Function at 0x4215c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.004732f2
test al, al
je 0x4215e7
mov dh, 0xee
ret
call fcn.004738e0
test al, al
je 0x421606
adc byte [edx], cl
mov eax, 0xec0eeae7
sahf
invalid
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x42177d
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
push str.ZHost
push dword [ebp - 8]
call esi
test eax, eax
jne 0x42177d
call fcn.00473742
test al, al
je 0x421677
out 0x6e, eax
sbb byte [0xb8486170], 0xc
push eax
xlatb
xchg edi, eax
mov eax, ss
mov al, byte [0x761e7201]
push ecx
and byte fs:[esi - 0x18], bl
inc ebp
sbb eax, 0xc0840005
call fcn.004733c1
test al, al
je 0x4216a0
mov word [ecx], fs
xor byte [edi], dl
push esi
lea edi, [edx - 0x6cc59d51]
mov bh, 0x4b
lodsd eax, dword [esi]
invalid
call fcn.0047389b
test al, al
je 0x4216bd
cdq
popal
notrack jmp 0xbb4fa90a
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call fcn.0047362e
test al, al
je 0x421703
xlatb
loopne 0x421744
mov edx, ds
ret
call fcn.00473925
test al, al
je 0x421726
mov byte [esi + 0x291db822], bh
jno 0x421731
sti
stosb byte es:[edi], al
iretd
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x421736
push eax
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x421740
push eax
call esi
call fcn.004732f2
test al, al
je 0x42175e
add byte [eax + eax*8 - 0x2a5ea8c], al
pop edx
std
or dword [eax], 0xfffffffc
sub ch, bl
lodsb al, byte [esi]
cld
fst st(3)
push esi
int3
call fcn.004738e0
test al, al
je 0x42177d
push ebp
xor dh, byte [ecx]
loop 0x421793
inc esp
add dword [edx], 0x13
fld xword [edx + 0x36]
fsub st(7), st(0)
out 0xa4, eax
cmp eax, 0x46599592
and bl, byte [edi + 0x5e]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.0047337c
test al, al
je 0x4217bd
push esp
imul ecx, dword [edi], 0x84a2ce96
pop eax
insd dword es:[edi], dx
sbb ah, 0xb5
dec edi
pop esi
pushfd
inc edi
pushal
adc eax, 0x59ef67e4
aaa
mov ebx, edx
call fcn.0047355f
test al, al
je 0x4217dc
add ch, byte [edi]
and al, 0xb5
fcmovnu st(0), st(0)
push ebp
jle 0x4217d4
in al, 0x3a
adc dword [ebp - 0x68b2941e], 0x73
imul ecx, dword [ebp - 0x69], 0x73
stosb byte es:[edi], al
cmp ecx, ecx
invalid
call fcn.004734d5
test al, al
je 0x4217fd
lcall 0xdc77, 0x7fcaf703
sti
xor esi, esi
or dword [esi], 0xb7add110
sub dl, dh
imul esp, dword [edi], 0xdb6e181
add esi, edi
retf 0x777f
call fcn.00473925
test al, al
je 0x421820
adc edx, dword [edi - 0x18216274]
push es
loop 0x4217e6
fistp qword [ebx - 0x29]
and ecx, dword [ecx - 0x34456deb]
adc al, 0x15
push ecx
sub eax, dword [ebx]
pop esi
cmp al, 0x26
mov edx, dword [ebp + 8]
cmp word [edx], 0
jne 0x42182d
xor ecx, ecx
jmp 0x421841
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421832
sub ecx, esi
sar ecx, 1
mov ebx, dword [ebp - 4]
push ecx
push edx
lea ecx, [ebx + 0x60]
call fcn.00402650
mov edx, dword [ebp + 0xc]
cmp word [edx], 0
jne 0x42185b
xor ecx, ecx
jmp 0x42186f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421860
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebx + 0x78]
call fcn.00402650
mov edx, dword [ebp + 0x10]
cmp word [edx], 0
jne 0x421886
xor ecx, ecx
jmp 0x42189f
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
test eax, eax
jne 0x421890
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebx + 0x90]
call fcn.00402650
mov ecx, ebx
call fcn.00420af0
call fcn.00473811
test al, al
je 0x4218d0
pop esp
dec esi
jae 0x421897
lodsb al, byte [esi]
leave
xor ch, byte [ebx + 0x4a]
adc ebp, 0xffffff90
call 0x42eb10c4
lodsb al, byte [esi]
stosd dword es:[edi], eax
push ebx
call fcn.0047396a
test al, al
je 0x4218ea
cmp dword [ebp + 0x4da686ad], ecx
lahf
wait
aam 0xbd
invalid
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc