Function at 0x438b70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f77b8
mov eax, dword fs:[0]
push eax
mov eax, 0x1bc8
call fcn.004da5e0
mov eax, dword [0x65b500]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1bd4], eax
mov dword [ebp - 0x1bc0], eax
mov dword [ebp - 0x1bb8], 0
lea eax, [ebp - 0x1bb0]
mov dword [ebp - 4], 1
push eax
call fcn.00437130
mov dword [ebp - 0x1ba8], str.pid
mov eax, dword [eax]
sub eax, 0x10
mov byte [ebp - 4], 2
push eax
call fcn.00407c20
add eax, 0x10
mov dword [ebp - 0x1bb8], 2
add esp, 8
mov dword [ebp - 0x1ba4], eax
mov edx, dword [ebp - 0x1bb0]
or edi, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x438c21
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [0x666000], 0
jne 0x438d26
push 0x20219
push str.SOFTWAREHaloDesktop
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1bd0]
mov dword [ebp - 0x1bd0], 0
mov dword [ebp - 0x1bcc], 0
mov dword [ebp - 0x1bc8], 0
call fcn.004147c0
mov ebx, dword [ebp - 0x1bd0]
test eax, eax
jne 0x438d1b
lea eax, [ebp - 0x1bb4]
mov dword [ebp - 0x1bb4], 0x800
push eax
lea eax, [ebp - 0xb20]
push eax
lea eax, [ebp - 0x1bbc]
push eax
push 0
push str.FROM
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x438d1b
mov eax, dword [ebp - 0x1bbc]
cmp eax, 1
je 0x438cb6
cmp eax, 2
jne 0x438d1b
mov eax, dword [ebp - 0x1bb4]
test eax, eax
je 0x438cd3
test al, 1
jne 0x438d1b
shr eax, 1
cmp word [ebp + eax*2 - 0xb22], 0
je 0x438cdc
jmp 0x438d1b
xor eax, eax
mov word [ebp - 0xb20], ax
mov ecx, 0x666000
lea esi, [ebp - 0xb20]
mov edx, 0x3ff
sub esi, ecx
nop
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x438d0e
movzx eax, word [esi + ecx]
test ax, ax
je 0x438d0e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x438cf0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test ebx, ebx
je 0x438d26
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00406890
mov ecx, eax
test ecx, ecx
je 0x4394ee
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1bac], eax
mov eax, 0x666000
mov byte [ebp - 4], 5
test eax, 0xffff0000
jne 0x438d64
movzx eax, ax
lea ecx, [ebp - 0x1bac]
push eax
call fcn.00406df0
jmp 0x438d90
mov ecx, 0x666000
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438d70
sub ecx, edx
sar ecx, 1
push ecx
push 0x666000
lea ecx, [ebp - 0x1bac]
call fcn.00408d30
mov dword [ebp - 0x1bb8], 6
mov esi, dword [ebp - 0x1bac]
add esi, 0xfffffff0
mov byte [ebp - 4], 6
push esi
mov dword [ebp - 0x1ba0], 0x607648
call fcn.00407c20
add eax, 0x10
mov dword [ebp - 0x1bb8], 0xe
add esp, 4
mov dword [ebp - 0x1b9c], eax
mov byte [ebp - 4], 8
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x438de5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [0x666800], 0
jne 0x438dfe
push 0x400
push 0x666800
call fcn.00583f70
call fcn.00406890
mov ecx, eax
test ecx, ecx
je 0x4394f8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1bac], eax
mov eax, 0x666800
mov byte [ebp - 4], 9
test eax, 0xffff0000
jne 0x438e3c
movzx eax, ax
lea ecx, [ebp - 0x1bac]
push eax
call fcn.00406df0
jmp 0x438e64
mov ecx, 0x666800
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438e44
sub ecx, edx
sar ecx, 1
push ecx
push 0x666800
lea ecx, [ebp - 0x1bac]
call fcn.00408d30
mov dword [ebp - 0x1bb8], 0x1e
mov esi, dword [ebp - 0x1bac]
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
push esi
mov dword [ebp - 0x1b98], str.mid
call fcn.00407c20
add eax, 0x10
mov dword [ebp - 0x1bb8], 0x3e
add esp, 4
mov dword [ebp - 0x1b94], eax
mov byte [ebp - 4], 0xc
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x438eb9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [0x667000], 0
