Function at 0x409fef
Capabilities:
Connect to wmi namespace via wbemlocator
Contain obfuscated stackstrings
Encode data using xor
Enumerate process modules
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421745
mov eax, dword fs:[0]
push eax
mov eax, 0x2744
call fcn.00420890
mov eax, dword [0x427040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2550], edi
lea ecx, [ebp - 0x2730]
call fcn.00404293
lea ecx, [ebp - 0x2750]
call fcn.00407f76
lea ecx, [ebp - 0x25cc]
call fcn.00407e80
movaps xmm0, xmmword [0x402230]
xor ecx, ecx
movups xmmword [ebp - 0x21e4], xmm0
mov dword [ebp - 0x21d4], 0x2021f43
mov dword [ebp - 0x21d0], 0x2020202
mov word [ebp - 0x21cc], 0x3532
mov byte [ebp - 0x21ca], 0
mov al, byte [ebp - 0x21e4]
xor byte [ebp + ecx - 0x21e3], al
inc ecx
cmp ecx, 0x19
jb 0x40a07d
lea eax, [ebp - 0x21e3]
mov byte [ebp - 0x21ca], 0
push eax
push edi
call fcn.00408052
movaps xmm0, xmmword [0x402330]
pop ecx
pop ecx
movups xmmword [ebp - 0x2368], xmm0
mov word [ebp - 0x2358], 0x1e19
xor ecx, ecx
mov byte [ebp - 0x2356], 0
mov al, byte [ebp - 0x2368]
xor byte [ebp + ecx - 0x2367], al
inc ecx
cmp ecx, 0x11
jb 0x40a0c6
lea eax, [ebp - 0x2367]
mov byte [ebp - 0x2356], 0
push eax
push edi
call fcn.00408052
pop ecx
pop ecx
mov cl, 0x79
mov dword [ebp - 0x20b4], 0xb1c1279
mov dword [ebp - 0x20b0], 0x4a151c17
xor eax, eax
mov dword [ebp - 0x20ac], 0x151d574b
mov word [ebp - 0x20a8], 0x15
xor byte [ebp + eax - 0x20b3], cl
inc eax
cmp eax, 0xc
jae 0x40a12f
mov cl, byte [ebp - 0x20b4]
jmp 0x40a11a
mov edx, dword [ebp - 0x272c]
lea eax, [ebp - 0x20b3]
mov ecx, dword [ebp - 0x2730]
push eax
mov byte [ebp - 0x20a7], 0
call fcn.00406f1f
call eax
mov esi, eax
mov dword [ebp - 0x2578], esi
test esi, esi
je 0x40a7ba
movaps xmm0, xmmword [0x402900]
xor ecx, ecx
movups xmmword [ebp - 0x2328], xmm0
mov dword [ebp - 0x2318], 0x4b824f6f
mov byte [ebp - 0x2314], 0
movsx eax, byte [ebp - 0x2328]
and eax, 0x8000000f
jns 0x40a194
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2327], al
inc ecx
cmp ecx, 0x13
jb 0x40a181
lea eax, [ebp - 0x2327]
mov byte [ebp - 0x2314], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [ebp - 0x20d4], 0x8172543d
mov dl, 0x3d
mov dword [ebp - 0x20d0], 0x83767f51
mov dword [ebp - 0x20cc], 0x7d866172
xor ecx, ecx
mov word [ebp - 0x20c8], 0x4e72
mov byte [ebp - 0x20c6], 0
movsx eax, dl
and eax, 0x8000000f
jns 0x40a1f9
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x20d3], al
inc ecx
cmp ecx, 0xd
jae 0x40a20e
mov dl, byte [ebp - 0x20d4]
jmp 0x40a1ea
lea eax, [ebp - 0x20d3]
mov byte [ebp - 0x20c6], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test edi, edi
je 0x40a7ae
test esi, esi
je 0x40a7ae
mov edx, dword [ebp - 0x2724]
mov ecx, dword [ebp - 0x2730]
call fcn.00406f1f
call eax
mov dl, 0x41
mov dword [ebp - 0x2568], eax
push 0x41
mov byte [ebp - 0x2549], dl
pop ecx
xor eax, eax
add ecx, 0xffffffbf
inc eax
shl eax, cl
test dword [ebp - 0x2568], eax
je 0x40a792
push 0x104
xor ecx, ecx
mov byte [ebp - 0x255c], dl
mov edx, dword [ebp - 0x2720]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x25e4]
mov byte [ebp - 0x2559], cl
push eax
push ecx
push ecx
push ecx
push ecx
mov ecx, dword [ebp - 0x2730]
lea eax, [ebp - 0x255c]
push eax
mov word [ebp - 0x255b], 0x5c3a
call fcn.00406f1f
call eax
test eax, eax
je 0x40a792
lea eax, [ebp - 0x255c]
push eax
call esi
dec eax
sub eax, 1
je 0x40a4bd
sub eax, 1
je 0x40a453
sub eax, 1
je 0x40a3eb
sub eax, 1
je 0x40a3a0
sub eax, 1
je 0x40a358
mov al, 0xc
mov dword [ebp - 0x20f4], 0x777a610c
mov dword [ebp - 0x20f0], 0x7a837b7a
xor ecx, ecx
mov dword [ebp - 0x20ec], 0x757e502c
mov word [ebp - 0x20e8], 0x7182
mov byte [ebp - 0x20e6], 0
movsx eax, al
and eax, 0x8000000f
jns 0x40a331
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x20f3], al
inc ecx
cmp ecx, 0xd
jae 0x40a346
mov al, byte [ebp - 0x20f4]
jmp 0x40a322
mov byte [ebp - 0x20e6], 0
lea eax, [ebp - 0x20f3]
jmp 0x40a501
mov cl, 0x2e
mov dword [ebp - 0x2068], 0x636f7c2e
mov dword [ebp - 0x2064], 0x5d476a0e
