Function at 0x431160
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c956c
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
mov eax, dword [0x51fee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1b8], 0
mov eax, dword [0x51fab0]
xor ebx, ebx
cmp byte [0x52195c], bl
mov ecx, 0x51fab0
sete bl
mov dword [ebp - 4], 1
add ebx, 0x80000001
mov dword [ebp - 0x1b0], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1bc], eax
or edi, 0xffffffff
cmp byte [ebp + 0x14], 0
mov byte [ebp - 4], 2
je 0x431250
cmp byte [0x51b24c], 0
jne 0x431250
mov eax, dword [0x521a88]
cmp dword [eax - 0xc], 0
jne 0x4311fd
mov esi, SysReAllocStringLen
jmp 0x431256
push 0x4da458
lea eax, [ebp - 0x1b4]
push 0x521a88
push eax
mov esi, VariantInit
call fcn.0040b790
add esp, 0xc
push eax
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 3
call fcn.00402b30
mov edx, dword [ebp - 0x1b4]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x431256
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x431256
mov esi, dword [ebp - 0x1b0]
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1c0], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 4
cmp dword [eax - 0xc], 0
je 0x4312aa
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1dc]
push 0x4da458
push eax
call fcn.0040b870
add esp, 0xc
mov dword [ebp - 0x1b4], eax
mov byte [ebp - 4], 5
mov ebx, 1
jmp 0x4312cc
push 0x4d9c60
lea ecx, [ebp - 0x1e0]
call fcn.00401ff0
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 4], 6
mov ebx, 2
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
mov dword [ebp - 0x1b8], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1b0], eax
mov eax, str.Software_
mov dword [ebp - 4], 7
test eax, 0xffff0000
jne 0x431324
movzx eax, ax
push 0
push eax
call fcn.00403bc0
add esp, 8
test eax, eax
je 0x431334
mov edx, str.Software_
movzx ecx, dx
push ecx
push eax
lea ecx, [ebp - 0x1b0]
call fcn.004075c0
jmp 0x431334
push str.Software_
lea ecx, [ebp - 0x1b0]
call fcn.0040b480
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x1d8]
push eax
mov dword [ebp - 4], 8
call fcn.0040b6d0
push 0x521a8c
push eax
lea eax, [ebp - 0x1d0]
push eax
mov byte [ebp - 4], 9
call fcn.0040b6d0
push dword [ebp - 0x1b4]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.0040b6d0
add esp, 0x24
mov edx, dword [ebp - 0x1d0]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xc
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4313a8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1d8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xd
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4313cb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1b0]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xe
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4313ee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xf
test bl, 2
je 0x43141f
mov edx, dword [ebp - 0x1e0]
add edx, 0xfffffff0
and ebx, 0xfffffffd
mov dword [ebp - 0x1b8], ebx
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x43141f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x10
test bl, 1
je 0x431447
mov edx, dword [ebp - 0x1dc]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x431447
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.004325f0
mov ecx, dword [0x521960]
push 0x20019
push dword [ebp - 0x1cc]
mov edx, 0xdee46a8
test al, al
cmove ecx, edx
mov dword [0x521960], ecx
push esi
lea ecx, [ebp - 0x1c8]
call fcn.0040bf80
test eax, eax
jne 0x4316ac
xor ecx, ecx
mov eax, 0x400
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a63b0
push 0x800
mov esi, eax
push 0
push esi
mov dword [ebp - 0x1b8], esi
call fcn.004a8550
mov ebx, dword [0x521340]
add esp, 0x10
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
cdq
mov ecx, 0x12
idiv ecx
cmp edx, 0xf
jne 0x4314e4
xor esi, esi
mov edi, ebx
inc esi
dec edi
cmp esi, 0x67
jb 0x4314d7
mov esi, dword [ebp - 0x1b8]
mov edi, dword [ebp - 0x1c8]
lea eax, [ebp - 0x1b4]
push eax
push esi
lea eax, [ebp - 0x1b0]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x1b4], 0x800
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x431542
mov eax, dword [ebp - 0x1b0]
cmp eax, 1
je 0x431523
cmp eax, 2
jne 0x431542
mov ebx, dword [ebp - 0x1b4]
test esi, esi
je 0x4315a5
test ebx, ebx
je 0x4315a0
test bl, 1
jne 0x431542
mov eax, ebx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x4315a5
test edi, edi
je 0x431555
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x1c8], edi
mov esi, dword [0x521340]
mov ecx, 0x14
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
mov dword [ebp - 0x1c4], 0
cmp edx, 8
jne 0x431649
test esi, esi
je 0x431649
mov ecx, esi
and ecx, 0x80000001
jns 0x431593
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x431603
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x43160a
xor eax, eax
mov word [esi], ax
shr ebx, 1
test edi, edi
je 0x4315ba
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x1c8], edi
xor eax, eax
mov dword [ebp - 0x1c4], 0
mov word [esi + ebx*2], ax
test esi, esi
jne 0x4315d2
xor ecx, ecx
jmp 0x4315e6
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4315d7
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x1d4]
push esi
call fcn.004097a0
push esi
call fcn.004a8200
add esp, 4
mov bl, 1
jmp 0x4316b4
lea esi, [esi*2 + 1]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*2]
sub ecx, eax
mov dword [0x521340], esi
sub ecx, 0
je 0x431634
sub ecx, 2
je 0x431637
dec ecx
je 0x431638
jmp 0x431641
add esi, 2
inc esi
add esi, 2
mov dword [0x521340], esi
test esi, esi
jne 0x431584
push dword [ebp - 0x1b8]
call fcn.004a8200
mov esi, dword [0x521340]
mov eax, esi
imul eax, esi
cdq
mov ecx, 0x15
idiv ecx
add esp, 4
cmp edx, 0xb
jne 0x4316b2
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x141]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a63b0
push eax
call fcn.004a8200
add esp, 8
jmp 0x4316b2
mov edi, dword [ebp - 0x1c8]
xor bl, bl
mov edx, dword [ebp - 0x1cc]
add edx, 0xfffffff0
or esi, 0xffffffff
mov byte [ebp - 4], 4
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4316da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x4316e5
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x1bc]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x431708
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x431728
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp + 0xc]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x431749
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret