Function at 0x43367d
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x23a0
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc03]
push edi
mov edi, 0x3ff
xor ebx, ebx
push edi
push ebx
push eax
mov byte [ebp - 0xc04], bl
call fcn.00626f50
push edi
lea eax, [ebp - 0x403]
mov byte [ebp - 0x404], bl
push ebx
push eax
call fcn.00626f50
push edi
lea eax, [ebp - 0x1003]
mov byte [ebp - 0x1004], bl
push ebx
push eax
call fcn.00626f50
push edi
lea eax, [ebp - 0x803]
mov byte [ebp - 0x804], bl
push ebx
push eax
call fcn.00626f50
lea eax, [edi + 1]
push esi
push str.SoftwareDownloadManager_s
push eax
mov dword [ebp - 0x23a0], eax
mov dword [ebp - 0x239c], eax
mov dword [ebp - 0x2398], eax
lea eax, [ebp - 0x238c]
push eax
call fcn.00445d6d
add esp, 0x40
lea eax, [ebp - 0x238c]
mov edi, str.RecoverNewIDMPassfromRegKey
push eax
push edi
push str._s_:_Opening_URL__s
call fcn.00449974
add esp, 0xc
lea eax, [ebp - 0x2390]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x238c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x433774
push eax
lea eax, [ebp - 0x238c]
push eax
push edi
push str._s_:_Failed_to_open_the_site_key___s___Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x4338d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x2398]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x2394]
push eax
push ebx
push str.Url0
push dword [ebp - 0x2390]
call esi
lea eax, [ebp - 0x239c]
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x2394]
push eax
push ebx
push str.User
push dword [ebp - 0x2390]
call esi
lea eax, [ebp - 0x23a0]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x2394]
push eax
push ebx
push str.EncPassword
push dword [ebp - 0x2390]
call esi
push dword [ebp - 0x2390]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x1004], bl
je 0x4338bb
cmp byte [ebp - 0x404], bl
je 0x4338bb
lea eax, [ebp - 0xc04]
push str.anonymous
push eax
call fcn.00631435
pop ecx
pop ecx
test eax, eax
je 0x4338bb
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x1004]
push eax
push edi
push str._s_:_Found_the_New_IDM_Download:_URL__s___User__s___Password__s_
call fcn.00449974
mov al, byte [ebp - 0x404]
add esp, 0x14
mov ecx, ebx
test al, al
je 0x433870
xor al, 0xf
mov byte [ebp + ecx - 0x804], al
inc ecx
mov edx, ecx
mov al, byte [ebp + ecx - 0x404]
test al, al
jne 0x433851
cmp edx, 0x400
jae 0x4338e1
lea eax, [ebp - 0x804]
mov byte [ebp + ecx - 0x804], bl
push eax
push edi
push str._s_:_Decoded_the_password____s_
call fcn.00449974
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x804]
push ecx
push eax
lea eax, [ebp - 0xc04]
push eax
lea eax, [ebp - 0x1004]
push eax
push ecx
push 0x86
push 5
call fcn.00412c85
xor eax, eax
add esp, 0x2c
inc eax
jmp 0x4338d2
lea eax, [ebp - 0x804]
push eax
push edi
push str._s_:_URL_or_Password_is_empty_...returning_now
call fcn.00449974
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3