Function at 0x427360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f0eb
mov eax, dword fs:[0]
push eax
sub esp, 0x844
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x844], ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x84c], eax
xor eax, eax
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x814], 7
mov dword [ebp - 0x818], 0
mov word [ebp - 0x828], ax
cmp word [edx], ax
jne 0x4273ea
xor ecx, ecx
jmp 0x4273ff
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4273f0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x828]
call fcn.00403d10
mov dword [ebp - 4], 0
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x83c], 0
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 0
call fcn.004360f0
test al, al
je 0x427465
xor eax, 0xfd737e30
cmp eax, 0x8ee795cb
add cl, byte [edx + 0x70]
ror byte [edi], 0x24
sbb dword [eax], eax
xchg ecx, eax
imul ebx, edi, 0x6d
mov eax, dword [0x8accc617]
mov ebx, dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push 0
push dword [ebp - 0x840]
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x4274d0
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov word [ebx], ax
lea eax, [ebp - 0x828]
push eax
call fcn.00403f30
mov ecx, dword [ebp - 0x814]
cmp ecx, 8
jb 0x4274c9
inc ecx
push ecx
push dword [ebp - 0x828]
lea ecx, [ebp - 0x828]
call fcn.00404090
mov eax, ebx
jmp 0x4277b9
lea eax, [ebp - 0x83c]
push eax
push 0x20119
push 0
push str.SoftWare
push dword [ebp - 0x82c]
call esi
test eax, eax
je 0x427541
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], 0
mov ecx, ebx
mov word [ebx], ax
lea eax, [ebp - 0x828]
push eax
call fcn.00403f30
mov eax, dword [ebp - 0x814]
cmp eax, 8
jb 0x4274c9
inc eax
lea ecx, [ebp - 0x828]
push eax
push dword [ebp - 0x828]
call fcn.00404090
mov eax, ebx
jmp 0x4277b9
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push 0x619710
push dword [ebp - 0x83c]
call esi
mov dword [ebp - 0x840], eax
call fcn.00436470
test al, al
je 0x42757f
cmp dword [ebx + ebx], eax
imul eax, dword [ecx - 0x4a038f0f], 0xffffffe6
pop ecx
xchg edx, eax
test dword [ebx], ebp
push eax
adc byte [edi - 0x179c2468], al
fdivr st(2), st(0)
add byte [eax], al
call fcn.00436860
test al, al
je 0x4275a4
sal byte [esp + ebx - 0x45], 0x50
jp 0x4275d4
mov ebx, 0x9c487a50
pushfd
popfd
punpcklwd mm1, mm7
jbe 0x427585
jne 0x4275bf
inc ebx
js 0x4275e2
out 0x35, al
bound edx, qword [eax - 0x43]
cmp ebp, edx
or eax, 0x2a5210a4
call fcn.004360f0
test al, al
je 0x4275c2
or al, 0x2d
push 0xec85095b
test al, 0x91
adc dword [edi + 0x32217fc9], ebx
mov byte [0x7458463f], al
insb byte es:[edi], dx
pop eax
je 0x42762e
cmp dword [ebp - 0x840], 0
je 0x42761a
push dword [ebp - 0x83c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
adc byte [edx], bl
call esi
push dword [ebp - 0x82c]
call esi
mov esi, dword [ebp - 0x830]
xor eax, eax
mov ecx, esi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov ch, 0xd0
idiv edi
push dword [ebx]
ror byte [ebx + 0x1446c7ce], 7
add byte [eax], al
add bh, al
inc esi
adc byte [eax], al
add byte [eax], al
add byte [esi - 0x77], ah
push es
lea eax, [ebp - 0x828]
push eax
call fcn.00403f30
lea ecx, [ebp - 0x828]
call fcn.00402d00
mov eax, esi
jmp 0x4277b9
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push dword [ebp - 0x848]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x427654
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
jmp 0x4275d7
call fcn.004360f0
test al, al
je 0x427671
push esi
int 0x4b
out dx, eax
retf
call fcn.00436630
test al, al
je 0x427691
outsb dx, byte [esi]
pop ss
hlt
call fcn.00436470
test al, al
je 0x4276b5
add al, byte [edx + 0x2e]
cmp byte [eax], dl
dec edx
sub bl, ch
nop
cmp edi, ebp
pop ss
pop edi
and dword [esi + 0x59], ebp
jge 0x4276c5
push edi
pop ds
adc esp, esi
int1
cmp dword [edi], esi
and eax, 0x8006839
add byte [eax], al
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00576f50
clc
adc al, 0
add esp, 0xc
mov dword [ebp - 0x844], 0x400
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x810]
push eax
push 0
push 0
push dword [ebp - 0x84c]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0x838]
call ebx
call fcn.004360f0
test al, al
je 0x427739
stosd dword es:[edi], eax
invalid
push dword [ebp - 0x83c]
call ebx
push dword [ebp - 0x82c]
call ebx
call fcn.00435fa0
test al, al
je 0x42776e
jno 0x42776d
mov byte [0x196a2c41], al
xchg edi, eax
or dword [eax], edx
cmp ebp, ebx
jno 0x427791
adc byte [ebx], bh
jmp 0x4277d0
loop 0x4276f9
lodsd eax, dword [esi]
aad 0x76
jnp 0x42775b
jle 0x427788
invalid
aam 0x8d
invalid
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427777
sub ecx, edx
sar ecx, 1
mov ecx, dword [ebp - 0x830]
jne 0x42779c
sal bh, 1
invalid
lea eax, [ebp - 0x828]
push eax
call fcn.00404b00
jmp 0x4277a8
idiv edi
call dword [eax - 0x18]
sar bp, cl
invalid
lea eax, [ebp - 0x810]
push eax
call fcn.004039f0
lea ecx, [ebp - 0x828]
call fcn.00402d00
mov eax, dword [ebp - 0x830]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
add byte [ebx - 0x333ca21b], cl
int3