Function at 0x43fd84
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
push 8
call fcn.00456f09
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x46e255
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov eax, 0x46e25f
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43fdef
push ebx
call fcn.00456f0f
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 8]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x43fe11
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x43fe0d
imul eax, dword [ebx]
jmp 0x43fe02
mov ecx, eax
test ecx, ecx
je 0x43fe30
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x43fe29
push ebx
push eax
call fcn.00456f0f
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x43fe17
call fcn.00456f0f
add esp, 4
mov eax, 0x46e255
mov dword [ebp - 8], eax
push dword [ebp + 8]
call fcn.0044010f
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], esp
lea eax, [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x43fe80
push 0x6e
push 0x406b5e6
push 6
call fcn.00456f15
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x43ffce
cmp dword [ebp - 0x14], 0
jne 0x43ffce
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00457cb0
add esp, 0x10
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x43fec9
push ebx
call fcn.00456f0f
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x43fee0
mov eax, 0x46e25f
push eax
push 1
mov ebx, 0x130
call fcn.00457bf0
add esp, 0x10
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], esp
push dword [ebp - 0x24]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
nop
nop
cmp dword [ebp - 0x28], esp
je 0x43ff2b
push 0x178
push 0x406b5e6
push 6
call fcn.00456f15
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x43ff3d
jmp 0x43ffce
lea eax, [ebp - 8]
push eax
push 4
mov eax, 2
call fcn.00457440
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x28], ebx
call fcn.00401afb
mov dword [ebp - 0x2c], ecx
mov edi, dword [ebp - 0x28]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x43ff80
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x2c]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x28]
call fcn.00456f27
add esp, 8
mov dword [ebp - 8], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x2c]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x24]
push edi
test eax, eax
je 0x43ffc3
push eax
mov ebx, eax
call fcn.00401030
inc eax
push eax
call fcn.00456f09
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [edi], eax
inc dword [ebp - 0x1c]
jmp 0x43fe8a
mov dword [ebp - 0x24], esp
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x43fffa
push 0x253
push 0x406b5e6
push 6
call fcn.00456f15
add esp, 0xc
push 0
mov ebx, 0x350
call fcn.00458740
add esp, 4
mov ebx, dword [ebp - 8]
call fcn.00401b1b
xor ecx, ecx
push eax
lea eax, [ebp - 0x20]
mov ebx, eax
pop eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
push eax
cmp ecx, eax
jg 0x44007e
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx]
inc ecx
shl ecx, 2
add ebx, ecx
push ebx
mov eax, dword [ebp - 0x20]
dec eax
pop ebx
shl eax, 2
add ebx, eax
mov dword [ebp - 0x24], ebx
push 0x1c1062f
mov ebx, dword [ebp - 0x24]
push dword [ebx]
push dword [ebp - 4]
mov ecx, 3
call fcn.0040109b
add esp, 0xc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x440075
push ebx
call fcn.00456f0f
add esp, 4
pop eax
mov dword [ebp - 4], eax
pop eax
pop ebx
pop ecx
jmp 0x44001d
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x44009d
push eax
mov ebx, eax
call fcn.00401030
inc eax
push eax
call fcn.00456f09
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4400a2
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4400b3
push ebx
call fcn.00456f0f
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4400d1
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4400cd
imul eax, dword [ebx]
jmp 0x4400c2
mov ecx, eax
test ecx, ecx
je 0x4400f0
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x4400e9
push ebx
push eax
call fcn.00456f0f
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4400d7
call fcn.00456f0f
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x440108
push ebx
call fcn.00456f0f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8