Function at 0x4187e6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ce87
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.00569440
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2028]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x203c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2040], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2048], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x202c], edi
mov dword [ebp - 0x204c], ebx
call fcn.00402ac4
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2038], ebx
mov dword [ebp - 0x2034], ebx
mov dword [ebp - 0x2030], ebx
call fcn.0042aae1
test al, al
je 0x418888
int 0xc3
out 0x13, eax
inc ebx
salc
or al, 0x80
adc dword [ebx + ebp*8 - 0x474d834a], eax
cmp eax, 0xd4bd8bb7
invalid
call fcn.0042aa57
test al, al
je 0x4188a7
in al, dx
rcl byte [edx - 0x1a33d6a9]
xor al, byte [ebx]
loop 0x4188e3
invalid
lea eax, [ebp - 0x2038]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4188ed
lea eax, [ebp - 0x2028]
mov ecx, edi
push eax
call fcn.00402a4c
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.00403628
mov eax, edi
jmp 0x418afc
lodsd eax, dword [esi]
invalid
call fcn.0042ae1d
test al, al
je 0x418906
xor al, 0xcb
sbb al, 0x5a
fcom st(5)
push ecx
or edx, dword [ebx - 7]
mov byte [0xf8e584df], ch
call fcn.0042ab6b
test al, al
je 0x418926
adc eax, 0x1845d72
mov dword [edx - 0x691aec7d], eax
scasd eax, dword es:[edi]
hlt
call fcn.0042aa57
test al, al
je 0x41894e
cld
lahf
out dx, al
stosb byte es:[edi], al
mov al, 0xc3
ror byte [eax - 0x60900d40], cl
mov cl, 6
pop es
int1
jae 0x418983
cdq
dec edi
add dword [0x7584645], ebx
arpl si, di
cmp byte [edi + ebx*4 - 0x75], dl
xor eax, sym.imp.ADVAPI32.dll_RegCreateKeyExW
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2034]
xor ebx, ebx
mov edi, 0xf013f
push ebx
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x203c]
push dword [ebp - 0x2038]
call esi
test eax, eax
je 0x41899e
push dword [ebp - 0x2038]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add byte [edx], bl
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2028]
push eax
call fcn.00402a4c
push ebx
jmp 0x418ae9
push ebx
lea eax, [ebp - 0x2030]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x2040]
push dword [ebp - 0x2034]
call esi
test eax, eax
je 0x4189d5
push dword [ebp - 0x2034]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2030]
call esi
jmp 0x418986
call fcn.0042ab6b
test al, al
je 0x4189ff
loop 0x418a0f
std
cwde
xor dl, byte [edx + 0x495f962a]
aad 0xcb
invalid
push 0x2000
lea eax, [ebp - 0x2010]
push ebx
push eax
call fcn.0056f390
add esp, 0xc
adc eax, 0xcc48300
mov dword [ebp - 0x2044], 0x1000
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push ebx
push dword [ebp - 0x2048]
push dword [ebp - 0x2030]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2030]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2034]
call esi
push dword [ebp - 0x2038]
call esi
lea eax, [ebp - 0x2010]
push eax
call fcn.00578706
pop ecx
test eax, eax
je 0x418986
invalid
call fcn.0042af76
test al, al
je 0x418a8f
jae 0x418a5a
in eax, 0xac
mov eax, dword [0xee1e7c0d]
popal
jo 0x418a7c
sti
push ebp
into
xlatb
cmp dh, byte [ebp - 0x18]
pop eax
and al, 1
add byte [eax + eax*8 + 0x9841b74], al
call fcn.0042aeec
test al, al
je 0x418ab3
test byte [ecx], cl
and eax, 0xbcb15f8b
inc edi
movsb byte es:[edi], byte [esi]
invalid
call fcn.0042aea7
test al, al
je 0x418ad5
std
out 0xe, al
adc byte [eax + esi + 0x59c78365], ah
test eax, 0x8ae342a7
faddp st(7)
add al, byte [esi]
sub al, 0x58
pop esp
push 0x32
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2010]
push eax
call fcn.00402ac4
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.00403628
mov eax, dword [ebp - 0x202c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056935c
mov esp, ebp
pop ebp
ret