Function at 0x43ed20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b15f0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov ebp, dword [sym.imp.user32.dll_GetDlgItem]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43edea
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b2880
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43edc6
cmp word [esp + 0x20], 1
jne 0x43ede4
push eax
push 1
push 0xf1
push 0x28f8
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43ede4
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 4
push 0
push 0x4b2880
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b15f0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43ee84
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b289c
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ee60
cmp word [esp + 0x20], 1
jne 0x43ee7e
push eax
push 1
push 0xf1
push 0x28f9
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43ee7e
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b289c
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b15f0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43ef1e
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b28bc
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43eefa
cmp word [esp + 0x20], 1
jne 0x43ef18
push eax
push 1
push 0xf1
push 0x28fa
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43ef18
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b28bc
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push 0x4b15f0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43efb8
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x4b28d8
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ef94
cmp word [esp + 0x20], 1
jne 0x43efb2
push eax
push 1
push 0xf1
push 0x28fb
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43efb2
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push 0x4b28d8
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
push 0x28fc
push 0x4b28f0
mov edx, 0x4b2918
mov ecx, 0x80000002
call fcn.0043d980
push 0x28fd
push 0x4b2978
mov edx, 0x4b29a0
mov ecx, 0x80000002
call fcn.0043d980
push 0x28fe
push 0x4b29f0
mov edx, 0x4b2a08
mov ecx, 0x80000002
call fcn.0043d980
push 0x28ff
push 0x4b2a58
mov edx, 0x4b2a80
mov ecx, 0x80000001
call fcn.0043d980
push 0x2900
push 0x4b2ad8
mov edx, 0x4b2af0
mov ecx, 0x80000002
call fcn.0043d980
mov ecx, dword [esp + 0x848]
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x814
ret