Function at 0x43db9a
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x898
mov eax, 0x48653f
call fcn.00468ad7
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x8a0], ecx
mov dword [ebp - 0x89c], edx
cmp ecx, ebx
je 0x43df01
cmp eax, ebx
je 0x43df01
push eax
lea ecx, [ebp - 0x870]
call fcn.00424491
push 7
pop edi
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x840], edi
mov dword [ebp - 0x844], ebx
mov word [ebp - 0x854], ax
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x898]
push eax
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], 1
mov dword [ebp - 0x898], 0x5c
call fcn.0043d8b5
mov esi, eax
cmp esi, 0xffffffff
jne 0x43dc44
mov esi, 0x3f2
push ebx
push 1
lea ecx, [ebp - 0x854]
call fcn.0041f501
push ebx
push 1
lea ecx, [ebp - 0x870]
call fcn.0041f501
mov eax, esi
jmp 0x43df06
push 0xffffffffffffffff
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x870]
call fcn.00429b29
push eax
lea ecx, [ebp - 0x854]
mov byte [ebp - 4], 2
call fcn.00420041
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0041f501
push esi
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x870]
call fcn.00429b29
push eax
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], 3
call fcn.00420041
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0041f501
cmp dword [ebp - 0x85c], 8
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x894], ebx
jae 0x43dcc3
lea eax, [ebp - 0x870]
lea ecx, [ebp - 0x894]
push ecx
push 0x2001f
push ebx
push eax
push dword [ebp - 0x8a0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x43dce8
mov esi, eax
jmp 0x43dc21
xor eax, eax
push 0x7fe
mov word [ebp - 0x838], ax
lea eax, [ebp - 0x836]
push ebx
push eax
call fcn.00466c70
mov eax, dword [ebp - 0x854]
add esp, 0xc
cmp dword [ebp - 0x840], 8
mov dword [ebp - 0x890], ebx
mov dword [ebp - 0x8a4], 0x800
jae 0x43dd2b
lea eax, [ebp - 0x854]
lea ecx, [ebp - 0x8a4]
push ecx
lea ecx, [ebp - 0x838]
push ecx
lea ecx, [ebp - 0x890]
push ecx
push ebx
push eax
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, ebx
je 0x43dd65
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43dc21
xor eax, eax
mov dword [ebp - 0x878], edi
mov dword [ebp - 0x87c], ebx
mov word [ebp - 0x88c], ax
cmp dword [ebp - 0x890], 4
mov byte [ebp - 4], 4
jne 0x43ddbd
push 9
pop ecx
push dword [ebp - 0x838]
mov word [ebp - 0x38], ax
lea edi, [ebp - 0x36]
rep stosd dword es:[edi], eax
push 0x49208c
stosw word es:[edi], ax
lea eax, [ebp - 0x38]
push 0x13
push eax
call fcn.0046bb7d
lea eax, [ebp - 0x38]
push eax
call fcn.00468f76
add esp, 0x14
push eax
lea eax, [ebp - 0x38]
jmp 0x43dde3
cmp dword [ebp - 0x890], 1
je 0x43ddcf
cmp dword [ebp - 0x890], 2
jne 0x43ddef
lea eax, [ebp - 0x838]
push eax
call fcn.00468f76
pop ecx
push eax
lea eax, [ebp - 0x838]
push eax
lea ecx, [ebp - 0x88c]
call fcn.00424413
mov edi, dword [ebp - 0x89c]
lea eax, [ebp - 0x88c]
push edi
push eax
call fcn.0043d9bd
pop ecx
pop ecx
test al, al
je 0x43dec7
mov eax, dword [edi]
cmp eax, ebx
jne 0x43de39
cmp dword [ebp - 0x840], 8
mov eax, dword [ebp - 0x854]
jae 0x43de27
lea eax, [ebp - 0x854]
push eax
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x43dec7
cmp eax, 1
jne 0x43dec7
xor eax, eax
xor ecx, ecx
cmp dword [ebp - 0x890], 4
mov dword [ebp - 0x898], ebx
jne 0x43de78
lea eax, [edi + 0x28]
cmp dword [eax + 0x14], 8
jb 0x43de60
mov eax, dword [eax]
push eax
call fcn.0046bb72
pop ecx
push 4
mov dword [ebp - 0x898], eax
lea eax, [ebp - 0x898]
pop ecx
jmp 0x43de9c
cmp dword [ebp - 0x890], 1
je 0x43de8a
cmp dword [ebp - 0x890], 2
jne 0x43de9c
lea eax, [edi + 0x28]
cmp dword [eax + 0x14], 8
jb 0x43de95
mov eax, dword [eax]
mov ecx, dword [edi + 0x38]
lea ecx, [ecx + ecx + 2]
cmp dword [ebp - 0x840], 8
mov edx, dword [ebp - 0x854]
jae 0x43deb1
lea edx, [ebp - 0x854]
push ecx
push eax
push dword [ebp - 0x890]
push ebx
push edx
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x894]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp - 0x88c]
call fcn.0041f501
push ebx
push 1
lea ecx, [ebp - 0x854]
call fcn.0041f501
push ebx
push 1
lea ecx, [ebp - 0x870]
call fcn.0041f501
xor eax, eax
jmp 0x43df06
mov eax, 0x3f2
call fcn.00468b5a
ret