Function at 0x10030430
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x10065b1b
call fcn.10064328
sub esp, 0x8c
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov esi, edx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], ebx
call fcn.1002cc88
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.100309d1
mov dword [ebp - 4], ebx
xor edx, edx
mov dword [ebp - 0x10], 0x7647f1a9
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0x7d2a
mov dword [ebp - 0x20], 0xfff7
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
je 0x100304d0
cmp dword [ebp - 0x18], ebx
je 0x100304d0
xor edx, edx
inc edx
jmp 0x100304d2
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
add ecx, 0xcd50
cmp ecx, 0x9ab83eb6
setne dl
xor eax, eax
cmp edx, 0xfffffffd
setne al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1003053e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x38]
add esi, 0xffffba34
mov ecx, edx
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x10030577
cmp dword [eax + 0x10], esi
jge 0x1003055c
mov eax, dword [eax + 8]
jmp 0x10030560
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10030552
cmp ecx, edx
je 0x10030577
cmp esi, dword [ecx + 0x10]
jl 0x10030577
mov dword [ebp - 0x30], ecx
lea esi, [ebp - 0x30]
jmp 0x1003057d
mov dword [ebp - 0x28], edx
lea esi, [ebp - 0x28]
mov esi, dword [esi]
lea ecx, [ebp - 0x50]
push 2
pop ebx
push ebx
mov dword [ebp - 0x20], esi
call fcn.100038f5
mov dword [ebp - 0x10], 0
jmp 0x100305a7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], 0xe0a8eac8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10030597
mov dword [ebp - 0x10], 0
jmp 0x100305c3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x44], 0xb6f65e79
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100305b5
mov edx, dword [ebp - 0x50]
xor eax, eax
mov dword [edx], 0xfffffffa
cmp dword [edx + 4], 0x29729cf3
setne al
xor ecx, ecx
cmp eax, dword [edx + 4]
setl cl
mov dword [edx + 4], ecx
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
imul edx, ecx
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x50]
call fcn.10003978
mov dword [ebp - 0x14], 0x51b9
cmp dword [ebp - 0x14], 0x51e4
jle 0x10030681
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
lea ecx, [ebp - 0x68]
cdq
idiv ebx
or edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001b14
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003063b
mov eax, dword [eax]
push eax
call fcn.1004c11f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.10003c82
inc ebx
cmp ebx, 0x471d
jl 0x1003061d
inc edi
cmp edi, 0x369
jl 0x1003061b
inc esi
cmp esi, 0x1db
jl 0x10030619
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x2c]
push 2
pop ebx
mov eax, dword [0x10705ad0]
test al, 1
jne 0x100306b6
and dword [0x10705ac8], 0
or eax, 1
mov dword [0x10705ad0], eax
xor eax, eax
push 0x100666e5
mov dword [0x10705acc], 7
mov word [0x10705ab8], ax
call fcn.1004c0f5
pop ecx
cmp dword [ebp - 0x14], 0x4eeb
jge 0x100306ca
push str.zswjgpx_mpnc_qtmunmgom_ondea_oiazqk_fyiubhj_fig_vnjktweoa_kzmesfws_yovrx
call fcn.1004c11f
pop ecx
and dword [ebp - 4], 0
cmp esi, dword [ebp - 0x38]
je 0x100306ee
push dword [esi + 0x18]
mov edx, dword [esi + 0x14]
lea ecx, [ebp - 0x98]
call fcn.10027449
pop ecx
xor ebx, ebx
mov byte [ebp - 4], 3
inc ebx
jmp 0x10030702
push 0x10705ab8
lea ecx, [ebp - 0x80]
call fcn.10003893
mov dword [ebp - 4], 4
push eax
mov ecx, edi
mov dword [ebp - 0x24], ebx
call fcn.10003893
or ebx, 4
test bl, 2
je 0x10030724
push 0
push 1
lea ecx, [ebp - 0x80]
and ebx, 0xfffffffd
call fcn.1000418d
test bl, 1
je 0x10030738
push 0
push 1
lea ecx, [ebp - 0x98]
call fcn.1000418d
lea ecx, [ebp - 0x38]
call fcn.1002577c
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret