Function at 0x42f3d1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x840
mov eax, 0x5a4f42
call fcn.00437119
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x84c], edi
call fcn.004018d0
mov dword [ebp - 4], edi
mov dword [ebp - 0x838], edi
mov dword [ebp - 0x834], edi
mov dword [ebp - 0x830], edi
call fcn.00425045
test al, al
je 0x42f45d
sbb bh, byte [edx]
push ebx
ror byte [edx + 0x29afae24], 1
jbe 0x42f45b
scasd eax, dword es:[edi]
sub dword [esi + 0x17], esi
pop ss
xchg edi, eax
invalid
xor edi, edi
lea eax, [ebp - 0x838]
mov esi, 0x20119
push eax
push esi
push edi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42f4a2
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00408fe0
push edi
push 1
lea ecx, [ebp - 0x828]
call fcn.00401a00
mov eax, ebx
jmp 0x42f6e7
call fcn.00425114
test al, al
je 0x42f4cd
xchg esi, eax
adc al, 0xad
arpl cx, cx
xchg ebx, eax
dec ecx
clc
popfd
jae 0x42f440
pop edi
xor eax, 0x8cb8b89
or dword [ebp + esi*8 + 0x4f], edx
jb 0x42f443
xor dl, byte [edi + 0x66]
push ss
xor edi, edi
mov esi, 0x20119
lea eax, [ebp - 0x834]
push eax
push esi
push edi
push dword [ebp - 0x840]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42f510
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push eax
call fcn.00408fe0
push edi
jmp 0x42f6d4
lea eax, [ebp - 0x830]
push eax
push esi
push edi
push dword [ebp - 0x844]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42f547
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
jmp 0x42f4f8
mov ch, 0xd0
idiv edi
invalid
call fcn.00424b6b
test al, al
je 0x42f570
rcl dword [ebx - 0x3a9ccd7d]
dec edx
jae 0x42f572
imul eax, dword [ecx - 0x6422d03c], 0x41
dec edx
jne 0x42f53e
push ss
jbe 0x42f5c1
or dword [esi + 0x7c], esp
jae 0x42f58f
inc ebp
xlatb
mov byte [eax + ebp*8 - 0xa575], 0x84
sal byte [esi + ebx + 0x46], 0x22
adc ecx, ebx
adc dword [esi + 0x47f9039], 0x61e00b3f
call fcn.00425000
test al, al
je 0x42f597
pop edx
invalid
inc esi
and dl, byte [ecx]
fld dword [ecx + 0x7f903996]
add al, 0x3f
or esp, eax
popal
shl dword [esp + ebp + 0x5676c947], 1
int3
and byte [eax], dh
pop ds
add eax, 0xff339f77
push 0x800
lea eax, [ebp - 0x810]
push edi
push eax
call fcn.00446a10
add esp, 0xc
mov dword [ebp - 0x848], 0x400
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push dword [ebp - 0x83c]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00424c7f
test al, al
je 0x42f5fe
invalid
adc ebp, ecx
das
aas
or byte [ecx - 0x6e], al
push cs
xor eax, 0xb44a9e97
sbb dword [ebp - 0xd171f0b], 0x84ffff55
sal byte [esi + edx - 0x13], 0
cmpsb byte [esi], byte es:[edi]
mov al, byte [0xb239cb3e]
and eax, 0xd22078b8
cmp eax, 0xaff36e29
call fcn.00424bf5
test al, al
je 0x42f61d
in eax, dx
add byte [esi + 0x39cb3ea0], ah
mov dl, 0x25
mov eax, 0x67d22078
cmp eax, 0xaff36e29
retf
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x810]
push eax
call fcn.004549af
pop ecx
mov dword [ebp - 0x83c], eax
call fcn.00424fbb
test al, al
je 0x42f661
push esi
mov dword [0xd36c4703], eax
xor eax, 0x5acf7f58
insd dword es:[edi], dx
xor al, 0x89
sub al, dh
call fcn.00424d09
test al, al
je 0x42f681
inc ecx
mov ebp, 0x3e5ef55e
mov byte [0x9063c26d], al
push esi
pop eax
fdivr st(5), st(0)
scasb al, byte es:[edi]
xchg esi, eax
or al, 0xe3
xor ebp, ecx
popal
call fcn.00424bf5
test al, al
je 0x42f6a9
wait
cmp edi, dword [edi]
popfd
outsb dx, byte [esi]
sbb bh, ah
ret 0x3604
cmp dword [ebp - 0x83c], 0
mov ecx, dword [ebp - 0x82c]
jne 0x42f6c6
lea eax, [ebp - 0x828]
push eax
call fcn.00408fe0
jmp 0x42f6d2
lea eax, [ebp - 0x810]
push eax
call fcn.004018d0
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00401a00
mov eax, dword [ebp - 0x82c]
call fcn.004370d4
ret