Function at 0x430340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7251
mov eax, dword fs:[0]
push eax
mov eax, 0x2658
call fcn.0045ea30
mov eax, dword [0x52965c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2630], 0
mov dword [ebp - 0x2640], 1
mov dword [ebp - 0x2660], 0
mov dword [ebp - 0x265c], 0
mov dword [ebp - 0x2658], 0
mov dword [ebp - 4], 0
call fcn.00405e40
mov ecx, eax
test ecx, ecx
je 0x430d99
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x264c], eax
push str.SOFTWARELudashi
lea ecx, [ebp - 0x264c]
mov byte [ebp - 4], 1
call fcn.00407260
test al, al
jne 0x4303f2
push 0x10
push str.SOFTWARELudashi
lea ecx, [ebp - 0x264c]
call fcn.004068a0
push 0x1000
lea eax, [ebp - 0x1628]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.00474bb0
mov edi, dword [ebp - 0x264c]
lea eax, [ebp - 0x2644]
add esp, 0xc
mov dword [ebp - 0x2644], 0
push eax
push 0x20219
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x430d5b
mov ebx, dword [ebp - 0x2644]
lea eax, [ebp - 0x262c]
push eax
lea eax, [ebp - 0x1628]
mov dword [ebp - 0x2660], ebx
push eax
lea eax, [ebp - 0x263c]
mov dword [ebp - 0x265c], 0x200
push eax
push 0
push 0x4f34a8
push ebx
mov dword [ebp - 0x262c], 0x2000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4304a7
mov eax, dword [ebp - 0x263c]
cmp eax, 1
je 0x430495
cmp eax, 2
jne 0x4304a7
cmp dword [ebp - 0x262c], 0
jne 0x4304a7
xor eax, eax
mov word [ebp - 0x1628], ax
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00474bb0
mov ecx, dword [0x52d948]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test ecx, ecx
jne 0x430523
push 0x528140
call esi
cmp dword [0x52d948], 0
jne 0x430512
push 0x20
call fcn.0045ea5d
add esp, 4
mov dword [ebp - 0x2654], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x430500
mov ecx, eax
call fcn.0041c7d0
mov ecx, eax
jmp 0x430502
xor ecx, ecx
mov byte [ebp - 4], 2
xchg dword [ebp - 0x263c], eax
mov dword [0x52d948], ecx
push 0x528140
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x52d948]
mov eax, dword [ecx]
lea edx, [ebp - 0x420]
push 0x104
push edx
lea edx, [ebp - 0x1628]
push edx
push ecx
call dword [eax + 4]
test eax, eax
jne 0x43056f
mov byte [ebp - 4], al
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x43055b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x430d77
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x430d77
push 0x1000
lea eax, [ebp - 0x2628]
push 0
push eax
call fcn.00474bb0
add esp, 0xc
mov dword [ebp - 0x262c], 0x2000
lea eax, [ebp - 0x262c]
push eax
lea eax, [ebp - 0x2628]
push eax
lea eax, [ebp - 0x263c]
push eax
push 0
push str.VendorID
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4305d8
mov eax, dword [ebp - 0x263c]
cmp eax, 1
je 0x4305c6
cmp eax, 2
jne 0x4305d8
cmp dword [ebp - 0x262c], 0
jne 0x4305d8
xor eax, eax
mov word [ebp - 0x2628], ax
mov ecx, dword [0x52dd98]
test ecx, ecx
jne 0x430638
push 0x529154
call esi
cmp dword [0x52dd98], 0
jne 0x430627
push 0x6c
call fcn.0045ea5d
add esp, 4
mov dword [ebp - 0x2654], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x430615
mov ecx, eax
call fcn.00429560
mov ecx, eax
jmp 0x430617
xor ecx, ecx
mov byte [ebp - 4], 2
xchg dword [ebp - 0x2654], eax
mov dword [0x52dd98], ecx
push 0x529154
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x52dd98]
call fcn.00429f30
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
lea esi, [eax - 0x10]
mov dword [ebp - 0x263c], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x430664
cmp ecx, dword [esi]
jne 0x430664
lock inc dword [eax]
jmp 0x430697
mov eax, dword [ecx]
lea ebx, [esi + 4]
push 2
push dword [ebx]
call dword [eax]
mov esi, eax
test esi, esi
je 0x430da3
mov eax, dword [ebx]
mov dword [esi + 4], eax
mov eax, dword [ebx]
inc eax
add eax, eax
push eax
push dword [ebp - 0x263c]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.00434ac0
add esp, 0x10
add esi, 0x10
mov dword [ebp - 0x2664], esi
mov ecx, dword [esi - 0x10]
lea eax, [esi - 0x10]
mov byte [ebp - 4], 6
mov dword [ebp - 0x263c], eax
test ecx, ecx