xor eax, eax
mov word [ebp - 0x2060], 0x45
xor byte [ebp + eax - 0x2067], cl
inc eax
cmp eax, 8
jae 0x40a38e
mov cl, byte [ebp - 0x2068]
jmp 0x40a379
mov byte [ebp - 0x205f], 0
lea eax, [ebp - 0x2067]
jmp 0x40a501
movaps xmm0, xmmword [0x402ba0]
xor ecx, ecx
movups xmmword [ebp - 0x23b8], xmm0
mov word [ebp - 0x23a8], 0x6d
movsx eax, byte [ebp - 0x23b8]
and eax, 0x8000000f
jns 0x40a3cc
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23b7], al
inc ecx
cmp ecx, 0x10
jb 0x40a3b9
mov byte [ebp - 0x23a7], 0
lea eax, [ebp - 0x23b7]
jmp 0x40a501
mov al, 0xe
mov dword [ebp - 0x20e4], 0x82735c0e
mov dword [ebp - 0x20e0], 0x79807d85
xor ecx, ecx
mov dword [ebp - 0x20dc], 0x7780522e
mov word [ebp - 0x20d8], 0x7384
mov byte [ebp - 0x20d6], 0
movsx eax, al
and eax, 0x8000000f
jns 0x40a42c
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x20e3], al
inc ecx
cmp ecx, 0xd
jae 0x40a441
mov al, byte [ebp - 0x20e4]
jmp 0x40a41d
mov byte [ebp - 0x20d6], 0
lea eax, [ebp - 0x20e3]
jmp 0x40a501
push 0x2f
pop ecx
mov al, cl
mov byte [ebp - 0x207e], cl
mov byte [ebp - 0x2084], al
xor ecx, ecx
mov dword [ebp - 0x2083], 0x74877855
mov byte [ebp - 0x207f], 0x73
mov dword [ebp - 0x207d], 0x85788153
mov word [ebp - 0x2079], 0x74
movsx eax, al
and eax, 0x8000000f
jns 0x40a499
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2083], al
inc ecx
cmp ecx, 0xb
jae 0x40a4ae
mov al, byte [ebp - 0x2084]
jmp 0x40a48a
mov byte [ebp - 0x2078], 0
lea eax, [ebp - 0x2083]
jmp 0x40a501
movaps xmm0, xmmword [0x4028b0]
xor ecx, ecx
movups xmmword [ebp - 0x2408], xmm0
mov byte [ebp - 0x23f8], 0
movsx eax, byte [ebp - 0x2408]
and eax, 0x8000000f
jns 0x40a4e7
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2407], al
inc ecx
cmp ecx, 0xf
jb 0x40a4d4
mov byte [ebp - 0x23f8], 0
lea eax, [ebp - 0x2407]
push 3
pop ecx
mov byte [ebp - 0x2072], cl
mov dl, 0x26
mov byte [ebp - 0x206c], cl
xor ecx, ecx
mov word [ebp - 0x2074], 0x7d26
mov dword [ebp - 0x2071], 0xb067b55
mov byte [ebp - 0x206d], 6
mov word [ebp - 0x206b], 0x2c55
mov byte [ebp - 0x2069], 0
xor byte [ebp + ecx - 0x2073], dl
inc ecx
cmp ecx, 0xa
jae 0x40a553
mov dl, byte [ebp - 0x2074]
jmp 0x40a53e
push eax
lea eax, [ebp - 0x255c]
mov byte [ebp - 0x2069], 0
push eax
lea eax, [ebp - 0x2073]
push eax
push dword [ebp - 0x2550]
call fcn.00408052
add esp, 0x10
test byte [ebp - 0x25e4], 0x80
je 0x40a5ca
mov al, 0x7e
mov dword [ebp - 0x2038], 0x54625c7e
mov word [ebp - 0x2034], 0x61
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x40a5a6
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2037], al
inc ecx
cmp ecx, 4
jae 0x40a5bb
mov al, byte [ebp - 0x2038]
jmp 0x40a597
mov byte [ebp - 0x2033], 0
lea edx, [ebp - 0x2037]
jmp 0x40a60a
mov cl, 0x1a
mov dword [ebp - 0x2048], 0x4e5b5c1a
mov word [ebp - 0x2044], 0x2829
xor eax, eax
mov byte [ebp - 0x2042], 0
xor byte [ebp + eax - 0x2047], cl
inc eax
cmp eax, 5
jae 0x40a5fd
mov cl, byte [ebp - 0x2048]
jmp 0x40a5e8
mov byte [ebp - 0x2042], 0
lea edx, [ebp - 0x2047]
movaps xmm0, xmmword [0x4026a0]
xor ecx, ecx
movups xmmword [ebp - 0x237c], xmm0
mov word [ebp - 0x236c], 0x7c05
mov byte [ebp - 0x236a], 0
mov al, byte [ebp - 0x237c]
xor byte [ebp + ecx - 0x237b], al
inc ecx
cmp ecx, 0x11
jb 0x40a62a
push edx
lea eax, [ebp - 0x237b]
mov byte [ebp - 0x236a], 0
push eax
push dword [ebp - 0x2550]
call fcn.00408052
add esp, 0xc
lea eax, [ebp - 0x2608]
push eax
lea eax, [ebp - 0x2610]
push eax
lea eax, [ebp - 0x2638]
push eax
lea eax, [ebp - 0x255c]
push eax
call edi
test eax, eax
je 0x40a740
mov edx, dword [ebp - 0x260c]
mov ecx, dword [ebp - 0x2610]
call fcn.00420d00
mulsd xmm0, qword [0x401fe8]
mov edx, dword [ebp - 0x2604]
mov ecx, dword [ebp - 0x2608]
movsd qword [ebp - 0x25d8], xmm0
call fcn.00420d00
movaps xmm1, xmmword [0x4025d0]
xor ecx, ecx
mulsd xmm0, qword [0x401fe8]
mov dword [ebp - 0x2410], 0x512a703c
movups xmmword [ebp - 0x2430], xmm1
mov dword [ebp - 0x240c], 0x14174c
movaps xmm1, xmmword [0x402420]
movups xmmword [ebp - 0x2420], xmm1
movsx eax, byte [ebp - 0x2430]
