Function at 0x42d319
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x848
mov eax, 0x5a2a4f
call fcn.004348d9
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor esi, esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp + 0x1c]
push eax
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x844], edi
mov dword [ebp - 0x854], esi
call fcn.00401870
mov dword [ebp - 4], esi
mov dword [ebp - 0x82c], esi
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], esi
call fcn.0043ab03
test al, al
je 0x42d3b9
idiv edi
invalid
mov al, byte [0xce25fa68]
jbe 0x42d384
test eax, 0x7c69721b
add dword [0x2acd8644], esi
je 0x42d3bb
movsb byte es:[edi], byte [esi]
fcomi st(5)
inc esi
add eax, 0x9d8b12f0
sal bh, 1
invalid
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push esi
push dword [ebp - 0x840]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x42d401
aam 0xf7
invalid
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00408f80
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.004019a0
mov eax, ebx
jmp 0x42d670
lea eax, [ebp - 0x83c]
push eax
push 0x20119
push 0
push str.SoftWare
push dword [ebp - 0x82c]
call esi
test eax, eax
je 0x42d42e
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42d3dd
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push edi
push dword [ebp - 0x83c]
call esi
mov dword [ebp - 0x840], eax
call fcn.0043a629
test al, al
je 0x42d468
in eax, 0xa3
dec eax
or al, 0xb3
jae 0x42d47b
and dword ss:[edi + esi*2 + 0x56a37bd4], edi
popal
in al, dx
imul eax, dword [edx + esi*4 - 0x18], 0xd46e
call fcn.0043a8db
test al, al
je 0x42d48d
test eax, 0xfad9ac47
invalid
dec ebp
cmp dword [ecx + 0x7e9cbb2b], 0xffffff8e
jb 0x42d4be
mov dword [0x59b841ac], eax
sbb ah, bl
sub al, 0x71
salc
add byte [eax], al
call fcn.0043ab03
test al, al
je 0x42d4ab
adc esp, dword [ebx - 0x3919a2aa]
inc esi
rcl ecx, cl
adc dword [esi], ecx
aam 0x31
mov al, 0xbc
xchg dword [eax + 0x7b], edx
dec ebx
int 8
cmp dword [ebp - 0x840], 0
je 0x42d4e1
push dword [ebp - 0x83c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edx
add bh, bh
salc
call esi
push dword [ebp - 0x82c]
call esi
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x828]
push eax
call fcn.00408f80
jmp 0x42d65b
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push dword [ebp - 0x848]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42d51b
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
jmp 0x42d4c0
call fcn.0043ab03
test al, al
je 0x42d538
adc al, 7
sbb eax, 0x6b203895
test eax, 0xd74abd6f
adc al, 0xa
push ebx
jbe 0x42d564
mov ecx, 0x45e8a5e7
rol byte [eax], cl
add byte [eax + eax*8 - 0x6b93e88c], al
call fcn.0043a782
test al, al
je 0x42d558
insb byte es:[edi], dx
xchg esp, eax
ljmp 0xee9e:0x7631f0c2
call fcn.0043a629
test al, al
je 0x42d57c
mov ch, 0x6d
lahf
invalid
push 0x800
xor ebx, ebx
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00445350
add esp, 0xc
mov dword [ebp - 0x84c], 0x400
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x850]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0x838]
call ebx
call fcn.0043ab03
test al, al
je 0x42d5ff
add byte [eax + eax*8 + 0x4a3d2174], al
stosb byte es:[edi], al
push ds
arpl word [edi + 0x55], cx
cmp eax, 0x631eaa4a
dec edi
push ebp
sbb al, 1
salc
daa
sub byte [edx + edx*4 - 0x7cc3e1fa], 0xc0
add al, 0xdf
pop edx
hlt
push dword [ebp - 0x83c]
call ebx
push dword [ebp - 0x82c]
call ebx
call fcn.0043aa34
test al, al
je 0x42d634
sahf
sahf
push ecx
pop ds
ror bl, 1
jge 0x42d5d9
cdq
mov eax, 0xc94c2923
sbb esp, esi
push edx
add ecx, dword [ebp + ebp*4 - 0x13e7c617]
sub edx, dword cs:[ebx]
lea eax, [ebp - 0x810]
push eax
call fcn.004532f1
pop ecx
mov ecx, dword [ebp - 0x830]
test eax, eax
je 0x42d4d0
lea eax, [ebp - 0x810]
push eax
call fcn.00401870
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.004019a0
mov eax, dword [ebp - 0x830]
call fcn.00434894
ret