Function at 0x430bda
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov ebx, ecx
cmp dword [0x442534], 0xffffffff
push edi
mov dword [ebp - 0x41c], esi
jne 0x430c0e
push ecx
push 3
pop edx
call fcn.0041e30f
push 3
mov edx, 0x408004
pop ecx
call fcn.0041e767
cmp dword [ebx + 0x10], esi
je 0x430c2a
push dword [ebx + 0x10]
mov ecx, ebx
call fcn.004309cf
lea eax, [ebp - 0x41c]
push eax
push 1
push esi
push 0x401690
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 4
pop edi
test eax, eax
jne 0x430f19
lea eax, [ebp - 0x424]
mov dword [ebp - 0x428], esi
push eax
lea eax, [ebp - 0x428]
mov dword [ebp - 0x420], edi
push eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], edi
push eax
push esi
push 0x408030
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x430dcb
cmp dword [ebp - 0x428], 1
jne 0x430dcb
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push 0x408068
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x430dcb
cmp dword [ebp - 0x420], 1
jne 0x430dcb
mov edi, dword [ebx + 8]
lea eax, [ebp - 0x210]
mov ecx, 0x4015d0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x430d17
test dx, dx
je 0x430d13
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x430d17
add eax, 4
add ecx, 4
test dx, dx
jne 0x430cf1
mov eax, esi
jmp 0x430d1c
sbb eax, eax
or eax, 1
test eax, eax
je 0x430db5
jmp 0x430d4e
mov eax, dword [edi]
test eax, eax
je 0x430d52
mov eax, dword [eax]
test eax, eax
jne 0x430d37
mov eax, 0x4015d0
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x430d6c
mov edi, dword [edi + 4]
test edi, edi
jne 0x430d26
push 0xb8
call fcn.00440dbc
pop ecx
test eax, eax
je 0x430d7a
mov ecx, eax
call fcn.0042d6bf
mov edi, eax
jmp 0x430d7c
mov eax, dword [edi]
mov dword [eax + 0x8c], 1
jmp 0x430db5
mov edi, esi
test edi, edi
je 0x430db5
lea edx, [ebp - 0x210]
mov ecx, edi
call fcn.0041eb99
mov dword [edi + 0x8c], 1
test eax, eax
jne 0x430da7
push edi
mov ecx, ebx
call fcn.0042eb4d
test eax, eax
je 0x430db5
mov ecx, edi
call fcn.0042d77a
push edi
call fcn.00440de5
pop ecx
lea eax, [ebp - 0x210]
push eax
push 0x40809c
push 3
call fcn.0041e83a
add esp, 0xc
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push 0x401f8c
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x430f0a
cmp dword [ebp - 0x420], 1
jne 0x430f0a
mov edi, dword [ebx + 8]
lea eax, [ebp - 0x210]
mov ecx, 0x4015d0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x430e45
test dx, dx
je 0x430e41
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x430e45
add eax, 4
add ecx, 4
test dx, dx
jne 0x430e1f
mov eax, esi
jmp 0x430e4a
sbb eax, eax
or eax, 1
test eax, eax
je 0x430ef4
jmp 0x430e7c
mov eax, dword [edi]
test eax, eax
je 0x430e80
mov eax, dword [eax]
test eax, eax
jne 0x430e65
mov eax, 0x4015d0
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x430e9a
mov edi, dword [edi + 4]
test edi, edi
jne 0x430e54
push 0xb8
call fcn.00440dbc
pop ecx
test eax, eax
je 0x430ea8
mov ecx, eax
call fcn.0042d6bf
mov edi, eax
jmp 0x430eaa
mov eax, dword [edi]
mov dword [eax + 0x90], 1
jmp 0x430ef4
mov edi, esi
test edi, edi
je 0x430ef4
lea edx, [ebp - 0x210]
mov ecx, edi
call fcn.0041eb99
mov dword [edi + 0x90], 1
test eax, eax
jne 0x430ee6
push esi
mov ecx, edi
call fcn.0042dbd3
test eax, eax
je 0x430edf
push edi
mov ecx, ebx
call fcn.0042eb4d
jmp 0x430ee2
xor eax, eax
inc eax
test eax, eax
je 0x430ef4
mov ecx, edi
call fcn.0042d77a
push edi
call fcn.00440de5
pop ecx
lea eax, [ebp - 0x210]
push eax
push 0x4080bc
push 3
call fcn.0041e83a
add esp, 0xc
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
pop edi
lea eax, [ebp - 0x41c]
push eax
push 1
push esi
push 0x401690
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43106b
lea eax, [ebp - 0x420]
mov dword [ebp - 0x428], edi
push eax
lea eax, [ebp - 0x418]
mov dword [ebp - 0x420], 0x208
push eax
lea eax, [ebp - 0x428]
push eax
push esi
push 0x4080dc
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43105f
cmp dword [ebp - 0x428], 1
jne 0x43105f
mov ecx, 0x4015d0
lea eax, [ebp - 0x418]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x430fb6
test dx, dx
je 0x430fb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x430fb6
add eax, edi
add ecx, edi
test dx, dx
jne 0x430f92
mov eax, esi
jmp 0x430fbb
sbb eax, eax
or eax, 1
test eax, eax
je 0x43105f
mov edi, dword [ebx + 8]
jmp 0x430ff4
mov eax, dword [edi]
test eax, eax
je 0x430ff8
mov eax, dword [eax]
test eax, eax
jne 0x430fd9
mov eax, 0x4015d0
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x43107a
mov edi, dword [edi + 4]
test edi, edi
jne 0x430fc8
push 0xb8
call fcn.00440dbc
pop ecx
test eax, eax
je 0x431010
mov ecx, eax
call fcn.0042d6bf
mov esi, eax
test esi, esi
je 0x431049
lea edx, [ebp - 0x418]
mov ecx, esi
call fcn.0041eb99
mov dword [esi + 0x94], 1
test eax, eax
jne 0x43103b
push esi
mov ecx, ebx
call fcn.0042eb4d
test eax, eax
je 0x431049
mov ecx, esi
call fcn.0042d77a
push esi
call fcn.00440de5
pop ecx
lea eax, [ebp - 0x418]
push eax
push 0x408108
push 3
call fcn.0041e83a
add esp, 0xc
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave
ret
mov eax, dword [edi]
mov dword [eax + 0x94], 1
jmp 0x431049