Function at 0x43a0b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
call section..text
add eax, 0x51615
mov dword [0x40130c], eax
mov eax, dword [0x40130c]
push eax
call fcn.0043a420
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0043a440
add esp, 4
mov dword [0x401318], eax
mov dword [0x40131c], 0
mov dword [0x401320], 1
push 0x401324
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x401324
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x401324
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x401324
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x401324
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x401324
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x401324
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x401324
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x1019
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
test eax, eax
je 0x43a16a
call entry0
mov edx, dword [str.softwareclassesInterface00000613_0000_0010_8000_00aa006d2ea4proxystubclsid]
mov byte [edx + 0x11], 0x49
mov eax, dword [str.softwareclassesInterface00000613_0000_0010_8000_00aa006d2ea4proxystubclsid]
mov byte [eax + 0x12], 0x6e
mov ecx, dword [str.softwareclassesInterface00000613_0000_0010_8000_00aa006d2ea4proxystubclsid]
mov byte [ecx + 0x13], 0x74
mov edx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [reloc.ADVAPI32.dll_RegOpenKeyA], edx
push 0x40131c
mov eax, dword [str.softwareclassesInterface00000613_0000_0010_8000_00aa006d2ea4proxystubclsid]
push eax
mov ecx, dword [0x401008]
push ecx
call dword [0x401368]
test eax, eax
je 0x43a1b6
xor eax, eax
jmp 0x43a40d
push 0x401014
push str.00020424_0000_0000_C000_000000000046
push 0x401018
push 0
push 0
mov edx, dword [0x40131c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x43a1e1
xor eax, eax
jmp 0x43a40d
movzx eax, word [str.00020424_0000_0000_C000_000000000046]
cmp eax, 0x7b
je 0x43a1f4
xor eax, eax
jmp 0x43a40d
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0
mov dword [0x4015c4], 0
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x1c]
jae 0x43a27a
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [section..data]
push ecx
call fcn.0043aab0
add esp, 8
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [0x40130c]
add eax, dword [0x4015c4]
push eax
mov ecx, dword [0x401318]
add ecx, dword [ebp - 4]
push ecx
call fcn.0043aa50
add esp, 0xc
mov edx, dword [0x401004]
add edx, dword [section..data]
add edx, dword [0x4015c4]
mov dword [0x4015c4], edx
mov eax, dword [ebp - 4]
add eax, dword [section..data]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
jmp 0x43a20b
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [0x401318]
push eax
call fcn.0043a480
add esp, 8
mov dword [0x401310], ebp
push pe_overlay
call fcn.0043a440
add esp, 4
mov dword [0x4015c8], eax
mov dword [0x40131c], 0
mov ecx, dword [0x40131c]
mov dword [ebp - 4], ecx
mov edx, dword [0x40131c]
mov dword [0x4015c4], edx
call fcn.0043a050
mov eax, dword [0x40130c]
push eax
call fcn.0043a420
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.0043a440
add esp, 4
mov dword [0x4015cc], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1c]
jae 0x43a35e
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [section..data]
push edx
call fcn.0043aab0
add esp, 8
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [0x40130c]
add ecx, dword [0x4015c4]
push ecx
mov edx, dword [0x4015cc]
add edx, dword [ebp - 4]
push edx
call fcn.0043aa50
add esp, 0xc
mov eax, dword [0x401004]
add eax, dword [section..data]
add eax, dword [0x4015c4]
mov dword [0x4015c4], eax
mov ecx, dword [ebp - 4]
add ecx, dword [section..data]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edx
jmp 0x43a2f0
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [0x4015cc]
push ecx
call fcn.0043a480
add esp, 8
mov edx, dword [0x401318]
mov eax, dword [0x4015cc]
mov dword [edx], eax
mov ecx, dword [0x401318]
push ecx
mov edx, dword [0x4015c8]
add edx, 0x200
push edx
call fcn.0043a090
add esp, 8
call fcn.0043a080
mov dword [0x4015d0], eax
mov eax, dword [0x4015c8]
sub eax, dword [0x4015d0]
push eax
mov ecx, dword [0x4015c8]
push ecx
mov edx, dword [0x4015cc]
push edx
call fcn.0043a6b0
add esp, 0xc
mov eax, dword [0x4015c8]
add eax, 0x28722
mov dword [0x401314], eax
mov ecx, dword [0x401314]
sub ecx, 2
mov dword [0x401314], ecx
mov dword [0x4015d4], 0x43a060
push 0x1a5d261e
mov esi, esi
mov eax, dword [0x4015d4]
mov esi, esi
mov esi, esi
mov ecx, esp
mov edx, edx
mov dword [ecx], 0
add dword [ecx], eax
mov edx, edx
ret
pop esi
mov esp, ebp
pop ebp
ret