and eax, 0x8000000f
jns 0x40a6ff
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x242f], al
inc ecx
cmp ecx, 0x26
jb 0x40a6ec
sub esp, 0x10
mov byte [ebp - 0x2409], 0
lea eax, [ebp - 0x242f]
movsd qword [esp + 8], xmm0
movsd xmm0, qword [ebp - 0x25d8]
movsd qword [esp], xmm0
push eax
push dword [ebp - 0x2550]
call fcn.00408052
add esp, 0x18
jmp 0x40a792
movaps xmm0, xmmword [0x4022f0]
xor ecx, ecx
movups xmmword [ebp - 0x2238], xmm0
mov dword [ebp - 0x2228], 0x12131613
mov dword [ebp - 0x2224], 0x77130a
mov al, byte [ebp - 0x2238]
xor byte [ebp + ecx - 0x2237], al
inc ecx
cmp ecx, 0x16
jb 0x40a764
lea eax, [ebp - 0x2237]
mov byte [ebp - 0x2221], 0
push eax
push dword [ebp - 0x2550]
call fcn.00408052
pop ecx
pop ecx
mov al, byte [ebp - 0x2549]
inc al
movsx ecx, al
mov dl, al
mov byte [ebp - 0x2549], al
cmp ecx, 0x5a
jbe 0x40a259
push dword [ebp - 0x2578]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
push eax
push eax
mov dword [ebp - 0x2564], eax
mov dword [ebp - 0x2560], eax
mov dword [ebp - 0x2574], eax
mov dword [ebp - 0x256c], eax
mov dword [ebp - 0x2598], eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x40a99c
xor eax, eax
push eax
push eax
push eax
push 3
push eax
push eax
push eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x40a996
lea eax, [ebp - 0x2564]
push eax
push 0x401044
push 1
push 0
push 0x401054
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40a996
mov dword [ebp - 0x2310], 0xffb0ffad
xor eax, eax
mov dword [ebp - 0x230c], 0xffabffb0
mov dword [ebp - 0x2308], 0xffbcffa3
mov dword [ebp - 0x2304], 0xffb2ffb6
mov dword [ebp - 0x2300], 0xffcdffa9
mov dword [ebp - 0x22fc], 0xffacffa3
mov dword [ebp - 0x22f8], 0xff9cff9a
mov dword [ebp - 0x22f4], 0xff8dff8a
mov dword [ebp - 0x22f0], 0xff8bff96
mov dword [ebp - 0x22ec], 0xffa3ff86
mov dword [ebp - 0x22e8], 0xff96ffb2
mov dword [ebp - 0x22e4], 0xff8dff9c
mov dword [ebp - 0x22e0], 0xff8cff90
mov dword [ebp - 0x22dc], 0xff99ff90
mov dword [ebp - 0x22d8], 0xffa9ff8b
mov dword [ebp - 0x22d4], 0xff93ff90
mov dword [ebp - 0x22d0], 0xff92ff8a
mov dword [ebp - 0x22cc], 0xffbaff9a
mov dword [ebp - 0x22c8], 0xff9cff91
mov dword [ebp - 0x22c4], 0xff86ff8d
mov dword [ebp - 0x22c0], 0xff8bff8f
mov dword [ebp - 0x22bc], 0xff90ff96
mov dword [ebp - 0x22b8], 0xff91
not word [ebp + eax*2 - 0x2310]
inc eax
cmp eax, 0x2d
jb 0x40a910
xor eax, eax
lea ecx, [ebp - 0x2588]
mov word [ebp - 0x22b6], ax
lea eax, [ebp - 0x2310]
push eax
call fcn.00408116
and dword [ebp - 4], 0
mov edx, dword [eax]
test edx, edx
je 0x40a947
mov edx, dword [edx]
jmp 0x40a949
xor edx, edx
mov eax, dword [ebp - 0x2564]
lea esi, [ebp - 0x2560]
push esi
xor esi, esi
push esi
mov ecx, dword [eax]
push esi
push esi
push esi
push esi
push esi
push edx
push eax
call dword [ecx + 0xc]
or dword [ebp - 4], 0xffffffff
mov esi, eax
mov ecx, dword [ebp - 0x2588]
test ecx, ecx
je 0x40a984
call fcn.004081ac
xor eax, eax
mov dword [ebp - 0x2588], eax
jmp 0x40a986
xor eax, eax
test esi, esi
jns 0x40a9b5
mov eax, dword [ebp - 0x2564]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fa65
leave
ret
push eax
push eax
push 3
pop ecx
push ecx
push ecx
push eax
push eax
push 0xa
push dword [ebp - 0x2560]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x40a9de
mov eax, dword [ebp - 0x2560]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x40a98a
mov dword [ebp - 0x229c], 0xffbaffac
xor eax, eax
mov dword [ebp - 0x2298], 0xffbaffb3
mov dword [ebp - 0x2294], 0xffabffbc
mov dword [ebp - 0x2290], 0xffd5ffdf
mov dword [ebp - 0x228c], 0xffb9ffdf
mov dword [ebp - 0x2288], 0xffb0ffad
mov dword [ebp - 0x2284], 0xffdfffb2
mov dword [ebp - 0x2280], 0xff96ffa8
mov dword [ebp - 0x227c], 0xffccff91
mov dword [ebp - 0x2278], 0xffa0ffcd
mov dword [ebp - 0x2274], 0xff91ffba
mov dword [ebp - 0x2270], 0xff8dff9c
mov dword [ebp - 0x226c], 0xff8fff86
mov dword [ebp - 0x2268], 0xff9eff8b
mov dword [ebp - 0x2264], 0xff93ff9d
mov dword [ebp - 0x2260], 0xffa9ff9a
mov dword [ebp - 0x225c], 0xff93ff90
mov dword [ebp - 0x2258], 0xff92ff8a
