Function at 0x42f6e6
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1b74
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
mov edi, 0x3e7
mov dword [ebp - 0x1b70], eax
push edi
push eax
mov byte [ebp - 0xbc0], al
mov ebx, ecx
lea eax, [ebp - 0xbbf]
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0xfa8], 0
lea eax, [ebp - 0xfa7]
push edi
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x3f0], 0
lea eax, [ebp - 0x3ef]
push edi
push 0
push eax
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0x138f]
push edi
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x7d8], 0
lea eax, [ebp - 0x7d7]
push edi
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x1778], 0
lea eax, [ebp - 0x1777]
push edi
push 0
push eax
call fcn.006390b0
add esp, 0xc
mov byte [ebp - 0x1b60], 0
lea eax, [ebp - 0x1b5f]
push edi
push 0
push eax
call fcn.006390b0
add esp, 0xc
lea eax, [ebp - 0x1b68]
push eax
push 0x20019
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42fa0a
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1b64]
push eax
lea eax, [ebp - 0x3f0]
mov dword [ebp - 0x1b64], 0x3e8
push eax
lea eax, [ebp - 0x1b6c]
push eax
push 0
push str.Password
push dword [ebp - 0x1b68]
call edi
test eax, eax
jne 0x42fa0a
lea eax, [ebp - 0x3f0]
push eax
call fcn.00643470
pop ecx
cmp eax, 1
jb 0x42fa0a
lea eax, [ebp - 0x3f0]
mov byte [ebp - 0x1390], 0
push eax
call fcn.00643470
pop ecx
cmp eax, 1
jb 0x42fa0a
lea eax, [ebp - 0x3f0]
xor esi, esi
push eax
call fcn.00643470
pop ecx
test eax, eax
je 0x42f87e
mov al, byte [ebp + esi - 0x3f0]
xor al, 0x98
mov byte [ebp + esi - 0x1390], al
lea eax, [ebp - 0x3f0]
push eax
inc esi
call fcn.00643470
pop ecx
cmp esi, eax
jb 0x42f85c
lea eax, [ebp - 0x1b64]
mov byte [ebp + esi - 0x1390], 0
push eax
lea eax, [ebp - 0xbc0]
mov esi, 0x3e8
push eax
lea eax, [ebp - 0x1b6c]
mov dword [ebp - 0x1b64], esi
push eax
push 0
push str.DatabaseName
push dword [ebp - 0x1b68]
call edi
lea eax, [ebp - 0x1b64]
mov dword [ebp - 0x1b64], esi
push eax
lea eax, [ebp - 0xfa8]
push eax
lea eax, [ebp - 0x1b6c]
push eax
push 0
push str.Login
push dword [ebp - 0x1b68]
call edi
lea eax, [ebp - 0x1b64]
mov dword [ebp - 0x1b64], esi
push eax
lea eax, [ebp - 0x7d8]
push eax
lea eax, [ebp - 0x1b6c]
push eax
push 0
push str.HostName
push dword [ebp - 0x1b68]
call edi
lea eax, [ebp - 0x1b64]
mov dword [ebp - 0x1b64], esi
push eax
lea eax, [ebp - 0x1b70]
push eax
lea eax, [ebp - 0x1b6c]
push eax
push 0
push str.Port
push dword [ebp - 0x1b68]
call edi
push dword [ebp - 0x1b68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xbc0]
push eax
call fcn.00643470
pop ecx
test eax, eax
je 0x42f975
lea eax, [ebp - 0xbc0]
push eax
lea eax, [ebp - 0xfa8]
push eax
push str._s__DB:__s_
lea eax, [ebp - 0x1778]
push esi
push eax
call fcn.00402e0a
add esp, 0x14
jmp 0x42f98c
lea eax, [ebp - 0xfa8]
push eax
lea eax, [ebp - 0x1778]
push esi
push eax
call fcn.006494f3
add esp, 0xc
lea eax, [ebp - 0x7d8]
push eax
call fcn.00643470
pop ecx
test eax, eax
je 0x42f9db
cmp dword [ebp - 0x1b70], 0
lea eax, [ebp - 0x7d8]
jbe 0x42f9ca
push dword [ebp - 0x1b70]
push eax
push str._s:_d
lea eax, [ebp - 0x1b60]
push esi
push eax
call fcn.00402e0a
add esp, 0x14
jmp 0x42f9db
push eax
lea eax, [ebp - 0x1b60]
push esi
push eax
call fcn.006494f3
add esp, 0xc
push 0xffffffffffffffff
mov edx, 0x6c5bb9
lea eax, [ebp - 0x1390]
push edx
push eax
lea ecx, [ebp - 0x1778]
push ecx
lea ecx, [ebp - 0x1b60]
push ecx
push edx
push dword [ebp + 8]
mov ecx, ebx
push 6
call fcn.0043ee6b
xor eax, eax
inc eax
jmp 0x42fa0c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret 8