Function at 0x42d676
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x840
mov eax, 0x5a2a82
call fcn.004348d9
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x84c], edi
call fcn.00401870
mov dword [ebp - 4], edi
mov dword [ebp - 0x838], edi
mov dword [ebp - 0x834], edi
mov dword [ebp - 0x830], edi
call fcn.0043aa34
test al, al
je 0x42d702
add byte [eax + eax*8 - 0x3365db8c], al
mov bh, byte [edi]
pop esp
jmp 0x42d6f3
lcall 0xeeb, 0x5c3f8acc
sub al, byte [eax]
xchg dword cs:[esi - 0x2f0e6421], ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
cmp dl, byte [eax - 0x752f4154]
push esp
jl 0x42d72e
mov esi, 0x7c548ad0
xor eax, 0xd49d8b94
idiv edi
push dword [ebx]
dec dword [ebp - 0x8377b]
invalid
xchg esp, eax
mov ebx, dword [ebp - 0x82c]
xor edi, edi
lea eax, [ebp - 0x838]
mov esi, 0x20119
push eax
push esi
push edi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42d747
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00408f80
push edi
push 1
lea ecx, [ebp - 0x828]
call fcn.004019a0
mov eax, ebx
jmp 0x42d98c
dec esi
mov eax, 0x6a57fffd
add dword [ebp - 0x82773], ecx
invalid
call fcn.0043ab03
test al, al
je 0x42d772
int 0xd1
jmp 0x42d6d9
lea eax, [ebp - 0x834]
push eax
push esi
push edi
push dword [ebp - 0x840]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42d7b5
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push eax
call fcn.00408f80
push edi
jmp 0x42d979
lea eax, [ebp - 0x830]
push eax
push esi
push edi
push dword [ebp - 0x844]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42d7ec
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
jmp 0x42d79d
call fcn.0043a55a
test al, al
je 0x42d815
jp 0x42d7fe
adc dword [ebp - 0x515f733a], 0x1ed5ca7e
in al, 0x21
daa
xchg edi, eax
invalid
retf 0x1ed5
call fcn.0043a9ef
test al, al
je 0x42d83c
dec edi
mov al, byte [edi]
mov byte [0xb9ee3179], al
pop ebp
mov word [eax - 0x1c], fs
and dword [edx + 0x14], eax
or al, 0xa9
cmp eax, 0xf0b523f1
cdq
ret 0x38a3
push 0x800
lea eax, [ebp - 0x810]
push edi
push eax
call fcn.00445350
add esp, 0xc
mov dword [ebp - 0x848], 0x400
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push dword [ebp - 0x83c]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0043a66e
test al, al
je 0x42d8a3
adc dl, byte [edi]
sti
pushfd
sbb al, 0x53
mov ah, 0x81
loop 0x42d8e5
invalid
call fcn.0043a5e4
test al, al
je 0x42d8c2
sbb ebx, edi
aaa
mov cl, 0xc9
xchg ebx, eax
iretd
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x810]
push eax
call fcn.004532f1
pop ecx
mov dword [ebp - 0x83c], eax
call fcn.0043a9aa
test al, al
je 0x42d906
add bh, bh
mov ch, 0xc8
idiv edi
invalid
add byte [ecx - 0x77], bl
test esp, eax
idiv edi
invalid
push ebx
into
aad 0x4a
dec eax
movsd dword es:[edi], dword [esi]
test byte [edi + 0x56], bl
shl byte [0x3458b07f], 1
call fcn.0043a6f8
test al, al
je 0x42d926
or bl, 0x11
and eax, 0x9aa2308e
adc dword [edi], 0xadca8be8
pop ebx
retf 0x9291
call fcn.0043a5e4
test al, al
je 0x42d94e
add bl, ch
sub byte [ebp + 0x54], 0xd7
jg 0x42d8cd
movsd dword es:[edi], dword [esi]
xor byte [ecx - 0x61], dl
lcall 0x7080, 0x17401b13
dec ebx
jbe 0x42d985
and byte [0xf5697027], cl
add byte [0xc4bd832c], bl
idiv edi
inc dword [eax]
cmp dword [ebp - 0x83c], 0
mov ecx, dword [ebp - 0x82c]
jne 0x42d96b
lea eax, [ebp - 0x828]
push eax
call fcn.00408f80
jmp 0x42d977
lea eax, [ebp - 0x810]
push eax
call fcn.00401870
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.004019a0
mov eax, dword [ebp - 0x82c]
dec dword [ebx - 0x82b7b]
invalid
call fcn.00434894
ret