jne 0x438ed2
push 0x3ff
push 0x667000
call fcn.00584bb0
call fcn.00406890
mov ecx, eax
test ecx, ecx
je 0x439502
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1bac], eax
mov eax, 0x667000
mov byte [ebp - 4], 0xd
test eax, 0xffff0000
jne 0x438f10
movzx eax, ax
lea ecx, [ebp - 0x1bac]
push eax
call fcn.00406df0
jmp 0x438f40
mov ecx, 0x667000
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x438f20
sub ecx, edx
sar ecx, 1
push ecx
push 0x667000
lea ecx, [ebp - 0x1bac]
call fcn.00408d30
mov dword [ebp - 0x1bb8], 0x7e
mov esi, dword [ebp - 0x1bac]
add esi, 0xfffffff0
mov byte [ebp - 4], 0xe
push esi
mov dword [ebp - 0x1b90], str.mid2
call fcn.00407c20
add eax, 0x10
mov dword [ebp - 0x1bb8], 0xfe
add esp, 4
mov dword [ebp - 0x1b8c], eax
mov byte [ebp - 4], 0x10
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x438f95
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0x603cf0
mov dword [ebp - 0x1bb0], 0
mov dword [ebp - 0x1bbc], 0
mov dword [ebp - 0x1bac], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x438fff
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x438ff8
lea ecx, [ebp - 0x1bac]
push ecx
lea ecx, [ebp - 0x1bbc]
push ecx
lea ecx, [ebp - 0x1bb0]
push ecx
call eax
movzx eax, word [ebp - 0x1bac]
mov dword [ebp - 0x1bac], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.005c5370
push dword [ebp - 0x1bbc]
lea eax, [ebp - 0x110]
push dword [ebp - 0x1bb0]
push str._u._u
push 0x7f
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x20
call fcn.00406890
mov ecx, eax
test ecx, ecx
je 0x43950c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1bb4], eax
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 0x11
test eax, 0xffff0000
jne 0x439074
movzx eax, ax
lea ecx, [ebp - 0x1bb4]
push eax
call fcn.00406df0
jmp 0x4390a2
lea ecx, [ebp - 0x110]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x439080
sub ecx, edx
lea eax, [ebp - 0x110]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1bb4]
call fcn.00408d30
mov dword [ebp - 0x1bb8], 0x1fe
mov esi, dword [ebp - 0x1bb4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x12
push esi
mov dword [ebp - 0x1b88], str.osver
call fcn.00407c20
add eax, 0x10
mov dword [ebp - 0x1bb8], 0x3fe
add esp, 4
mov dword [ebp - 0x1b84], eax
mov byte [ebp - 4], 0x14
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4390f7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [0x668000], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
jne 0x4391b3
lea eax, [ebp - 0x1bb4]
push eax
call fcn.00436750
add esp, 4
push 0x10
push str.HaloDesktop.exe
lea ecx, [ebp - 0x1bb4]
mov byte [ebp - 4], 0x15
call fcn.00418be0
call fcn.00406890
mov ecx, eax
test ecx, ecx
je 0x439516
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1bb0], eax
lea eax, [ebp - 0x1bb0]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x1bb4]
push eax
call fcn.00435f00
mov esi, dword [ebp - 0x1bb0]
add esp, 8
push 0x3f
push esi
push 0x668000
call ebx
mov byte [ebp - 4], 0x15
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x439192
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1bb4]
mov eax, edi
mov byte [ebp - 4], 0x14
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4391b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x668000
lea ecx, [ebp - 0x1b7c]
mov dword [ebp - 0x1b80], str.appver
call fcn.00406060
xor eax, eax
mov byte [ebp - 4], 0x17
cmp ax, word [0x668080]
jne 0x4392fa
push 0x210
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.005c5370
add esp, 0xc