mov dword [ebp - 0x2254], 0xff9a
not word [ebp + eax*2 - 0x229c]
inc eax
cmp eax, 0x25
jb 0x40aa9e
xor eax, eax
lea ecx, [ebp - 0x2594]
mov word [ebp - 0x2252], ax
lea eax, [ebp - 0x229c]
push eax
call fcn.00408116
mov esi, eax
mov dword [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x20fc], 0xffaeffa8
mov dword [ebp - 0x20f8], 0xffb3
not word [ebp + eax*2 - 0x20fc]
inc eax
cmp eax, 3
jb 0x40aae6
xor eax, eax
lea ecx, [ebp - 0x2584]
mov word [ebp - 0x20f6], ax
lea eax, [ebp - 0x20fc]
push eax
call fcn.00408116
mov byte [ebp - 4], 2
mov ecx, dword [esi]
test ecx, ecx
je 0x40ab1d
mov esi, dword [ecx]
jmp 0x40ab1f
xor esi, esi
mov eax, dword [eax]
test eax, eax
je 0x40ab29
mov edx, dword [eax]
jmp 0x40ab2b
xor edx, edx
mov eax, dword [ebp - 0x2560]
lea edi, [ebp - 0x2574]
push edi
push 0
push 0x20
mov ecx, dword [eax]
push esi
push edx
push eax
call dword [ecx + 0x50]
mov ecx, dword [ebp - 0x2584]
mov esi, eax
mov edi, dword [ebp - 0x2550]
test ecx, ecx
je 0x40ab62
call fcn.004081ac
and dword [ebp - 0x2584], 0
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2594]
test ecx, ecx
je 0x40ab7c
call fcn.004081ac
and dword [ebp - 0x2594], 0
test esi, esi
jns 0x40ae59
jmp 0x40a9d0
mov eax, dword [ecx]
lea edx, [ebp - 0x2598]
push edx
lea edx, [ebp - 0x256c]
push edx
push 1
push 0xffffffffffffffff
push ecx
call dword [eax + 0x10]
cmp dword [ebp - 0x2598], 0
je 0x40ae67
mov dword [ebp - 0x2114], 0xff8dffbb
xor eax, eax
mov dword [ebp - 0x2110], 0xff89ff96
mov dword [ebp - 0x210c], 0xffb3ff9a
mov dword [ebp - 0x2108], 0xff8bff9a
mov dword [ebp - 0x2104], 0xff9aff8b
mov dword [ebp - 0x2100], 0xff8d
not word [ebp + eax*2 - 0x2114]
inc eax
cmp eax, 0xb
jb 0x40abec
push 0
xor eax, eax
lea edx, [ebp - 0x2630]
push 0
mov word [ebp - 0x20fe], ax
mov eax, dword [ebp - 0x256c]
push edx
push 0
lea edx, [ebp - 0x2114]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x10]
xor eax, eax
mov dword [ebp - 0x2208], 0xff8dffaf
mov dword [ebp - 0x2204], 0xff8bff90
mov dword [ebp - 0x2200], 0xff9cff9a
mov dword [ebp - 0x21fc], 0xff96ff8b
mov dword [ebp - 0x21f8], 0xff91ff90
mov dword [ebp - 0x21f4], 0xff8bffac
mov dword [ebp - 0x21f0], 0xff8bff9e
mov dword [ebp - 0x21ec], 0xff8cff8a
mov word [ebp - 0x21e8], ax
movups xmm0, xmmword [ebp + eax*2 - 0x2208]
andnps xmm0, xmmword [0x402bf0]
movups xmmword [ebp + eax*2 - 0x2208], xmm0
add eax, 8
cmp eax, 0x10
jb 0x40ac7c
push 0
xor eax, eax
lea edx, [ebp - 0x2620]
push 0
mov word [ebp - 0x21e8], ax
mov eax, dword [ebp - 0x256c]
push edx
push 0
lea edx, [ebp - 0x2208]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40ae33
push 3
pop eax
cmp word [ebp - 0x2620], ax
jne 0x40ae33
cmp dword [ebp - 0x2618], 0
je 0x40ae33
push dword [ebp - 0x2628]
call fcn.0041f790
cmp dword [ebp - 0x2618], 1
mov edi, eax
jne 0x40ad35
mov dl, 0x1b
mov dword [ebp - 0x2558], 0x75541b
xor ecx, ecx
xor byte [ebp + ecx - 0x2557], dl
inc ecx
cmp ecx, 2
jae 0x40ad22
mov dl, byte [ebp - 0x2558]
jmp 0x40ad0d
xor edx, edx
lea esi, [ebp - 0x2557]
push 3
mov byte [ebp - 0x2555], dl
pop eax
jmp 0x40ad7d
xor edx, edx
mov dword [ebp - 0x2028], 0x66664f60
mov al, 0x60
mov byte [ebp - 0x2024], dl
mov ecx, edx
movsx eax, al
and eax, 0x8000000f
jns 0x40ad5a
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2027], al
inc ecx
push 3
pop eax
cmp ecx, eax
jae 0x40ad71
mov al, byte [ebp - 0x2028]
jmp 0x40ad4b
mov byte [ebp - 0x2024], dl
lea esi, [ebp - 0x2027]
movaps xmm0, xmmword [0x402620]
mov ecx, edx
movups xmmword [ebp - 0x2354], xmm0
mov byte [ebp - 0x2344], 0x55
mov byte [ebp - 0x2343], al
mov word [ebp - 0x2342], 0x7a
mov al, byte [ebp - 0x2354]
xor byte [ebp + ecx - 0x2353], al
inc ecx
cmp ecx, 0x12
jb 0x40ada3
push edi
mov edi, dword [ebp - 0x2550]
lea eax, [ebp - 0x2353]
push eax
push edi
mov byte [ebp - 0x2341], dl
call fcn.00408052
movaps xmm0, xmmword [0x4025e0]
add esp, 0xc
movups xmmword [ebp - 0x2154], xmm0
mov dword [ebp - 0x2144], 0x190c193e
xor ecx, ecx
mov dword [ebp - 0x2140], 0x4d571e18
mov dword [ebp - 0x213c], 0x67601e48
