Function at 0x430d00
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x45a5f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
push ebp
push esi
push edi
mov edi, 0x104
push edi
call fcn.0044c0b7
push edi
mov ebp, eax
call fcn.0044c0b7
push edi
mov ebx, eax
call fcn.0044c0b7
mov dword [esp + 0x3c], eax
mov eax, dword [0x471df4]
add esp, 0xc
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x250], 0
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x25c]
mov edx, dword [esp + 0x258]
lea eax, [esp + 0x20]
mov byte [esp + 0x250], 1
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x20]
mov esi, eax
lea eax, [esp + 0x144]
push edi
push eax
push 0
push ecx
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x430f72
mov edi, dword [esp + 0x25c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x46a404
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x40]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x144]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x258]
and ecx, 3
lea eax, [esp + 0x2c]
rep movsb byte es:[edi], byte [esi]
push eax
push 0x20019
lea ecx, [esp + 0x48]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x28]
push ebx
push ecx
lea edx, [esp + 0x28]
push 0
push edx
push ebp
push 0
push eax
mov dword [esp + 0x48], 0
mov esi, 1
call edi
test eax, eax
jne 0x430f42
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x430f42
mov eax, dword [esp + 0x260]
test eax, eax
jne 0x430eab
push ebp
jmp 0x430eac
push ebx
lea ecx, [esp + 0x14]
call fcn.0044a511
cmp dword [esp + 0x24], 1
jne 0x430ec5
lea ecx, [esp + 0x10]
call fcn.0044a88a
mov ecx, dword [esp + 0x264]
lea edx, [esp + 0x10]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
call fcn.0044a149
call fcn.0042fed0
add esp, 8
test eax, eax
je 0x430f0f
mov ecx, dword [esp + 0x258]
lea eax, [esp + 0x40]
push eax
push ecx
call fcn.00430ab0
add esp, 8
test eax, eax
je 0x430f07
dec dword [esp + 0x14]
mov dword [esp + 0x28], 1
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
push edx
mov eax, 0x104
push ebx
push ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
push 0
mov eax, esi
push edx
push ebp
push eax
mov eax, dword [esp + 0x48]
inc esi
push eax
call edi
test eax, eax
je 0x430e91
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov eax, ecx
inc ecx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x144]
push 0x104
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x430db3
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0044c0e0
push ebx
call fcn.0044c0e0
mov ecx, dword [esp + 0x38]
push ecx
call fcn.0044c0e0
add esp, 0xc
lea ecx, [esp + 0x38]
mov byte [esp + 0x250], 0
call fcn.0044a3d4
lea ecx, [esp + 0x10]
mov dword [esp + 0x250], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x248]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x244
ret