lea eax, [ebp - 0x320]
push 0x108
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.00406890
mov ecx, eax
test ecx, ecx
je 0x439520
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1bb0], eax
mov byte [ebp - 4], 0x18
call fcn.00406890
mov ecx, eax
test ecx, ecx
je 0x43952a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1bac], eax
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 0x19
test eax, 0xffff0000
jne 0x439269
movzx eax, ax
lea ecx, [ebp - 0x1bac]
push eax
call fcn.00406df0
jmp 0x439294
lea ecx, [ebp - 0x320]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x439272
sub ecx, edx
lea eax, [ebp - 0x320]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1bac]
call fcn.00408d30
lea eax, [ebp - 0x1bb0]
mov byte [ebp - 4], 0x1a
push eax
lea eax, [ebp - 0x1bac]
push eax
call fcn.00435f00
mov edx, dword [ebp - 0x1bac]
add esp, 8
mov byte [ebp - 4], 0x18
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4392cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1bb0]
push 0x3f
push esi
push 0x668080
call ebx
mov byte [ebp - 4], 0x17
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4392fa
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0x668080
lea ecx, [ebp - 0x1b74]
mov dword [ebp - 0x1b78], str.modver
call fcn.00406060
lea eax, [ebp - 0x1bb0]
mov byte [ebp - 4], 0x1b
push eax
call fcn.00436910
mov esi, eax
push 0x1048
lea eax, [ebp - 0x1b68]
mov byte [ebp - 4], 0x1c
push 0
push eax
call fcn.005c5370
push 0
push 0x1048
push 0
lea eax, [ebp - 0x1b68]
push eax
push dword [esi]
call fcn.004337a0
add esp, 0x24
test eax, eax
jne 0x439362
mov word [ebp - 0x1b68], ax
call fcn.00406890
mov ecx, eax
test ecx, ecx
je 0x439534
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1bb4], eax
lea eax, [ebp - 0x1b68]
mov byte [ebp - 4], 0x1d
test eax, 0xffff0000
jne 0x4393a1
movzx eax, ax
lea ecx, [ebp - 0x1bb4]
push eax
call fcn.00406df0
jmp 0x4393d2
lea ecx, [ebp - 0x1b68]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4393b0
sub ecx, edx
lea eax, [ebp - 0x1b68]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1bb4]
call fcn.00408d30
mov dword [ebp - 0x1bb8], 0x7fe
mov esi, dword [ebp - 0x1bb4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x1e
push esi
mov dword [ebp - 0x1b70], str.instdate
call fcn.00407c20
add eax, 0x10
mov dword [ebp - 0x1bb8], 0xffe
mov dword [ebp - 0x1b6c], eax
add esp, 4
mov byte [ebp - 4], 0x1c
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x439427
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1bb0]
mov eax, edi
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x439448
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x1f
push eax
call fcn.00407c20
mov ebx, dword [ebp - 0x1bc0]
add eax, 0x10
add esp, 4
mov dword [ebx], eax
mov dword [ebp - 0x1bb8], 0xfff
xor esi, esi
nop dword [eax]
nop word [eax + eax]
push dword [ebp + esi*8 - 0x1ba4]
mov ecx, ebx
push dword [ebp + esi*8 - 0x1ba8]
call fcn.00418dc0
inc esi
cmp esi, 8
jb 0x439480
push fcn.00432a20
push 8
push 8
lea eax, [ebp - 0x1ba8]
mov byte [ebp - 4], 1
push eax
call fcn.004da64c
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 0
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x4394d0
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da36e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004064e0
push 0x80004005
call fcn.004064e0
push 0x80004005
call fcn.004064e0
push 0x80004005
call fcn.004064e0
push 0x80004005
call fcn.004064e0
push 0x80004005
call fcn.004064e0
push 0x80004005
call fcn.004064e0
push 0x80004005
call fcn.004064e0
int3