Function at 0x41816d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x848
mov eax, 0x59ce21
call fcn.005693c7
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor esi, esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp + 0x1c]
push eax
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x844], edi
mov dword [ebp - 0x854], esi
call fcn.00402ac4
mov dword [ebp - 4], esi
mov dword [ebp - 0x82c], esi
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], esi
call fcn.0042af76
test al, al
je 0x41820d
add byte [esi + 0x1f58762e], cl
mov fs, word [eax - 0x4fbf3852]
out dx, al
ljmp 0xeb6b
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push esi
push dword [ebp - 0x840]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x418255
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00402a4c
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00403628
mov eax, ebx
jmp 0x4184c4
lea eax, [ebp - 0x83c]
push eax
push 0x20119
push 0
push str.SoftWare
push dword [ebp - 0x82c]
call esi
test eax, eax
je 0x418282
push cs
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x418231
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push edi
push dword [ebp - 0x83c]
call esi
mov dword [ebp - 0x840], eax
call fcn.0042aa9c
test al, al
je 0x4182bc
movsd dword es:[edi], dword [esi]
iretd
call fcn.0042ad4e
test al, al
je 0x4182e1
adc ebx, dword [ecx - 0x4f]
pop es
scasb al, byte es:[edi]
scasb al, byte es:[edi]
dec ebx
cdq
jne 0x418273
add dword [eax], ebp
scasd eax, dword es:[edi]
pushal
jmp 0x4182e9
push esi
call fcn.0042af76
test al, al
je 0x4182ff
adc eax, 0xe8bdc595
mul dword [edi - 0x5e12813f]
and al, 0xa1
push ss
mov word [ecx], ds
sub bh, dh
into
mov cl, ah
add dword [ebx - 0x83f43], eax
inc dword [eax]
xchg ebp, eax
lds edi, [ebp - 0x3e580818]
jle 0x4182e0
mov eax, dword [0x8c16a124]
sbb dword [eax], ebp
test esi, 0x8301cc8a
mov ebp, 0xfffff7c0
add byte [ebp + ebp - 1], dh
mov ch, 0xc4
idiv edi
dec dword [ebx + 0x5a00b435]
add bh, bh
salc
cmp dword [ebp - 0x840], 0
je 0x418335
push dword [ebp - 0x83c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x828]
push eax
call fcn.00402a4c
jmp 0x4184af
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push dword [ebp - 0x848]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41836f
invalid
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
jmp 0x418314
call fcn.0042af76
test al, al
je 0x41838c
imul ebx, dword [edx + 0x2f], 0xffffff8b
inc ecx
mov eax, 0x4fc15ed1
inc eax
cmp ecx, dword [esi]
or dword [edx - 0x56], ecx
adc ecx, ebx
mov word [edx], ds
call fcn.0042abf5
test al, al
je 0x4183ac
insd dword es:[edi], dx
fcom qword [0xe7445947]
xchg ebx, eax
push 0x39
pop ebp
cmp al, 0x70
movsb byte es:[edi], byte [esi]
jo 0x418348
cmc
pop eax
cmc
mov esp, 0x3654cb25
call fcn.0042aa9c
test al, al
je 0x4183d0
insd dword es:[edi], dx
jecxz 0x418348
mov ah, 0x33
and edx, ecx
mov cl, 7
fdiv st(6), st(0)
jne 0x4183a2
in al, 0x5d
add al, byte [0x98fabd3]
xchg dword [esi + 0x800684d], edx
add byte [eax], al
push 0x800
xor ebx, ebx
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.0056f390
add esp, 0xc
mov dword [ebp - 0x84c], 0x400
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x850]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0x838]
call ebx
call fcn.0042af76
test al, al
je 0x418453
lodsd eax, dword [esi]
add edi, dword [edi]
das
mov cl, 2
sub eax, 0x70deba1e
push 0xd1f8d8f
fimul word [ebp + 0x16]
mov esp, dword [ebp - 0x52]
mov esi, 0x8bbe81f8
sbb eax, sym.imp.ADVAPI32.dll_RegCloseKey
push dword [ebp - 0x83c]
call ebx
push dword [ebp - 0x82c]
call ebx
call fcn.0042aea7
test al, al
je 0x418488
mov eax, 0x89db6716
xchg edi, eax
dec ecx
inc esi
outsb dx, byte [esi]
invalid
lea eax, [ebp - 0x810]
push eax
call fcn.00578706
pop ecx
mov ecx, dword [ebp - 0x830]
test eax, eax
je 0x418324
lea eax, [ebp - 0x810]
push eax
call fcn.00402ac4
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00403628
mov eax, dword [ebp - 0x830]
call fcn.00569382
ret