je 0x4306bf
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x4306d5
call fcn.00405e40
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x430da8
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [esi - 0xc]
add eax, 0x10
mov dword [ebp - 0x2630], 1
push esi
push 5
mov dword [ebp - 0x2638], eax
lea eax, [ebp - 0x2638]
push str.ex1
push eax
call fcn.004311b0
add esp, 0x14
mov esi, dword [ebp - 0x2638]
mov byte [ebp - 4], 7
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x430723
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x430739
call fcn.00405e40
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x430db2
mov eax, dword [ecx]
call dword [eax + 0xc]
push 5
push str.ex2
push dword [esi - 0xc]
add eax, 0x10
mov dword [ebp - 0x2630], 3
mov dword [ebp - 0x262c], eax
lea eax, [ebp - 0x262c]
push esi
push eax
call fcn.004311b0
lea eax, [ebp - 0x2628]
push eax
lea eax, [ebp - 0x262c]
push eax
lea eax, [ebp - 0x2650]
push eax
call fcn.00404e20
add esp, 0x20
mov dword [ebp - 0x2630], 1
mov edx, dword [ebp - 0x262c]
or ebx, 0xffffffff
mov byte [ebp - 4], 9
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4307b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xa
lea edx, [esi - 0x10]
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4307ce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00405e40
mov ecx, eax
test ecx, ecx
je 0x430dbc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2630], eax
push str.turn_pid
lea ecx, [ebp - 0x2630]
mov byte [ebp - 4], 0xb
call fcn.00407260
test al, al
jne 0x430815
push 8
push str.turn_pid
lea ecx, [ebp - 0x2630]
call fcn.004068a0
mov byte [ebp - 4], 0xc
call fcn.00405e40
mov ecx, eax
test ecx, ecx
je 0x430dc6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x262c], eax
push str.instnew
lea ecx, [ebp - 0x262c]
mov byte [ebp - 4], 0xd
call fcn.00407260
test al, al
jne 0x430860
push 7
push str.instnew
lea ecx, [ebp - 0x262c]
call fcn.004068a0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x2634], esp
mov dword [eax + 0x24], 0
mov ecx, dword [0x52d948]
mov eax, dword [ebp - 0x2650]
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x2638], eax
test ecx, ecx
jne 0x4308ee
push 0x528140
call esi
cmp dword [0x52d948], 0
jne 0x4308d7
push 0x20
call fcn.0045ea5d
add esp, 4
mov dword [ebp - 0x2648], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x4308c5
mov ecx, eax
call fcn.0041c7d0
mov ecx, eax
jmp 0x4308c7
xor ecx, ecx
mov byte [ebp - 4], 0xf
xchg dword [ebp - 0x2634], eax
mov dword [0x52d948], ecx
push 0x528140
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x52d948]
mov eax, dword [ebp - 0x2638]
push 0
push eax
lea eax, [ebp - 0x2630]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x262c]
push eax
call fcn.0041e4e0
mov edx, dword [ebp - 0x262c]
mov eax, ebx
mov byte [ebp - 4], 0xc
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430929
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2630]
mov eax, ebx
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43094a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00474bb0
add esp, 0xc
lea eax, [ebp - 0x628]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00474bb0
mov ecx, dword [0x52d948]
add esp, 0xc
test ecx, ecx
jne 0x4309ed
push 0x528140
call esi
cmp dword [0x52d948], 0
jne 0x4309dc
push 0x20
call fcn.0045ea5d
add esp, 4
mov dword [ebp - 0x2648], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x4309ca
mov ecx, eax
call fcn.0041c7d0
mov ecx, eax
jmp 0x4309cc
xor ecx, ecx
mov byte [ebp - 4], 0xa
xchg dword [ebp - 0x2634], eax
mov dword [0x52d948], ecx
push 0x528140
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x52d948]
mov eax, dword [ecx]
lea edx, [ebp - 0x218]
push 0x104
push edx
lea edx, [ebp - 0x628]
push edx
push ecx
call dword [eax + 4]
lea eax, [ebp - 0x262c]
mov dword [ebp - 0x2638], 0
push eax
lea eax, [ebp - 0x2638]
mov dword [ebp - 0x262c], 0
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x2630], 0
push eax
mov dword [ebp - 0x2634], 0
call fcn.004346b0
