Function at 0x41816d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x848
mov eax, 0x59ce21
call fcn.005693c7
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor esi, esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp + 0x1c]
push eax
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x844], edi
mov dword [ebp - 0x854], esi
call fcn.00402ac4
mov dword [ebp - 4], esi
mov dword [ebp - 0x82c], esi
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], esi
call fcn.0042af76
test al, al
je 0x41820d
dec edi
retf 0x48d0
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push esi
push dword [ebp - 0x840]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x418255
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00402a4c
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00403628
mov eax, ebx
jmp 0x4184c4
lea eax, [ebp - 0x83c]
push eax
push 0x20119
push 0
push str.SoftWare
push dword [ebp - 0x82c]
call esi
test eax, eax
je 0x418282
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x418231
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push edi
push dword [ebp - 0x83c]
call esi
mov dword [ebp - 0x840], eax
call fcn.0042aa9c
test al, al
je 0x4182bc
retf
call fcn.0042ad4e
test al, al
je 0x4182e1
push ecx
neg dword [esi - 0x39584f6e]
invalid
call fcn.0042af76
test al, al
je 0x4182ff
push esi
das
test byte [edi - 0x5df374c2], dl
dec esp
adc ebp, dword [ebx]
dec eax
mov edx, 0xef8a0b80
lodsb al, byte [esi]
cmp dword [edx - 0x6e], edx
cmp dword [ebp - 0x840], 0
je 0x418335
push dword [ebp - 0x83c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
mov ecx, dword [ebp - 0x830]
sal bh, 1
invalid
lea eax, [ebp - 0x828]
push eax
call fcn.00402a4c
jmp 0x4184af
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push dword [ebp - 0x848]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41836f
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
int3
mov ah, 0
pop edx
add bh, bh
salc
push dword [ebp - 0x838]
jmp 0x418314
call fcn.0042af76
test al, al
je 0x41838c
jmp 0x418320
call fcn.0042abf5
test al, al
je 0x4183ac
dec ebx
jo 0x418361
cmc
fistp qword [eax]
jae 0x41841c
mov ch, 0x23
into
push ss
xor al, 0xac
pop edi
and eax, 0xd7a5b3f
jns 0x418341
call fcn.0042aa9c
test al, al
je 0x4183d0
mov bl, 0x44
xchg esp, eax
or eax, 0xe4d2e5fc
cmp al, 0xca
add eax, 0x8b97fd02
xchg ecx, eax
fdiv st(2), st(0)
clc
not dword [esi]
jge 0x4183e8
js 0x41842c
ja 0x41835b
push 0x800
xor ebx, ebx
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.0056f390
add esp, 0xc
mov dword [ebp - 0x84c], 0x400
test dword [edi + esi*8 + 0x400ffff], esi
add byte [eax], al
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x850]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add byte [edx], bl
call ebx
push dword [ebp - 0x838]
call ebx
call fcn.0042af76
add dword [eax], eax
test al, al
je 0x418453
retf
push dword [ebp - 0x83c]
call ebx
push dword [ebp - 0x82c]
call ebx
call fcn.0042aea7
test al, al
je 0x418488
test dword [esp + edi*4], ebp
ja 0x4184be
and al, 0xe8
xor edi, dword [ecx - 0x2bdf2c8]
cmp al, bh
mov bl, 0x56
cmc
cmpps xmm5, xmmword [eax - 9], 0xac
out dx, eax
cmpsd dword [esi], dword es:[edi]
push ebp
xchg dword [ebp - 0x80f7b], ecx
call dword [eax - 0x18]
jb 0x418494
lea eax, [ebp - 0x810]
push eax
call fcn.00578706
push ss
add byte [ecx - 0x75], bl
invalid
pop ecx
mov ecx, dword [ebp - 0x830]
test eax, eax
je 0x418324
lea eax, [ebp - 0x810]
push eax
call fcn.00402ac4
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00403628
mov eax, dword [ebp - 0x830]
call fcn.00569382
ret