Function at 0x43fdf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7fba
mov eax, dword fs:[0]
push eax
sub esp, 0x874
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x87c], ebx
mov dword [ebp - 0x878], 0
mov dword [ebp - 0x880], ebx
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 0
mov dword [ebp - 0x860], 0
mov dword [ebp - 4], 1
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x868]
call fcn.00418a70
test eax, eax
je 0x43fecd
push 1
push 0x51fa18
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x868]
call fcn.00418a70
test eax, eax
je 0x43fecd
push 0x51f98c
mov ecx, ebx
call fcn.00402400
mov dword [ebp - 0x878], 1
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x868]
test eax, eax
je 0x43fec6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x868], 0
mov eax, ebx
jmp 0x4401cd
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.004b1a50
add esp, 0xc
lea ecx, [ebp - 0x85c]
push 0x51f994
mov dword [ebp - 0x86c], 0x400
call fcn.00402400
mov byte [ebp - 4], 2
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x810]
push eax
push str.CurrentVersion
lea ecx, [ebp - 0x868]
call fcn.00418b20
test eax, eax
jne 0x4400ec
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
jmp 0x43ff40
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43ff40
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x85c]
call fcn.004025f0
mov ebx, dword [0x53ed90]
mov eax, ebx
imul eax, ebx
imul eax, ebx
cdq
mov ecx, 0x12
idiv ecx
cmp edx, 0xb
jne 0x43ff88
xor esi, esi
mov edi, ebx
inc esi
dec edi
cmp esi, 0x12
jb 0x43ff81
push 0x51fa94
lea ecx, [ebp - 0x874]
call fcn.00402400
mov byte [ebp - 4], 3
mov ebx, dword [ebp - 0x868]
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x870]
push eax
push 0
push 0x51f99c
push ebx
mov dword [ebp - 0x86c], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x440019
mov eax, dword [ebp - 0x870]
cmp eax, 1
je 0x43ffec
cmp eax, 2
je 0x43ffec
mov edi, 0xd
jmp 0x440019
mov eax, dword [ebp - 0x86c]
test eax, eax
je 0x44000e
test al, 1
jne 0x440007
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x440017
mov edi, 0xd
jmp 0x440019
xor eax, eax
mov word [ebp - 0x810], ax
xor edi, edi
call fcn.0043d5c0
test al, al
jne 0x440040
mov esi, 1
mov eax, esi
mov edx, 0x8b
mov edi, edi
dec edx
lea ecx, [eax + esi]
lea esi, [eax]
mov eax, ecx
jns 0x440030
mov dword [0x53ed90], ecx
test edi, edi
jne 0x4400c6
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x440051
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x874]
call fcn.004025f0
lea eax, [ebp - 0x874]
push eax
mov edx, 0x51fa14
lea ecx, [ebp - 0x870]
call fcn.00417d50
add esp, 4
mov byte [ebp - 4], 4
mov eax, dword [eax]
lea ecx, [ebp - 0x85c]
push dword [eax - 0xc]
push eax
call fcn.0040fda0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x870]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4400c6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x874]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4400f2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4400f2
mov ebx, dword [ebp - 0x868]
test ebx, ebx
je 0x440105
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x868], ebx
mov esi, dword [ebp - 0x85c]
mov dword [ebp - 0x864], 0
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
lea edx, [esi - 4]
mov ecx, eax
jl 0x44013b
cmp ecx, dword [esi - 0x10]
jne 0x44013b
lea edi, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x440175
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
jne 0x44014f
call fcn.00402790
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov ecx, dword [esi - 0xc]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ecx*2 + 2]
push esi
push eax
lea eax, [edi + 0x10]
push eax
call fcn.004ad00b
add esp, 0x10
mov esi, dword [ebp - 0x87c]
lea eax, [edi + 0x10]
mov dword [esi], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x878], 1
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x85c]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4401b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
test ebx, ebx
je 0x4401cb
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x868], 0
mov eax, esi
mov dword [ebp - 0x864], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac57a
mov esp, ebp
pop ebp
ret