mov byte [ebp - 0x2138], 0
mov al, byte [ebp - 0x2154]
xor byte [ebp + ecx - 0x2153], al
inc ecx
cmp ecx, 0x1b
jb 0x40ae08
push esi
lea eax, [ebp - 0x2153]
mov byte [ebp - 0x2138], 0
push eax
push edi
call fcn.00408052
add esp, 0xc
lea eax, [ebp - 0x2630]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x2620]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x256c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2574]
test ecx, ecx
jne 0x40ab89
mov eax, dword [ebp - 0x2560]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x2564]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x2574]
test ecx, ecx
je 0x40ae8f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
movaps xmm0, xmmword [0x4029f0]
xor ecx, ecx
movups xmmword [ebp - 0x2134], xmm0
mov dword [ebp - 0x2124], 0x4a167364
mov dword [ebp - 0x2120], 0xb0b0b16
mov dword [ebp - 0x211c], 0x3b0b0b0b
mov word [ebp - 0x2118], 0x3c
mov al, byte [ebp - 0x2134]
xor byte [ebp + ecx - 0x2133], al
inc ecx
cmp ecx, 0x1c
jb 0x40aecc
lea eax, [ebp - 0x2133]
mov byte [ebp - 0x2117], 0
push eax
push edi
call fcn.00408052
movaps xmm0, xmmword [0x402530]
pop ecx
movups xmmword [ebp - 0x2464], xmm0
pop ecx
movaps xmm0, xmmword [0x4025f0]
xor ecx, ecx
movups xmmword [ebp - 0x2454], xmm0
mov word [ebp - 0x2444], 0x52
mov al, byte [ebp - 0x2464]
xor byte [ebp + ecx - 0x2463], al
inc ecx
cmp ecx, 0x20
jb 0x40af1c
mov edx, dword [ebp - 0x25c0]
lea eax, [ebp - 0x2554]
mov ecx, dword [ebp - 0x25cc]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 0x2463]
mov byte [ebp - 0x2443], 0
push eax
push esi
call fcn.00406f1f
call eax
test eax, eax
jne 0x40b130
movaps xmm0, xmmword [0x402170]
mov eax, 0x104
xor edx, edx
mov dword [ebp - 0x2600], eax
mov dword [ebp - 0x25fc], eax
mov ecx, edx
movups xmmword [ebp - 0x23f4], xmm0
mov word [ebp - 0x23e4], 2
mov al, byte [ebp - 0x23f4]
xor byte [ebp + ecx - 0x23f3], al
inc ecx
cmp ecx, 0x10
jb 0x40af91
mov ecx, dword [ebp - 0x25cc]
lea eax, [ebp - 0x2600]
push eax
lea eax, [ebp - 0x31c]
mov byte [ebp - 0x23e3], dl
push eax
push edx
push edx
mov edx, dword [ebp - 0x25c8]
lea eax, [ebp - 0x23f3]
push eax
push dword [ebp - 0x2554]
call fcn.00406f1f
call eax
test eax, eax
jne 0x40b03d
movaps xmm0, xmmword [0x402670]
xor ecx, ecx
movups xmmword [ebp - 0x2190], xmm0
mov dword [ebp - 0x2180], 0x57464d50
mov dword [ebp - 0x217c], 0x2185641
mov dword [ebp - 0x2178], 0x285107
mov al, byte [ebp - 0x2190]
xor byte [ebp + ecx - 0x218f], al
inc ecx
cmp ecx, 0x1a
jb 0x40b00c
lea eax, [ebp - 0x31c]
mov byte [ebp - 0x2175], 0
push eax
lea eax, [ebp - 0x218f]
push eax
push edi
call fcn.00408076
add esp, 0xc
movaps xmm0, xmmword [0x4029e0]
xor edx, edx
movups xmmword [ebp - 0x2390], xmm0
mov word [ebp - 0x2380], 0x737b
mov ecx, edx
mov byte [ebp - 0x237e], dl
mov al, byte [ebp - 0x2390]
xor byte [ebp + ecx - 0x238f], al
inc ecx
cmp ecx, 0x11
jb 0x40b05e
mov ecx, dword [ebp - 0x25cc]
lea eax, [ebp - 0x25fc]
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 0x237e], dl
push eax
push edx
push edx
mov edx, dword [ebp - 0x25c8]
lea eax, [ebp - 0x238f]
push eax
push dword [ebp - 0x2554]
call fcn.00406f1f
call eax
test eax, eax
jne 0x40b117
movaps xmm0, xmmword [0x402ac0]
xor ecx, ecx
movups xmmword [ebp - 0x21c8], xmm0
mov dword [ebp - 0x21b8], 0x68557b6a
mov dword [ebp - 0x21b4], 0x27416c74
mov dword [ebp - 0x21b0], 0x117a2c
movsx eax, byte [ebp - 0x21c8]
and eax, 0x8000000f
jns 0x40b0ec
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x21c7], al
inc ecx
cmp ecx, 0x1a
jb 0x40b0d9
lea eax, [ebp - 0x218]
mov byte [ebp - 0x21ad], 0
push eax
lea eax, [ebp - 0x21c7]
push eax
push edi
call fcn.00408076
add esp, 0xc
push dword [ebp - 0x2554]
mov edx, dword [ebp - 0x25bc]
mov ecx, dword [ebp - 0x25cc]
call fcn.00406f1f
call eax
movaps xmm0, xmmword [0x4021c0]
xor edx, edx
movups xmmword [ebp - 0x2548], xmm0
mov ecx, edx
mov dword [ebp - 0x2590], edx
movaps xmm0, xmmword [0x402390]
movups xmmword [ebp - 0x2538], xmm0
push 0x2f
movaps xmm0, xmmword [0x402410]
