Function at 0x430db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df766
mov eax, dword fs:[0]
push eax
sub esp, 0xc58
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x800
mov dword [ebp - 0xc60], eax
lea eax, [ebp - 0xc20]
push 0
push eax
mov dword [ebp - 0xc54], 0
call fcn.00480620
add esp, 0xc
mov dword [ebp - 0xc58], 0x800
xor eax, eax
mov dword [ebp - 0xc64], 1
mov dword [ebp - 0xc5c], eax
call fcn.00452215
test al, al
je 0x430e47
int 0xed
sub byte [esp + esi*4 + 0x30670a33], ah
sti
sal byte [eax], cl
push edx
arpl cx, bp
je 0x430e96
cld
xchg esi, eax
dec edi
lds esp, [esi]
clc
hlt
call fcn.004520bc
test al, al
je 0x430e6e
popfd
pop edx
sub dword [edx - 0x2a], ebx
add al, 0x50
sub al, 0x53
fisubr word [edi - 0xc]
cmc
into
ja 0x430ea2
invalid
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00480620
push 0x5e6c34
push str._shellexContextMenuHandlers_
lea eax, [ebp - 0x218]
push 0x5e9d58
push eax
call fcn.00407df0
push 0x5e6c34
push str._shellexDragDropHandlers_
lea eax, [ebp - 0x420]
push 0x5e9d58
push eax
call fcn.00407df0
add esp, 0x38
call fcn.004520bc
test al, al
je 0x430ef5
insb byte es:[edi], dx
pop esi
add byte [eax + 0x18], ch
popfd
pop esi
add byte [ebp - 0x2177b], cl
jmp [eax + 0x58]
invalid
into
xchg esi, eax
or byte [edx], dh
movsd dword es:[edi], dword [esi]
push ax
xor al, 0x4c
dec eax
outsb dx, byte [esi]
fild dword [esi - 0x73]
loopne 0x430ee4
leave
sub al, 0x65
add edx, dword [ebx + 0x186b57dc]
adc eax, 0x4fbb8545
mov esi, dword [ebp - 0xc60]
lea ecx, [ebp - 0xc50]
xor eax, eax
mov dword [ebp - 0xc3c], 7
push 0xffffffffffffffff
push eax
push esi
mov dword [ebp - 0xc40], 0
mov word [ebp - 0xc50], ax
call fcn.004029a0
cmp word [ebp - 0x218], 0
mov dword [ebp - 4], 0
jne 0x430f3c
xor ecx, ecx
jmp 0x430f54
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430f45
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xc50]
call fcn.00405c20
xor eax, eax
mov dword [ebp - 0xc24], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0xc38]
mov dword [ebp - 0xc28], 0
mov word [ebp - 0xc38], ax
call fcn.004029a0
cmp word [ebp - 0x420], 0
mov byte [ebp - 4], 1
jne 0x430fa5
xor ecx, ecx
jmp 0x430fbf
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430fb0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xc38]
call fcn.00405c20
call fcn.0045236e
test al, al
je 0x430ff2
std
invalid
ret
call fcn.00452101
test al, al
je 0x431013
adc eax, 0x48734c86
ja 0x43104f
sbb byte [esi + 0x53967ea8], dl
cmp ah, byte [ecx + 0x79]
lahf
jle 0x430fd0
jge 0x43108e
xor dword [edx + 0x21173e8], ebp
add byte [eax + eax*8 - 0x24f0e78c], al
sal dword [ecx], 1
sahf
call fcn.0045218b
test al, al
je 0x431034
pand mm2, mm1
xor dword [edi - 0x62], esp
xor byte [ebp + ebp*8 + 0x6c7969ac], dh
sub byte [esi + 0x24], cl
sbb ch, byte [edx]
fdiv qword [ebx - 0x67]
imul edi, dword [edi - 0x3b427c9b], 0x8fffff3
cmp dword [ebp - 0xc3c], 8
lea ecx, [ebp - 0xc54]
push ecx
push 0xf013f
lea eax, [ebp - 0xc50]
cmovae eax, dword [ebp - 0xc50]
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
call fcn.00452329
test dword [eax + 0x6afffff3], esi
add byte [eax + 0x68], dl
add byte [eax], al
add byte [eax + 0x600c15ff], al
pop esi
add byte [ebx + 0x12c0e8d8], cl
add al, byte [eax]
test al, al
je 0x43107f
and ebp, ecx
fmul qword [ecx + 0x5f]
xchg esp, eax
call 0x447bfd8
inc ecx
test eax, 0x5be150ef
adc dword [ebp - 0x72908a25], eax
test dword [eax + 0x50fffff3], ebp
test ebx, ebx
jne 0x4310f2
lea eax, [ebp - 0xc58]
push eax
lea eax, [ebp - 0xc20]
push eax
lea eax, [ebp - 0xc64]
push eax
push ebx
push 0x5e6948
push dword [ebp - 0xc54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
lea eax, [ebp - 0xc20]
invalid
