Function at 0x4184ca
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x840
mov eax, 0x59ce54
call fcn.005693c7
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x84c], edi
call fcn.00402ac4
mov dword [ebp - 4], edi
mov dword [ebp - 0x838], edi
mov dword [ebp - 0x834], edi
mov dword [ebp - 0x830], edi
call fcn.0042aea7
test al, al
je 0x418556
add ah, byte es:[esi + 0x7f86003c]
aam 0x5e
in al, dx
wait
mov ch, 0x32
sub dword [ebx + 0x16], esi
invalid
lea eax, [ebp - 0x838]
mov esi, 0x20119
push eax
push esi
push edi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41859b
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00402a4c
push edi
push 1
lea ecx, [ebp - 0x828]
call fcn.00403628
mov eax, ebx
jmp 0x4187e0
call fcn.0042af76
test al, al
je 0x4185c6
lea ecx, [ebp - 0x5a9ef23e]
arpl word [edi - 0x50], sp
add esp, dword [eax]
push ds
lodsd eax, dword [esi]
hlt
lea eax, [ebp - 0x834]
push eax
push esi
push edi
push dword [ebp - 0x840]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x418609
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push eax
call fcn.00402a4c
push edi
jmp 0x4187cd
lea eax, [ebp - 0x830]
push eax
push esi
push edi
push dword [ebp - 0x844]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x418640
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
jmp 0x4185f1
call fcn.0042a9cd
test al, al
je 0x418669
sbb dword [edi], edx
test byte [edi + 0x46], 0xac
xor dword [edi - 0x286861c2], 0xffffffce
ja 0x418674
iretd
call 0xac6d05e6
jae 0x4186b5
invalid
call fcn.0042ae62
test al, al
je 0x418690
mov edi, 0xf9003d36
xchg edx, eax
popfd
cmp eax, 0x9d92f900
xchg esi, eax
xchg esp, eax
mov bh, 0xf
mov eax, 0x3de076bc
push 0xffffffffffffffdf
push ds
ror dword [esp + eax - 0x10], cl
jns 0x41865f
invalid
push 0x800
lea eax, [ebp - 0x810]
push edi
push eax
call fcn.0056f390
add esp, 0xc
mov dword [ebp - 0x848], 0x400
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push dword [ebp - 0x83c]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc esp
add byte [edx], bl
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0042aae1
test al, al
je 0x4186f7
fistp dword [ebp + edi + 0x53]
cdq
in eax, dx
sub edi, dword [edi]
aas
test eax, 0xffd020e
jmp 0x41870a
call fcn.0042aa57
test al, al
je 0x418716
neg byte [0x43f30b45]
sub byte [edx], dl
loopne 0x4186ee
or dword [ebp + edi*8 - 0x44], 0xfffffff4
xchg ecx, eax
arpl ax, di
sub dword [esi + ebx], esp
stc
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
adc eax, sym.imp.ADVAPI32.dll_RegCloseKey
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x810]
push eax
call fcn.00578706
pop ecx
mov dword [ebp - 0x83c], eax
call fcn.0042ae1d
test al, al
je 0x41875a
invalid
scasb al, byte es:[edi]
je 0x4186cd
movsd dword es:[edi], dword [esi]
or eax, 0x62720684
mov dword [0x199177b5], eax
les eax, [edx - 0x18]
or al, 0x24
add dword [eax], eax
call fcn.0042ab6b
test al, al
je 0x41877a
pop eax
lahf
ficomp dword [0x40370023]
and byte [ecx - 0x5b], al
push ebx
aad 0xd3
or byte [eax + 0x12], 0x25
ud1
iretd
call fcn.0042aa57
test al, al
je 0x4187a2
push esi
jle 0x4187b4
and dword [edx], edi
clc
cwde
loop 0x41871d
scasb al, byte es:[edi]
setle byte [edx + 0x5711ebec]
pushal
fadd dword [ecx + 0x21]
adc edx, edx
sub eax, 0x30e77abd
jb 0x418726
pop ss
cmp dword [ebp - 0x83c], 0
mov ecx, dword [ebp - 0x82c]
jne 0x4187bf
lea eax, [ebp - 0x828]
push eax
call fcn.00402a4c
jmp 0x4187cb
idiv edi
call dword [eax - 0x18]
invalid
lea eax, [ebp - 0x810]
push eax
call fcn.00402ac4
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00403628
mov eax, dword [ebp - 0x82c]
call fcn.00569382
ret