movups xmmword [ebp - 0x2528], xmm0
pop eax
movaps xmm0, xmmword [0x4022b0]
movups xmmword [ebp - 0x2518], xmm0
mov byte [ebp - 0x24f8], al
movaps xmm0, xmmword [0x4023c0]
movups xmmword [ebp - 0x2508], xmm0
mov dword [ebp - 0x24f7], 0x32293c3e
mov byte [ebp - 0x24f3], al
mov word [ebp - 0x24f2], 0x22
mov al, byte [ebp - 0x2548]
xor byte [ebp + ecx - 0x2547], al
inc ecx
cmp ecx, 0x56
jb 0x40b1a2
mov ecx, dword [ebp - 0x25cc]
lea eax, [ebp - 0x2554]
push eax
lea eax, [ebp - 0x2547]
mov byte [ebp - 0x24f1], dl
mov edx, dword [ebp - 0x25c0]
push eax
push esi
call fcn.00406f1f
call eax
test eax, eax
jne 0x40b338
push 4
pop eax
push 0x51
mov dword [ebp - 0x25f4], eax
xor edx, edx
mov dword [ebp - 0x25f8], eax
mov ecx, edx
pop eax
mov byte [ebp - 0x205c], al
mov dword [ebp - 0x205b], 0x63626f46
mov dword [ebp - 0x2057], 0x65666d
movsx eax, al
and eax, 0x8000000f
jns 0x40b224
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x205b], al
inc ecx
cmp ecx, 7
jae 0x40b239
mov al, byte [ebp - 0x205c]
jmp 0x40b215
mov ecx, dword [ebp - 0x25cc]
lea eax, [ebp - 0x25f8]
push eax
lea eax, [ebp - 0x2590]
mov byte [ebp - 0x2054], dl
push eax
lea eax, [ebp - 0x25f4]
push eax
push edx
mov edx, dword [ebp - 0x25c8]
lea eax, [ebp - 0x205b]
push eax
push dword [ebp - 0x2554]
call fcn.00406f1f
call eax
test eax, eax
jne 0x40b31f
xor ecx, ecx
cmp dword [ebp - 0x2590], 1
jne 0x40b2c8
movaps xmm0, xmmword [0x4028a0]
movups xmmword [ebp - 0x2340], xmm0
mov dword [ebp - 0x2330], 0xc0b6263
mov byte [ebp - 0x232c], cl
mov al, byte [ebp - 0x2340]
xor byte [ebp + ecx - 0x233f], al
inc ecx
cmp ecx, 0x13
jb 0x40b2a6
mov byte [ebp - 0x232c], 0
lea eax, [ebp - 0x233f]
jmp 0x40b316
movaps xmm0, xmmword [0x402800]
movups xmmword [ebp - 0x22b4], xmm0
mov dword [ebp - 0x22a4], 0x11686970
mov word [ebp - 0x22a0], 0xe
movsx eax, byte [ebp - 0x22b4]
and eax, 0x8000000f
jns 0x40b2fc
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x22b3], al
inc ecx
cmp ecx, 0x14
jb 0x40b2e9
mov byte [ebp - 0x229f], 0
lea eax, [ebp - 0x22b3]
push eax
push edi
call fcn.00408052
pop ecx
pop ecx
push dword [ebp - 0x2554]
mov edx, dword [ebp - 0x25bc]
mov ecx, dword [ebp - 0x25cc]
call fcn.00406f1f
call eax
movaps xmm0, xmmword [0x402220]
xor edx, edx
movups xmmword [ebp - 0x24f0], xmm0
mov ecx, edx
mov dword [ebp - 0x258c], edx
movaps xmm0, xmmword [0x402360]
movups xmmword [ebp - 0x24e0], xmm0
mov word [ebp - 0x24c0], 0x3928
movaps xmm0, xmmword [0x402480]
movups xmmword [ebp - 0x24d0], xmm0
mov byte [ebp - 0x24be], dl
mov al, byte [ebp - 0x24f0]
xor byte [ebp + ecx - 0x24ef], al
inc ecx
cmp ecx, 0x31
jb 0x40b37b
mov ecx, dword [ebp - 0x25cc]
lea eax, [ebp - 0x2554]
push eax
lea eax, [ebp - 0x24ef]
mov byte [ebp - 0x24be], dl
mov edx, dword [ebp - 0x25c0]
push eax
push esi
call fcn.00406f1f
call eax
test eax, eax
jne 0x40b520
movaps xmm0, xmmword [0x4023b0]
xor edx, edx
push 4
pop eax
mov dword [ebp - 0x25ec], eax
mov ecx, edx
mov dword [ebp - 0x25f0], eax
movups xmmword [ebp - 0x2250], xmm0
mov dword [ebp - 0x2240], 0x1c12111e
mov word [ebp - 0x223c], 0x1415
mov byte [ebp - 0x223a], dl
mov al, byte [ebp - 0x2250]
xor byte [ebp + ecx - 0x224f], al
inc ecx
cmp ecx, 0x15
jb 0x40b3f8
mov ecx, dword [ebp - 0x25cc]
lea eax, [ebp - 0x25f0]
push eax
lea eax, [ebp - 0x258c]
mov byte [ebp - 0x223a], dl
push eax
lea eax, [ebp - 0x25ec]
push eax
push edx
mov edx, dword [ebp - 0x25c8]
lea eax, [ebp - 0x224f]
push eax
push dword [ebp - 0x2554]
call fcn.00406f1f
call eax
test eax, eax
jne 0x40b507
cmp dword [ebp - 0x258c], 1
jne 0x40b4a9
movaps xmm0, xmmword [0x4021a0]
xor edx, edx
movups xmmword [ebp - 0x21ac], xmm0
mov dword [ebp - 0x219c], 0x2294c56
mov ecx, edx
mov dword [ebp - 0x2198], 0x9000e0d
mov dword [ebp - 0x2194], 0x666108
mov al, byte [ebp - 0x21ac]
xor byte [ebp + ecx - 0x21ab], al
inc ecx
cmp ecx, 0x1a
jb 0x40b488
mov byte [ebp - 0x2191], dl
lea eax, [ebp - 0x21ab]
jmp 0x40b4fe
movaps xmm0, xmmword [0x4023d0]
xor ecx, ecx
movups xmmword [ebp - 0x2174], xmm0
mov dword [ebp - 0x2164], 0x2805617b
