Function at 0x42f6ed
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a4f75
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.00437070
mov eax, dword [0x62e10c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2028]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x203c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2040], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2048], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x202c], edi
mov dword [ebp - 0x204c], ebx
call fcn.004018d0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2038], ebx
and ebp, edi
dec dword [ecx - 0x627603a3]
enter 0xffffffffffffffdf, 0xffffffffffffffff
mov dword [ebp - 0x2034], ebx
mov dword [ebp - 0x2030], ebx
call fcn.00424c7f
test al, al
je 0x42f78f
imul bl
fsubr st(4)
inc ebx
cmpsb byte [esi], byte es:[edi]
sub esp, dword [esi]
mov esp, 0xc724d5bf
and dword [ebp - 0x4274e43f], 0xffffdfd4
call fcn.00424bf5
test al, al
je 0x42f7ae
mov dl, 0x66
pop ebx
jl 0x42f757
ljmp 0xd27:0x7e2fa14f
lea eax, [ebp - 0x2038]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42f7f4
lea eax, [ebp - 0x2028]
mov ecx, edi
push eax
call fcn.00408fe0
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.00401a00
mov eax, edi
jmp 0x42fa03
call fcn.00424fbb
test al, al
je 0x42f80d
call 0xb99407ee
mul byte [edi + 0xc]
shr ah, 1
mov ecx, ecx
movsd dword es:[edi], dword [esi]
or byte [esi - 0x18], cl
not dword [edi + edi*8 - 1]
call fcn.00424d09
invalid
test al, al
je 0x42f82d
hlt
call fcn.00424bf5
test al, al
je 0x42f855
ret
mov ss, word [ebx + edi*8 - 0x42]
mov eax, dword [0x9a27741c]
dec esp
fild qword [esi + 9]
mov edx, 0xf14a7230
insb byte es:[edi], dx
inc eax
adc dword [edi], esi
loope 0x42f82e
jp 0x42f810
xor eax, 0x94525731
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2034]
xor ebx, ebx
mov edi, 0xf013f
push ebx
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x203c]
push dword [ebp - 0x2038]
call esi
test eax, eax
je 0x42f8a5
push dword [ebp - 0x2038]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2028]
push eax
call fcn.00408fe0
push ebx
jmp 0x42f9f0
invalid
push ebx
lea eax, [ebp - 0x2030]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x2040]
push dword [ebp - 0x2034]
call esi
test eax, eax
je 0x42f8dc
push dword [ebp - 0x2034]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2030]
call esi
jmp 0x42f88d
call fcn.00424d09
test al, al
je 0x42f906
jle 0x42f875
and ebx, dword [edi - 0x7a]
inc eax
daa
scasd eax, dword es:[edi]
jb 0x42f896
adc byte [ecx - 0x7236ed5a], bh
cmp byte [ebx], dl
pushal
and al, 0x51
jmp 0x198e0136
push 0x2000
lea eax, [ebp - 0x2010]
push ebx
push eax
call fcn.00446a10
add esp, 0xc
mov dword [ebp - 0x2044], 0x1000
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push ebx
push dword [ebp - 0x2048]
push dword [ebp - 0x2030]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2030]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
salc
push dword [ebp - 0x2034]
call esi
push dword [ebp - 0x2038]
call esi
lea eax, [ebp - 0x2010]
push eax
call fcn.004549af
pop ecx
test eax, eax
je 0x42f88d
call fcn.00425114
test al, al
je 0x42f996
cli
invalid
call fcn.0042508a
test al, al
je 0x42f9ba
xlatb
jmp 0x42f954
call fcn.00425045
test al, al
je 0x42f9dc
test eax, ecx
jmp 0xfb43fd9
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2010]
push eax
call fcn.004018d0
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.00401a00
mov eax, dword [ebp - 0x202c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043671f
mov esp, ebp
pop ebp
ret