Function at 0x430a10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9428
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x51fee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x90], eax
mov eax, dword [0x521340]
imul eax, eax
cdq
mov ecx, 0x12
idiv ecx
mov dword [ebp - 4], 1
cmp edx, 8
jne 0x430a69
dec dword [0x52198c]
mov eax, dword [0x51fab0]
xor ebx, ebx
cmp byte [0x52195c], bl
mov ecx, 0x51fab0
sete bl
add ebx, 0x80000001
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x9c], eax
mov esi, dword [0x521340]
mov eax, esi
imul eax, esi
cdq
mov ecx, 0xf
idiv ecx
mov byte [ebp - 4], 2
cmp edx, 0xe
jne 0x430ae4
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x7b]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a63b0
push eax
call fcn.004a8200
add esp, 8
or edi, 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x430b59
cmp byte [0x51b24c], 0
jne 0x430b59
mov eax, dword [0x521a88]
cmp dword [eax - 0xc], 0
jne 0x430b08
mov ebx, SysReAllocStringLen
jmp 0x430b59
push 0x4da458
lea eax, [ebp - 0x8c]
push 0x521a88
push eax
mov ebx, VariantInit
call fcn.0040b790
add esp, 0xc
push eax
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 3
call fcn.00402b30
mov edx, dword [ebp - 0x8c]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x430b59
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
mov byte [ebp - 4], 4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x8c], eax
mov eax, str.Software_
mov byte [ebp - 4], 5
test eax, 0xffff0000
jne 0x430bc2
movzx esi, ax
push 0
push esi
call fcn.00403bc0
add esp, 8
test eax, eax
je 0x430bd2
push esi
push eax
lea ecx, [ebp - 0x8c]
call fcn.004075c0
jmp 0x430bd2
push str.Software_
lea ecx, [ebp - 0x8c]
call fcn.0040b480
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x98]
push eax
mov byte [ebp - 4], 6
call fcn.0040b6d0
push 0x521a8c
push eax
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 4], 7
call fcn.0040b6d0
push 0x4da458
push eax
lea eax, [ebp - 0xa4]
push eax
mov byte [ebp - 4], 8
call fcn.0040b790
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0xb4]
push eax
mov byte [ebp - 4], 9
call fcn.0040b6d0
add esp, 0x30
lea ecx, [ebp - 0xb0]
push 0x20019
push dword [eax]
push ebx
call fcn.0040bf80
mov edx, dword [ebp - 0xb4]
test eax, eax
setne bl
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x430c6b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa4]
add edx, 0xfffffff0
mov byte [ebp - 4], 8
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x430c8e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x94]
add edx, 0xfffffff0
mov byte [ebp - 4], 7
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x430cb1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x98]
add edx, 0xfffffff0
mov byte [ebp - 4], 6
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x430cd4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x8c]
add edx, 0xfffffff0
mov byte [ebp - 4], 4
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x430cf7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0xb0]
test bl, bl
jne 0x430e3c
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x94]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0xa0], 0
push esi
mov dword [ebp - 0x98], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x430d69
cmp dword [ebp - 0x94], 4
jne 0x430d69
test esi, esi
je 0x430d54
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0xa0]
mov dword [ecx], eax
mov bl, 1
jmp 0x430e3e
mov ebx, dword [0x521340]
mov eax, ebx
imul eax, ebx
cdq
mov ecx, 0x15
idiv ecx
cmp edx, 8
jne 0x430d97
call fcn.004a8009
mov ebx, dword [0x521340]
cmp ebx, eax
jne 0x430d97
dec ebx
mov dword [0x521340], ebx
test esi, esi
je 0x430daa
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [0x521340]
xor esi, esi
mov eax, ebx
imul eax, ebx
cdq
mov ecx, 0x16
idiv ecx
cmp edx, 0x15
jne 0x430e3c
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x90], eax
mov eax, 0x66666667
imul ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x90], eax
mov eax, 0x2aaaaaab
imul ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x90], eax
mov eax, 0x92492493
imul ebx
add edx, ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
xor ecx, ecx
add eax, edx
mov dword [ebp - 0x90], eax
nop
mov dword [ebp + ecx*8 - 0x88], 0
mov dword [ebp + ecx*8 - 0x84], 0
inc ecx
cmp ecx, 0xf
jl 0x430e20
xor bl, bl
test esi, esi
je 0x430e49
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x9c]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x430e6c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x430e8c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 0xc]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x430ead
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret