Function at 0x432da0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fac76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x788
push ebx
push esi
push edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x10], esp
push eax
call fcn.004ab6e0
lea ecx, [ebp - 0x4c]
push ecx
call fcn.00401350
xor esi, esi
push 0x100
mov dword [ebp - 4], esi
call fcn.004f266a
add esp, 0xc
mov byte [ebp - 0x314], 0
mov dword [0xe56d18], esi
call fcn.00432c50
push 1
lea ecx, [ebp - 0x94]
call fcn.004f0653
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x94]
push edx
push 8
push str.c:endpcacheprocess_log.txt
mov byte [ebp - 4], 1
call fcn.004f0727
mov dword [ebp - 0x14], esi
xor eax, eax
mov ecx, dword [0xe56d18]
mov dword [ebp - 0x1c], eax
cmp eax, ecx
jge 0x433123
shl eax, 8
mov byte [ebp - 0x794], 0
lea eax, [eax + 0xd8b8c0]
mov dword [ebp - 0x2c], eax
push eax
push str.CLSID
lea eax, [ebp - 0x794]
push str._s_sInprocServer32
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x794]
push ecx
push 0x20019
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x694]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
push ecx
push edx
push 0
push 0
push eax
call esi
test eax, eax
je 0x432ec7
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x694]
push ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push edx
push eax
push 0
push 0
push ecx
call esi
test eax, eax
jne 0x432ef0
lea edi, [ebp - 0x694]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x314]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x314]
push str._SystemRoot_System32_browseui.dll
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x43311a
lea edx, [ebp - 0x314]
push edx
call fcn.004fa6c0
push eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x594], 0
call fcn.0040e3f0
add esp, 8
mov ebx, eax
push 0x5147b4
push ebx
call fcn.004f2d80
push 0x5144fc
push ebx
mov esi, eax
call fcn.004f2d80
push 0x516efc
push ebx
mov edi, eax
call fcn.004f2d80
add esp, 0x18
test esi, esi
jne 0x4330b4
test edi, edi
jne 0x4330b4
test eax, eax
jne 0x4330b4
push ebx
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x20]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x114]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x594]
push 0x51a180
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x18
test eax, eax
jne 0x433009
mov eax, dword [0xe56dbc]
mov edx, dword [ebp + 0x1b4]
lea ecx, [ebp - 0x594]
test eax, eax
mov eax, dword [ebp + 0x1b0]
push ecx
push edx
push eax
jne 0x432fec
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x433003
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
push 0x5147ac
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x433021
inc dword [0xe56d24]
lea ecx, [ebp - 0x594]
push ecx
lea ecx, [ebp - 0x88]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, dword [ebp - 0x2c]
lea edx, [ebp - 0x214]
push esi
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler_s
push edx
call fcn.004f175f
lea eax, [ebp - 0x214]
push eax
call fcn.004bc2e0
add esp, 0x10
lea ecx, [ebp - 0x214]
mov byte [ebp - 0x214], 0
push esi
push str.CLSID
push str.HKLR_s_sInprocServer32
push ecx
call fcn.004f175f
lea edx, [ebp - 0x214]
push edx
call fcn.004bc2e0
mov eax, dword [0xe56cac]
add esp, 0x14
inc eax
mov dword [ebp - 0x14], 1
mov dword [0xe56cac], eax
mov eax, dword [ebp - 0x1c]
inc eax
jmp 0x432e2c
push ebx
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x20]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x114]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x594]
push 0x51a0f0
push eax
call fcn.004f175f
add esp, 0x18
lea ecx, [ebp - 0x594]
push ecx
lea ecx, [ebp - 0x88]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x1c]
inc eax
jmp 0x432e2c
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4331ef
lea edx, [ebp - 0x4c]
push 0x51a0a8
push edx
mov byte [ebp - 0x594], 0
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x594]
push eax
push 0x5190b4
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x14
test eax, eax
jne 0x4331c8
mov eax, dword [0xe56dbc]
mov ecx, dword [ebp + 0x1b0]
test eax, eax
mov eax, dword [ebp + 0x1b4]
lea edx, [ebp - 0x594]
push edx
push eax
push ecx
jne 0x4331ab
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4331c2
sub esp, 0x1a8
mov ecx, 0x6a
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x594]
lea ecx, [ebp - 0x88]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x94]
call fcn.004f076e
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x80]
call fcn.004f05fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret