Function at 0x430f14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
mov eax, dword [0x573510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x478], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push edi
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x470], esi
call fcn.0040c020
push esi
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x434], 7
call fcn.00403630
push 0x400000
call fcn.0040f000
xor edi, edi
inc edi
pop ecx
mov dword [ebp - 0x46c], eax
cmp eax, esi
je 0x430fa0
mov edx, dword [eax]
lea ecx, [ebp - 0x498]
push ecx
mov ecx, eax
call dword [edx + 0x30]
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x44c]
call fcn.00402d90
push esi
push edi
lea ecx, [ebp - 0x498]
call fcn.00402ea0
push ebx
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.004561f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x430]
call fcn.0040aa70
xor eax, eax
push ebx
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push esi
push eax
call fcn.004561f0
add esp, 0xc
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x470]
push eax
push 0x4c9c14
push 0x4c9b80
push 0x80000001
mov dword [ebp - 0x470], edi
mov dword [ebp - 0x474], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x468]
call fcn.0040aa70
push 0x4c9b50
lea eax, [ebp - 0x414]
push eax
push 0x56d178
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.00430bc4
add esp, 0xc
push eax
lea eax, [ebp - 0x4d0]
push eax
call fcn.00430bc4
add esp, 0xc
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.00430bc4
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x430]
call fcn.00402d90
push esi
push edi
lea ecx, [ebp - 0x498]
call fcn.00402ea0
push esi
push edi
lea ecx, [ebp - 0x4d0]
call fcn.00402ea0
push esi
push edi
lea ecx, [ebp - 0x4b4]
call fcn.00402ea0
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x4b4]
call fcn.004021a0
push eax
call fcn.00412d40
mov bl, al
neg bl
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x4b4]
inc bl
call fcn.0040e510
test bl, bl
pop ebx
jne 0x431183
cmp dword [ebp - 0x418], 8
mov eax, dword [ebp - 0x42c]
jae 0x43111b
lea eax, [ebp - 0x42c]
push esi
push 0x4c9b40
push 0x4c9b38
push eax
call fcn.00414150
add esp, 0x10
test al, al
je 0x431183
cmp dword [ebp - 0x418], 8
mov eax, dword [ebp - 0x42c]
jae 0x431148
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
je 0x431183
push 0x4c9b28
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x47c]
mov dword [0x576ec8], eax
cmp dword [ecx + 0x18], 8
jb 0x431175
mov ecx, dword [ecx + 4]
jmp 0x431178
add ecx, 4
push ecx
push dword [ebp - 0x478]
call eax
pop ecx
pop ecx
push esi
push edi
lea ecx, [ebp - 0x468]
call fcn.00402ea0
push esi
push edi
lea ecx, [ebp - 0x430]
call fcn.00402ea0
mov ecx, dword [ebp - 0x46c]
cmp ecx, esi
je 0x4311ac
mov eax, dword [ecx]
push edi
call dword [eax]
push esi
push edi
lea ecx, [ebp - 0x44c]
call fcn.00402ea0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045633d
leave
ret