Function at 0x4187e6
Capabilities:
Check for software breakpoints
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ce87
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.00569440
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2028]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x203c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2040], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2048], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x202c], edi
mov dword [ebp - 0x204c], ebx
call fcn.00402ac4
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2038], ebx
mov dword [ebp - 0x2034], ebx
mov dword [ebp - 0x2030], ebx
call fcn.0042aae1
test al, al
je 0x418888
or ebp, dword [esi + 0x55]
loop 0x418892
sbb byte [esi], 0xe4
in al, 0x73
pop ecx
fld xword [ecx - 0x2acfad53]
lodsd eax, dword [esi]
push edx
xor ch, dl
mov edi, dword [ebp - 0x202c]
call fcn.0042aa57
test al, al
je 0x4188a7
push ss
in eax, 0x23
cmp dword [eax + 0x32], ebp
shl dword [edi], 0xcc
and edi, dword [ecx]
push 0xcc27c132
pop ds
xchg al, bh
ror dword [0x9ada9e71], cl
shr al, cl
jle 0x418890
pop es
lea eax, [ebp - 0x2038]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4188ed
lea eax, [ebp - 0x2028]
mov ecx, edi
push eax
call fcn.00402a4c
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.00403628
add dword [ebp - 0x202773], ecx
invalid
mov eax, edi
jmp 0x418afc
call fcn.0042ae1d
test al, al
je 0x418906
ja 0x41887e
xchg byte [ebx], bh
mov byte [0x194f0af8], al
jbe 0x4188e6
test bl, 0x82
push ebp
call fcn.0042ab6b
call fcn.0042ab6b
test al, al
je 0x418926
pop edi
ljmp 0xad3a
call fcn.0042aa57
test al, al
je 0x41894e
mov eax, 0x92eb419e
xor al, 0xec
mov edi, 0xd0069028
add al, 0x7b
cmp byte [edi], ah
inc edi
sbb byte [eax + 0x63], al
mov al, byte [0x18067c93]
mov ecx, 0x762a5471
jge 0x4188da
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor eax, sym.imp.ADVAPI32.dll_RegCreateKeyExW
lea eax, [ebp - 0x2034]
xor ebx, ebx
mov edi, 0xf013f
push ebx
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x203c]
push dword [ebp - 0x2038]
call esi
test eax, eax
je 0x41899e
push dword [ebp - 0x2038]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2028]
push eax
call fcn.00402a4c
push ebx
jmp 0x418ae9
push ebx
lea eax, [ebp - 0x2030]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x2040]
push dword [ebp - 0x2034]
call esi
test eax, eax
je 0x4189d5
push dword [ebp - 0x2034]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2030]
call esi
jmp 0x418986
call fcn.0042ab6b
test al, al
je 0x4189ff
or dl, dl
cmp al, 0xcc
sbb ah, byte [edx - 0x80]
wait
push ss
out 0x1c, al
stosd dword es:[edi], eax
mov byte [0xe0518902], al
add dword [0xc6764104], ebp
fnsave dword [0xa94e443d]
sub ecx, ebp
xor ebx, ebx
push 0x2000
lea eax, [ebp - 0x2010]
push ebx
push eax
call fcn.0056f390
add esp, 0xc
mov dword [ebp - 0x2044], 0x1000
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push ebx
push dword [ebp - 0x2048]
push dword [ebp - 0x2030]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2030]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2034]
call esi
push dword [ebp - 0x2038]
call esi
lea eax, [ebp - 0x2010]
push eax
call fcn.00578706
pop ecx
test eax, eax
je 0x418986
call fcn.0042af76
test al, al
je 0x418a8f
mov eax, dword [0x48d1ef6b]
sub dword [eax - 0x1585c936], esp
pop ds
sbb esi, dword [edi + 0x2b274bf3]
mov ecx, 0x12458e8
mov bh, 0xf3
dec ebx
daa
sub edi, dword [ecx + 0x12458e8]
call fcn.0042aeec
add dword [eax], eax
add byte [eax + eax*8 - 0x78ce48c], al
test al, al
je 0x418ab3
jae 0x418a92
mov al, byte [0x1d862fd9]
mov eax, esi
loope 0x418a89
or byte [esi + 0x3d], 0x82
jg 0x418adc
test eax, 0xc24fc817
mov ecx, 0x6ada7f24
jg 0x418a8c
push 0xffffffffffffffe8
out dx, eax
and eax, dword [ecx]
add byte [eax + eax*8 - 0x7a08e68c], al
jo 0x418a87
call fcn.0042aea7
test al, al
je 0x418ad5
test dword [ebp - 0x4223890], 0x4e7f4111
mov es, word [edx - 0x37934c48]
jno 0x418ab0
invalid
cmp eax, 0x18387759
mov dword [0xd48d8b4d], eax
invalid
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2010]
push eax
call fcn.00402ac4
push 0
test eax, esi
invalid
push 1
lea ecx, [ebp - 0x2028]
call fcn.00403628
mov eax, dword [ebp - 0x202c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056935c
mov esp, ebp
pop ebp
ret