mov dword [ebp - 0x2160], 0x2d232032
mov dword [ebp - 0x215c], 0x4b4c2524
mov byte [ebp - 0x2158], 0
mov al, byte [ebp - 0x2174]
xor byte [ebp + ecx - 0x2173], al
inc ecx
cmp ecx, 0x1b
jb 0x40b4de
mov byte [ebp - 0x2158], 0
lea eax, [ebp - 0x2173]
push eax
push edi
call fcn.00408052
pop ecx
pop ecx
push dword [ebp - 0x2554]
mov edx, dword [ebp - 0x25bc]
mov ecx, dword [ebp - 0x25cc]
call fcn.00406f1f
call eax
mov cl, 0x56
mov dword [ebp - 0x20c4], 0x24331d56
mov dword [ebp - 0x20c0], 0x653a3338
xor eax, eax
mov dword [ebp - 0x20bc], 0x3a327864
mov word [ebp - 0x20b8], 0x3a
xor byte [ebp + eax - 0x20c3], cl
inc eax
cmp eax, 0xc
jae 0x40b560
mov cl, byte [ebp - 0x20c4]
jmp 0x40b54b
lea eax, [ebp - 0x20c3]
mov byte [ebp - 0x20b7], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x40a99c
movaps xmm0, xmmword [0x402340]
xor ecx, ecx
movups xmmword [ebp - 0x2220], xmm0
mov dword [ebp - 0x2210], 0x2f1a2b3c
mov dword [ebp - 0x220c], 0x2b222c
mov al, byte [ebp - 0x2220]
xor byte [ebp + ecx - 0x221f], al
inc ecx
cmp ecx, 0x16
jb 0x40b5a2
lea eax, [ebp - 0x221f]
mov byte [ebp - 0x2209], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40a99c
xor eax, eax
push eax
push eax
push eax
push 0x41435049
call esi
mov edi, eax
test edi, edi
je 0x40b670
push edi
call fcn.0041fde6
pop ecx
push edi
push eax
push 0
push 0x41435049
mov dword [ebp - 0x2568], eax
call esi
mov edi, dword [ebp - 0x2568]
test eax, eax
je 0x40b669
xor esi, esi
movaps xmm0, xmmword [0x402610]
xor ecx, ecx
movups xmmword [ebp - 0x23a4], xmm0
mov word [ebp - 0x2394], 0x7725
mov byte [ebp - 0x2392], 0
mov al, byte [ebp - 0x23a4]
xor byte [ebp + ecx - 0x23a3], al
inc ecx
cmp ecx, 0x11
jb 0x40b62e
mov byte [ebp - 0x2392], 0
movzx eax, byte [esi + edi]
push eax
push esi
lea eax, [ebp - 0x23a3]
push eax
push dword [ebp - 0x2550]
call fcn.00408052
add esp, 0x10
inc esi
cmp esi, 0x10
jl 0x40b60e
push edi
call fcn.0041fdef
pop ecx
movaps xmm0, xmmword [0x4026d0]
xor ecx, ecx
movups xmmword [ebp - 0x24bc], xmm0
movaps xmm0, xmmword [0x402010]
movups xmmword [ebp - 0x24ac], xmm0
movsx eax, byte [ebp - 0x24bc]
and eax, 0x8000000f
jns 0x40b6a1
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x24bb], al
inc ecx
cmp ecx, 0x1e
jb 0x40b68e
mov esi, dword [ebp - 0x2550]
lea eax, [ebp - 0x24bb]
push eax
push esi
mov byte [ebp - 0x249d], 0
call fcn.00408052
movaps xmm0, xmmword [0x402190]
pop ecx
pop ecx
movups xmmword [ebp - 0x23cc], xmm0
mov word [ebp - 0x23bc], 0x11
xor ecx, ecx
mov al, byte [ebp - 0x23cc]
xor byte [ebp + ecx - 0x23cb], al
inc ecx
cmp ecx, 0x10
jb 0x40b6e3
lea eax, [ebp - 0x23cb]
mov byte [ebp - 0x23bb], 0
push eax
push esi
call fcn.00408052
mov edx, dword [ebp - 0x2578]
pop ecx
pop ecx
test edx, edx
je 0x40b895
push 0x2f
pop eax
mov byte [ebp - 0x2094], al
xor ecx, ecx
mov dword [ebp - 0x2093], 0x7d747f5e
mov dword [ebp - 0x208f], 0x727e815f
mov dword [ebp - 0x208b], 0x828274
movsx eax, al
and eax, 0x8000000f
jns 0x40b752
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x2093], al
inc ecx
cmp ecx, 0xb
jae 0x40b767
mov al, byte [ebp - 0x2094]
jmp 0x40b743
mov ecx, dword [ebp - 0x2730]
lea eax, [ebp - 0x2093]
push eax
push edx
mov edx, dword [ebp - 0x2728]
mov byte [ebp - 0x2088], 0
call fcn.00406f1f
call eax
mov dword [ebp - 0x2568], eax
test eax, eax
je 0x40b889
lea eax, [ebp - 0x25e8]
push eax
push 0x1000
lea eax, [ebp - 0x2020]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x40b889
mov edi, dword [ebp - 0x25e8]
xor esi, esi
shr edi, 2
mov dword [ebp - 0x25d0], edi
test edi, edi
je 0x40b883
push dword [ebp + esi*4 - 0x2020]
push 0
push 0x410
call dword [ebp - 0x2568]
mov dword [ebp - 0x25d4], eax
test eax, eax
je 0x40b87a
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x40b861
push 3
mov cl, 0x6c
mov dword [ebp - 0x2030], 0x661f496c
mov byte [ebp - 0x202c], 0
xor eax, eax
pop edi
xor byte [ebp + eax - 0x202f], cl
inc eax
cmp eax, edi
jae 0x40b838
mov cl, byte [ebp - 0x2030]
jmp 0x40b824
lea eax, [ebp - 0x114]
mov byte [ebp - 0x202c], 0
push eax
