449260
movzx eax, al
test eax, eax
jne 0x43eb86
mov ecx, dword [ebp - 0x4ac]
call fcn.00449430
movzx ecx, al
test ecx, ecx
je 0x43eb86
mov ecx, dword [ebp - 0x4b0]
call fcn.00449260
movzx edx, al
test edx, edx
jne 0x43eb86
mov ecx, dword [ebp - 0x4b0]
call fcn.00449430
movzx eax, al
test eax, eax
jne 0x43ebd1
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x440]
call fcn.00402820
push eax
mov ecx, dword [ebp - 0x4b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ebba
mov edx, dword [ebp + 8]
mov eax, dword [edx]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x43ebd1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.00402750
jmp 0x43f05f
mov dword [ebp - 0x4a4], 0
lea edx, [ebp - 0x428]
push edx
mov ecx, dword [ebp - 0x4ac]
call fcn.004488b0
mov byte [ebp - 4], 3
push str.REG_SZ
lea eax, [ebp - 0x428]
push eax
call fcn.004349b0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x43ec1b
mov dword [ebp - 0x4a4], 1
jmp 0x43ee05
push str.REG_EXPAND_SZ
lea edx, [ebp - 0x428]
push edx
call fcn.004349b0
add esp, 8
movzx eax, al
test eax, eax
je 0x43ec45
mov dword [ebp - 0x4a4], 2
jmp 0x43ee05
push str.REG_BINARY
lea ecx, [ebp - 0x428]
push ecx
call fcn.004349b0
add esp, 8
movzx edx, al
test edx, edx
je 0x43ec6f
mov dword [ebp - 0x4a4], 3
jmp 0x43ee05
push str.REG_DWORD
lea eax, [ebp - 0x428]
push eax
call fcn.004349b0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x43ec99
mov dword [ebp - 0x4a4], 4
jmp 0x43ee05
push str.REG_DWORD_LITTLE_ENDIAN
lea edx, [ebp - 0x428]
push edx
call fcn.004349b0
add esp, 8
movzx eax, al
test eax, eax
je 0x43ecc3
mov dword [ebp - 0x4a4], 4
jmp 0x43ee05
push str.REG_DWORD_BIG_ENDIAN
lea ecx, [ebp - 0x428]
push ecx
call fcn.004349b0
add esp, 8
movzx edx, al
test edx, edx
je 0x43eced
mov dword [ebp - 0x4a4], 5
jmp 0x43ee05
push str.REG_LINK
lea eax, [ebp - 0x428]
push eax
call fcn.004349b0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x43ed17
mov dword [ebp - 0x4a4], 6
jmp 0x43ee05
push str.REG_MULTI_SZ
lea edx, [ebp - 0x428]
push edx
call fcn.004349b0
add esp, 8
movzx eax, al
test eax, eax
je 0x43ed41
mov dword [ebp - 0x4a4], 7
jmp 0x43ee05
push str.REG_RESOURCE_LIST
lea ecx, [ebp - 0x428]
push ecx
call fcn.004349b0
add esp, 8
movzx edx, al
test edx, edx
je 0x43ed6b
mov dword [ebp - 0x4a4], 8
jmp 0x43ee05
push str.REG_FULL_RESOURCE_DESCRIPTOR
lea eax, [ebp - 0x428]
push eax
call fcn.004349b0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x43ed92
mov dword [ebp - 0x4a4], 9
jmp 0x43ee05
push str.REG_RESOURCE_REQUIREMENTS_LIST
lea edx, [ebp - 0x428]
push edx
call fcn.004349b0
add esp, 8
movzx eax, al
test eax, eax
je 0x43edb9
mov dword [ebp - 0x4a4], 0xa
jmp 0x43ee05
push str.REG_QWORD
lea ecx, [ebp - 0x428]
push ecx
call fcn.004349b0
add esp, 8
movzx edx, al
test edx, edx
je 0x43ede0
mov dword [ebp - 0x4a4], 0xb
jmp 0x43ee05
push str.REG_QWORD_LITTLE_ENDIAN
lea eax, [ebp - 0x428]
push eax
call fcn.004349b0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x43ee05
mov dword [ebp - 0x4a4], 0xb
xor edx, edx
mov word [ebp - 0x410], dx
push 0x3fe
push 0
lea eax, [ebp - 0x40e]
push eax
call fcn.005be3a0
add esp, 0xc
mov dword [ebp - 0x4c0], 0x200
lea ecx, [ebp - 0x4a0]
push ecx
mov ecx, dword [ebp - 0x4b0]
call fcn.004488b0
mov dword [ebp - 0x4d4], eax
mov edx, dword [ebp - 0x4d4]
mov dword [ebp - 0x4d8], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x4d8]
push eax
lea ecx, [ebp - 0x458]
push ecx
call fcn.005b64c1
add esp, 8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4a0]
call fcn.00420fa0
cmp dword [ebp - 0x4a4], 2
je 0x43ee9a
cmp dword [ebp - 0x4a4], 1
je 0x43ee9a
cmp dword [ebp - 0x4a4], 7
jne 0x43ef36
lea edx, [ebp - 0x4c0]
push edx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x4a4]
push ecx
push 0
lea ecx, [ebp - 0x440]
call fcn.00402820
push eax
mov edx, dword [ebp - 0x4b4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ef31
lea ecx, [ebp - 0x458]
call fcn.00402820
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004092d0
add esp, 8
test eax, eax
je 0x43eefc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax], edx
jmp 0x43ef31
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x458]
call fcn.00402750
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x428]
call fcn.00420fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.00402750
jmp 0x43f05f
jmp 0x43f02a
cmp dword [ebp - 0x4a4], 4
je 0x43ef4c
cmp dword [ebp - 0x4a4], 3
jne 0x43eff8
lea ecx, [ebp - 0x4c0]
push ecx
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x4a4]
push eax
push 0
lea ecx, [ebp - 0x440]
call fcn.00402820
push eax
mov ecx, dword [ebp - 0x4b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43eff6
movsx edx, word [ebp - 0x410]
mov dword [ebp - 0x4e0], edx
lea ecx, [ebp - 0x458]
call fcn.00402820
push eax
call fcn.005c8490
add esp, 4
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x4dc]
cmp eax, dword [ebp - 0x4e0]
jne 0x43efc4
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax], edx
jmp 0x43eff6
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x458]
call fcn.00402750
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x428]
call fcn.00420fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.00402750
jmp 0x43f05f
jmp 0x43f02a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x458]
call fcn.00402750
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x428]
call fcn.00420fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.00402750
jmp 0x43f05f
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x458]
call fcn.00402750
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x428]
call fcn.00420fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.00402750
jmp 0x43e9d5
mov ecx, dword [ebp - 0x4b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ad281
mov esp, ebp
pop ebp
ret 0x10