lea eax, [ebp - 0x2634]
push eax
lea eax, [ebp - 0x2630]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004346b0
mov eax, dword [ebp - 0x2638]
add esp, 0x18
sub eax, dword [ebp - 0x2630]
jne 0x430a7f
mov eax, dword [ebp - 0x262c]
sub eax, dword [ebp - 0x2634]
test eax, eax
jg 0x430af5
mov edx, dword [ebp - 0x2650]
mov eax, ebx
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430aa4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x263c]
mov eax, ebx
mov byte [ebp - 4], 2
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430ac2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x430adb
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2644]
test eax, eax
je 0x430d77
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x430d77
mov ecx, dword [0x52dd98]
test ecx, ecx
jne 0x430b55
push 0x529154
call esi
cmp dword [0x52dd98], 0
jne 0x430b44
push 0x6c
call fcn.0045ea5d
add esp, 4
mov dword [ebp - 0x2648], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x430b32
mov ecx, eax
call fcn.00429560
mov ecx, eax
jmp 0x430b34
xor ecx, ecx
mov byte [ebp - 4], 0xa
xchg dword [ebp - 0x2634], eax
mov dword [0x52dd98], ecx
push 0x529154
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x52dd98]
call fcn.0042b070
mov eax, dword [eax]
mov dword [ebp - 0x2638], eax
call fcn.00405e40
mov ecx, eax
test ecx, ecx
je 0x430dd0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2634], eax
push dword [ebp - 0x2638]
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x2634]
push str.ver__s__s__d
push eax
call fcn.004046e0
sub esp, 0x14
mov eax, esp
mov dword [ebp - 0x2648], esp
mov dword [eax + 0x24], 0
mov ecx, dword [0x52d948]
mov byte [ebp - 4], 0x14
test ecx, ecx
jne 0x430c1e
push 0x528140
call esi
cmp dword [0x52d948], 0
jne 0x430c0d
push 0x20
call fcn.0045ea5d
add esp, 4
mov dword [ebp - 0x2630], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x430bfb
mov ecx, eax
call fcn.0041c7d0
mov ecx, eax
jmp 0x430bfd
xor ecx, ecx
mov byte [ebp - 4], 0x14
xchg dword [ebp - 0x2630], eax
mov dword [0x52d948], ecx
push 0x528140
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x52d948]
mov esi, dword [ebp - 0x2634]
push 0
push 0
push esi
mov byte [ebp - 4], 0x13
call fcn.0041e240
cmp dword [ebp - 0x2638], 0
je 0x430cd5
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x2648], esp
mov dword [eax + 0x24], 0
mov ecx, dword [0x52d948]
mov byte [ebp - 4], 0x16
test ecx, ecx
jne 0x430cb9
push 0x528140
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x52d948], 0
jne 0x430ca8
push 0x20
call fcn.0045ea5d
add esp, 4
mov dword [ebp - 0x2640], eax
mov byte [ebp - 4], 0x17
test eax, eax
je 0x430c96
mov ecx, eax
call fcn.0041c7d0
mov ecx, eax
jmp 0x430c98
xor ecx, ecx
mov byte [ebp - 4], 0x16
xchg dword [ebp - 0x2640], eax
mov dword [0x52d948], ecx
push 0x528140
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x52d948]
push 0
push 0
push str.install_file_fail
mov byte [ebp - 4], 0x13
call fcn.0041e240
mov dword [ebp - 0x2640], 0
mov byte [ebp - 4], 0xa
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x430cf0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2650]
mov eax, ebx
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430d11
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x263c]
mov eax, ebx
mov byte [ebp - 4], 2
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430d2f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x430d48
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2644]
test eax, eax
je 0x430d77
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x430d77
mov byte [ebp - 4], 0
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x430d77
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x2640]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045e5d8
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004043b0
call fcn.00404a40
push 0x80004005
call fcn.004043b0
push 0x80004005
call fcn.004043b0
push 0x80004005
call fcn.004043b0
push 0x80004005
call fcn.004043b0
push 0x80004005
call fcn.004043b0
int3