lea eax, [ebp - 0x202f]
push eax
push dword [ebp - 0x2550]
call fcn.00408052
mov edi, dword [ebp - 0x25d0]
add esp, 0xc
push dword [ebp - 0x25d4]
mov edx, dword [ebp - 0x2708]
mov ecx, dword [ebp - 0x2730]
call fcn.00406f1f
call eax
inc esi
cmp esi, edi
jb 0x40b7d1
mov esi, dword [ebp - 0x2550]
push dword [ebp - 0x2578]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movaps xmm0, xmmword [0x4021e0]
xor ecx, ecx
movups xmmword [ebp - 0x23e0], xmm0
mov word [ebp - 0x23d0], 0x16
movsx eax, byte [ebp - 0x23e0]
and eax, 0x8000000f
jns 0x40b8c1
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23df], al
inc ecx
cmp ecx, 0x10
jb 0x40b8ae
lea eax, [ebp - 0x23df]
mov byte [ebp - 0x23cf], 0
push eax
push esi
call fcn.00408052
movaps xmm0, xmmword [0x402b00]
xor edx, edx
movups xmmword [ebp - 0x249c], xmm0
pop ecx
movaps xmm0, xmmword [0x402aa0]
movups xmmword [ebp - 0x248c], xmm0
pop ecx
movaps xmm0, xmmword [0x402ae0]
mov ecx, edx
movups xmmword [ebp - 0x247c], xmm0
mov dword [ebp - 0x246c], 0x75756a7d
mov byte [ebp - 0x2468], dl
movsx eax, byte [ebp - 0x249c]
and eax, 0x8000000f
jns 0x40b935
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x249b], al
inc ecx
cmp ecx, 0x33
jb 0x40b922
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2570]
push eax
push 0x20019
push edx
lea eax, [ebp - 0x249b]
mov byte [ebp - 0x2468], dl
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x40a99c
xor ecx, ecx
lea eax, [ebp - 0x257c]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x820]
mov esi, ecx
push eax
push ecx
jmp 0x40bb6d
lea eax, [ebp - 0x2580]
inc esi
push eax
push 0x20019
push 0
lea eax, [ebp - 0x820]
push eax
push dword [ebp - 0x2570]
call edi
test eax, eax
jne 0x40bb58
mov eax, 0x400
mov dword [ebp - 0x20a4], 0x2b311c58
xor edx, edx
mov dword [ebp - 0x25dc], eax
mov dword [ebp - 0x25e0], eax
mov cl, 0x58
mov dword [ebp - 0x20a0], 0x21393428
mov eax, edx
mov dword [ebp - 0x209c], 0x3d353916
mov byte [ebp - 0x2098], dl
xor byte [ebp + eax - 0x20a3], cl
inc eax
cmp eax, 0xb
jae 0x40ba03
mov cl, byte [ebp - 0x20a4]
jmp 0x40b9ee
mov ecx, dword [ebp - 0x25cc]
lea eax, [ebp - 0x25dc]
push eax
lea eax, [ebp - 0x1020]
mov byte [ebp - 0x2098], dl
push eax
push edx
push edx
mov edx, dword [ebp - 0x25c8]
lea eax, [ebp - 0x20a3]
push eax
push dword [ebp - 0x2580]
call fcn.00406f1f
call eax
test eax, eax
jne 0x40ba8a
mov cl, 0x56
mov dword [ebp - 0x2040], 0x25737b56
mov word [ebp - 0x203c], 0x76
xor byte [ebp + eax - 0x203f], cl
inc eax
cmp eax, 4
jae 0x40ba67
mov cl, byte [ebp - 0x2040]
jmp 0x40ba52
lea eax, [ebp - 0x1020]
mov byte [ebp - 0x203b], 0
push eax
lea eax, [ebp - 0x203f]
push eax
push dword [ebp - 0x2550]
call fcn.00408052
add esp, 0xc
movaps xmm0, xmmword [0x402070]
xor edx, edx
movups xmmword [ebp - 0x2440], xmm0
mov ecx, edx
mov al, byte [ebp - 0x2440]
xor byte [ebp + ecx - 0x243f], al
inc ecx
cmp ecx, 0xe
jb 0x40ba9c
mov ecx, dword [ebp - 0x25cc]
lea eax, [ebp - 0x25e0]
push eax
lea eax, [ebp - 0xc20]
mov byte [ebp - 0x2431], dl
push eax
push edx
push edx
mov edx, dword [ebp - 0x25c8]
lea eax, [ebp - 0x243f]
push eax
push dword [ebp - 0x2580]
call fcn.00406f1f
call eax
test eax, eax
jne 0x40bb3f
xor edx, edx
mov dword [ebp - 0x2050], 0x2e78065d
mov cl, 0x5d
mov word [ebp - 0x204c], 0x5700
mov byte [ebp - 0x204a], dl
mov eax, edx
xor byte [ebp + eax - 0x204f], cl
inc eax
cmp eax, 5
jae 0x40bb1d
mov cl, byte [ebp - 0x2050]
jmp 0x40bb08
lea eax, [ebp - 0xc20]
mov byte [ebp - 0x204a], dl
push eax
lea eax, [ebp - 0x204f]
push eax
push dword [ebp - 0x2550]
call fcn.00408052
add esp, 0xc
push dword [ebp - 0x2580]
mov edx, dword [ebp - 0x25bc]
mov ecx, dword [ebp - 0x25cc]
call fcn.00406f1f
call eax
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x257c]
push eax
lea eax, [ebp - 0x820]
push eax
push esi
push dword [ebp - 0x2570]
mov dword [ebp - 0x257c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x40b98d
push dword [ebp - 0x2570]
mov edx, dword [ebp - 0x25bc]
mov ecx, dword [ebp - 0x25cc]
call fcn.00406f1f
call eax
jmp 0x40a99c