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4310db
test dx, dx
je 0x4310d7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4310db
add eax, 4
add ecx, 4
test dx, dx
jne 0x4310b5
xor eax, eax
jmp 0x4310e0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4311f6
mov dword [ebp - 0xc5c], 1
push dword [ebp - 0xc54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x800
lea eax, [ebp - 0xc20]
mov dword [ebp - 0xc54], 0
push 0
push eax
call fcn.00480620
add esp, 0xc
mov dword [ebp - 0xc58], 0x800
call fcn.00452596
test al, al
je 0x431141
xchg ebp, eax
scasb al, byte es:[edi]
mov cl, 8
or dl, byte [ebx]
inc ecx
sbb eax, 0xeb6331a6
arpl word [ebx - 0x427c19f6], bx
fdivr st(3), st(0)
invalid
cmp dword [ebp - 0xc24], 8
lea ecx, [ebp - 0xc54]
push ecx
push 0xf013f
lea eax, [ebp - 0xc38]
cmovae eax, dword [ebp - 0xc38]
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xc60], eax
call fcn.004524c7
test al, al
je 0x431190
inc ebx
les edi, [ebx + 0x54]
inc edi
adc dword [ecx + 0x4726ae8f], esp
in al, dx
xchg byte [eax - 0x1b7cd3de], dl
cmp dword [ebp - 0xc60], 0
jne 0x431210
lea eax, [ebp - 0xc58]
push eax
lea eax, [ebp - 0xc20]
push eax
lea eax, [ebp - 0xc64]
push eax
push 0
push 0x5e6948
push dword [ebp - 0xc54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
lea eax, [ebp - 0xc20]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4311fd
test dx, dx
je 0x4311f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4311fd
add eax, 4
add ecx, 4
test dx, dx
jne 0x4311d0
xor eax, eax
jmp 0x431202
xor ebx, ebx
jmp 0x431315
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4311f6
mov dword [ebp - 0xc5c], 1
call fcn.004523f8
test al, al
je 0x431234
sub al, 0xf4
mov edx, 0xf92e964e
xchg edx, eax
cmp dh, cl
mov edi, 0xc13e51ac
push esi
salc
iretd
call fcn.0045225a
test al, al
je 0x431252
fldenv [ecx - 0x5db37557]
mov ch, 0xdd
pmulhuw mm2, mm2
pop esi
sahf
invalid
call fcn.004523b3
test al, al
je 0x43126d
cmp byte [esi + 3], al
add dword [ebp - 0x875e147], ebx
loopne 0x431293
mov ebx, 0xf9d10724
iretd
push dword [ebp - 0xc54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x800
lea eax, [ebp - 0xc20]
mov dword [ebp - 0xc54], 0
push 0
push eax
call fcn.00480620
add al, 0
add esp, 0xc
mov dword [ebp - 0xc58], 0x800
call fcn.004522e4
test al, al
je 0x4312c0
push ebp
push 0xe3a7f7f1
mov ecx, 0x6752218e
jno 0x431248
mov ebx, 0x217ca065
shr dword [eax + ebp*8], cl
cmp al, 0xe
add al, byte [eax]
call fcn.00452101
test al, al
je 0x4312e7
int1
cmpsd dword [esi], dword es:[edi]
push 0xffffffffffffffb0
mov ecx, 0x9cb5927
scasb al, byte es:[edi]
lodsd eax, dword [esi]
and dword [eax + 0x76], esp
insd dword es:[edi], dx
push es
lock xor dword [esi + 0x51], esi
push ebp
out 0xa0, eax
mov edi, 0xcdd2ed0c
mov ah, 0x2c
call fcn.004521d0
test al, al
je 0x43130f
jbe 0x43135e
mov dword [eax + 0x205477cc], 0xf9e11d4d
jle 0x431338
mov al, 0xbb
mov edi, 0x52586a19
sub al, 0x3d
iretd
mov ebx, dword [ebp - 0xc5c]
push dword [ebp - 0xc54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc54], 0
call fcn.00451f63
test al, al
je 0x431344
pop edx
push esi
dec esp
pop edx
pop edx
and al, 0xb
add eax, 0x822ffe46
pop eax
aad 0xc
mov esi, 0xf3dc858b
invalid
mov eax, dword [ebp - 0xc24]
test ebx, ebx
setne bl
cmp eax, 8
jb 0x431367
inc eax
lea ecx, [ebp - 0xc38]
push eax
push dword [ebp - 0xc38]
enter 0xfffffffffffffff3, 0xffffffffffffffff
call fcn.00402c10
mov ecx, dword [ebp - 0xc3c]
xor eax, eax
mov dword [ebp - 0xc24], 7
mov dword [ebp - 0xc28], 0
mov word [ebp - 0xc38], ax
cmp ecx, 8
jb 0x4313a2
inc ecx
push ecx
push dword [ebp - 0xc50]
lea ecx, [ebp - 0xc50]
call fcn.00402c10
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret 4