Function at 0x43a0a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov eax, 0x493948
xor esi, esi
call fcn.00439bd0
mov edi, eax
mov eax, str.SYSTEMCurrentControlSetControlDeviceClasses
call fcn.00439bd0
lea edi, [edi + eax + 2]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044288b
add esp, 4
cmp edi, 0x7fffffff
mov ebx, eax
mov dword [esp + 0x14], ebx
ja 0x43a0fe
mov eax, str.SYSTEMCurrentControlSetControlDeviceClasses
mov edx, edi
mov ecx, ebx
call fcn.00402c70
push 0x493948
mov eax, ebx
call fcn.004254d0
add esp, 4
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43a34f
xor edi, edi
nop
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
xor eax, eax
push edx
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
call fcn.0043a5e0
mov ebx, dword [esp + 0x24]
add esp, 0xc
test eax, eax
je 0x43a181
mov eax, ebx
call fcn.0043a370
xor ecx, ecx
cmp eax, ebp
sete cl
mov esi, ecx
test esi, esi
jne 0x43a17a
test ebx, ebx
je 0x43a17a
push ebx
call fcn.00442886
add esp, 4
add edi, 1
test esi, esi
je 0x43a130
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x43a34b
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x43a1fb
mov ecx, SysReAllocString
mov eax, ebp
xor edx, edx
cmp word [eax], dx
je 0x43a1b4
add eax, 2
sub ecx, 1
jne 0x43a1a5
jmp 0x43a1b8
test ecx, ecx
jne 0x43a1f2
mov edx, 0x80070057
xor eax, eax
test edx, edx
mov ecx, edx
jge 0x43a1c7
xor eax, eax
xor edx, edx
test ecx, ecx
setl dl
sub edx, 1
and edx, eax
test ebx, ebx
mov edi, edx
je 0x43a249
mov ecx, SysReAllocString
mov eax, ebx
xor edx, edx
cmp word [eax], 0
je 0x43a202
add eax, 2
sub ecx, 1
jne 0x43a1e2
jmp 0x43a206
mov eax, SysReAllocString
sub eax, ecx
jmp 0x43a1bf
mov ecx, 0x80070057
jmp 0x43a1c5
test ecx, ecx
jne 0x43a240
mov edx, 0x80070057
xor eax, eax
test edx, edx
mov ecx, edx
jge 0x43a215
xor eax, eax
xor edx, edx
test ecx, ecx
setl dl
mov ecx, SysReAllocString
sub edx, 1
and edx, eax
mov esi, edx
mov eax, 0x4939f8
xor edx, edx
nop
cmp word [eax], 0
je 0x43a250
add eax, 2
sub ecx, 1
jne 0x43a230
jmp 0x43a258
mov eax, SysReAllocString
sub eax, ecx
jmp 0x43a20d
mov ecx, 0x80070057
jmp 0x43a213
test ecx, ecx
jne 0x43a33f
mov edx, 0x80070057
xor eax, eax
xor ecx, ecx
test edx, edx
setl cl
mov edx, 2
sub ecx, 1
and ecx, eax
add ecx, esi
lea esi, [ecx + edi + 0x107]
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044288b
add esp, 4
cmp esi, 0x7fffffff
mov edi, eax
ja 0x43a2a4
mov eax, ebp
mov edx, esi
mov ecx, edi
call fcn.00402c70
push ebx
mov eax, edi
call fcn.004254d0
push 0x4939f8
mov eax, edi
call fcn.004254d0
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x18]
push edx
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esi + esi]
push 0
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x20]
push 0x4939fc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x43a316
mov edx, 0x208
cmp dword [esp + 0x18], edx
jae 0x43a316
mov ecx, dword [esp + 0x28]
mov eax, edi
call fcn.00402c70
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x43a32e
push edi
call fcn.00442886
add esp, 4
test ebx, ebx
je 0x43a34b
push ebx
call fcn.00442886
add esp, 4
mov ebx, ebp
jmp 0x43a34f
mov eax, SysReAllocString
sub eax, ecx
jmp 0x43a25f
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x43a35c
push ebx
call fcn.00442886
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret