Function at 0x43f380
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x2d0
mov eax, 0x46bfb8
call fcn.0046791c
mov esi, edx
mov eax, dword [ebp + 8]
xor ebx, ebx
push 1
push ecx
mov byte [esi], bl
lea ecx, [ebp - 0x2c0]
mov dword [ebp - 0x2c4], eax
mov dword [eax], 2
call fcn.0044117d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x224], ebx
jne 0x43f3e4
mov ecx, dword [ebp + 4]
mov edx, 0xc2
push 0x40872c
call fcn.0047b157
lea ecx, [ebp - 0x2c0]
call fcn.004233f9
mov eax, 0x80004005
jmp 0x43f699
mov edi, 0xc8
lea eax, [ebp - 0x128]
push edi
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0x2dc], edi
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2cc], 1
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 0x40876c
push ebx
push dword [ebp - 0x224]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
mov edi, eax
test edi, edi
je 0x43f473
jle 0x43f441
movzx eax, di
or eax, 0x80070000
lea edx, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], eax
lea ecx, [ebp - 0x2c8]
mov dword [ebp - 0x2c8], 1
call fcn.0043ef32
cmp edi, 2
jne 0x43f3cf
mov byte [esi], 1
jmp 0x43f3cf
cmp dword [ebp - 0x2cc], 1
je 0x43f49f
lea edx, [ebp - 0x2cc]
mov byte [esi], 1
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], 2
call fcn.0043ef32
jmp 0x43f3cf
lea eax, [ebp - 0x200]
mov dword [ebp - 0x2d8], ebx
push eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2c8], ebx
push eax
lea eax, [ebp - 0x2c8]
mov dword [ebp - 0x2d0], ebx
push eax
lea edx, [ebp - 0x2d8]
lea ecx, [ebp - 0x128]
call fcn.0043f703
mov dword [ebp - 0x2d4], eax
test eax, eax
jns 0x43f517
mov ecx, dword [ebp + 4]
mov edx, 0xe4
push eax
push 0x40872c
call fcn.00475b3c
lea edx, [ebp - 0x2d4]
mov byte [esi], 1
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], 3
call fcn.0043ef32
jmp 0x43f3cf
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0x20
push eax
push 0x408798
push 1
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetNLSVersionEx]
test eax, eax
jne 0x43f576
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x43f54b
movzx eax, ax
or eax, 0x80070000
lea edx, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], eax
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], 4
call fcn.0043ef32
mov ebx, 0x80004005
jmp 0x43f68c
xor eax, eax
mov word [ebp - 0x1f0], ax
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x60]
push 0x28
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x218]
lea eax, [ebp - 0x1f0]
push dword [ebp - 0x21c]
push 9
push 0x4087c4
push 0x64
push eax
call fcn.0042f13a
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x128]
push eax
push 0x4087e0
call fcn.0043f6a7
mov edi, dword [ebp - 0x2c4]
add esp, 0x28
cmp dword [ebp - 0x2d8], 9
jne 0x43f66f
mov eax, dword [ebp - 0x2c8]
mov dword [edi], 1
cmp eax, dword [ebp - 0x21c]
jne 0x43f66c
push 0x10
mov eax, 0x405474
push eax
lea eax, [ebp - 0x200]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
je 0x43f63a
lea edx, [ebp - 0x200]
mov ecx, ebx
mov eax, dword [edx + ecx*4]
lea edx, [ebp - 0x210]
cmp eax, dword [edx + ecx*4]
lea edx, [ebp - 0x200]
jne 0x43f66c
inc ecx
cmp ecx, 4
jne 0x43f620
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x2d0], eax
ja 0x43f66c
mov dword [edi], ebx
jb 0x43f667
lea edx, [ebp - 0x200]
mov ecx, ebx
mov edi, 0x405474
mov eax, dword [edx + ecx*4]
cmp eax, dword [edi + ecx*4]
jne 0x43f68c
inc ecx
cmp ecx, 4
jne 0x43f659
mov byte [esi], 1
jmp 0x43f68c
mov byte [esi], 1
cmp dword [edi], 1
lea edx, [ebp - 0x1f0]
lea ecx, [ebp - 0x128]
jne 0x43f687
call fcn.0043ee4e
jmp 0x43f68c
call fcn.0043eec0
lea ecx, [ebp - 0x2c0]
call fcn.004233f9
mov eax, ebx
call fcn.004678b9
ret 4