Function at 0x430e26
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x848
mov eax, 0x5a43b2
call fcn.0043a209
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor esi, esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp + 0x1c]
push eax
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x844], edi
mov dword [ebp - 0x854], esi
call fcn.00403820
mov dword [ebp - 4], esi
mov dword [ebp - 0x82c], esi
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], esi
call fcn.0043d81c
test al, al
je 0x430ec6
adc dword [eax], ecx
movsb byte es:[edi], byte [esi]
push ebp
ret
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push esi
push dword [ebp - 0x840]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x430f0e
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00425c2a
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.004253f2
mov eax, ebx
jmp 0x43117d
invalid
lea eax, [ebp - 0x83c]
push eax
push 0x20119
push 0
push 0x5a8224
push dword [ebp - 0x82c]
call esi
test eax, eax
je 0x430f3b
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x430eea
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push edi
push dword [ebp - 0x83c]
call esi
mov dword [ebp - 0x840], eax
call fcn.0043d342
test al, al
je 0x430f75
loop 0x430f00
cmovp ebx, dword [edi + 0x6a2c4834]
salc
pop ebx
cmp byte [edx - 0x3b942766], dh
xor al, 0xa
pop esp
call fcn.0043d5f4
test al, al
je 0x430f9a
pop edx
inc edx
xchg esp, eax
cdq
inc ebx
push ebp
lodsd eax, dword [esi]
pushal
push cs
ja 0x430f39
cmp byte [esi + 0x26], ah
push 0xaaa8cd18
sub ch, byte [ecx - 0x198fc9f2]
jb 0x430f88
call fcn.0043d81c
test al, al
je 0x430fb8
loopne 0x431004
inc esp
cmpsb byte [esi], byte es:[edi]
int 0xd6
cli
xchg edx, ebp
xor ebp, dword [eax - 0x18]
outsd dx, dword [esi]
mov cl, 0xae
jo 0x431004
pop ecx
inc ebp
pop ecx
int1
cmp dword [ebp - 0x840], 0
je 0x430fee
push dword [ebp - 0x83c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x828]
push eax
call fcn.00425c2a
jmp 0x431168
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push dword [ebp - 0x848]
push dword [ebp - 0x838]
enter 0xfffffffffffffff7, 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x431028
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
jmp 0x430fcd
call fcn.0043d81c
test al, al
je 0x431045
jl 0x431037
pushal
out 0x22, al
nop
ret
and dword [ebx + 0x2f5998cd], ecx
dec eax
call fcn.0043d49b
test al, al
je 0x431065
adc dword [ebx], edi
or al, 0x50
pop ecx
jno 0x43103e
invalid
call fcn.0043d342
test al, al
je 0x431089
jg 0x431082
sahf
imul edi, dword [ebp + 0xa], 0x8eccead8
outsb dx, byte [esi]
sti
clc
cli
push ebp
pop esp
ret
dec ebp
mov ebp, 0x8f9f44e9
in al, 0x68
add byte [eax], cl
add byte [eax], al
push 0x800
xor ebx, ebx
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00446360
add esp, 0xc
mov dword [ebp - 0x84c], 0x400
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x850]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0x838]
call ebx
call fcn.0043d81c
test al, al
je 0x43110c
push ebp
in al, dx
mov al, byte [0x6e482394]
xlatb
cmp ah, ah
test al, 0xd7
stosb byte es:[edi], al
mov edx, 0xf348a2bb
pop es
adc al, 0xf2
sbb byte [eax + 0x6eb77d34], al
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x83c]
call ebx
push dword [ebp - 0x82c]
call ebx
call fcn.0043d74d
test al, al
je 0x431141
fldcw word [eax + 0x1a]
cmp ecx, dword [edx - 0x625c2786]
mov bh, 0xcf
test al, 0x5c
mov byte [0x8495e2b1], al
mov eax, es
add eax, 0x33077664
cmp edi, esp
inc ebp
lea eax, [ebp - 0x810]
push eax
call fcn.004549d7
pop ecx
mov ecx, dword [ebp - 0x830]
test eax, eax
je 0x430fdd
lea eax, [ebp - 0x810]
push eax
call fcn.00403820
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.004253f2
mov eax, dword [ebp - 0x830]
call fcn.0043a1c4
ret