Function at 0x407090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51bcfd
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x562494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x214], 0
xorps xmm0, xmm0
mov dword [ebp - 0x214], edi
movq qword [ebp - 0x21c], xmm0
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], edi
push 0x200
lea eax, [ebp - 0x210]
mov dword [ebp - 4], edi
push edi
push eax
call fcn.004dcf80
add esp, 0xc
mov dword [ebp - 0x240], 0x100
lea eax, [ebp - 0x348]
push eax
call fcn.004078f0
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x238], edi
push ecx
push 0x20019
push edi
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, eax
mov dword [ebp - 0x23c], edx
test edx, edx
jne 0x407159
mov edi, dword [ebp - 0x238]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x348]
or esi, 0xffffffff
add ecx, 0xfffffff0
mov eax, esi
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4071aa
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x407875
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x238], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x407868
push 0
push dword [edx + 4]
call ebx
cmp dword [ebp - 0x23c], 0
jne 0x40723a
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x210]
push eax
push str.svcVersion
lea ecx, [ebp - 0x21c]
call fcn.00409dc0
test eax, eax
je 0x407217
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004dcf80
add esp, 0xc
mov dword [ebp - 0x240], 0x100
lea eax, [ebp - 0x240]
lea ecx, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x54bc64
call fcn.00409dc0
mov edi, dword [ebp - 0x21c]
test edi, edi
je 0x407230
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], 0
xor eax, eax
mov dword [ebp - 0x224], 0
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407260
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00408c10
push 0
push 0x54bc74
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 1
call fcn.00407fb0
test eax, eax
jne 0x4073e4
mov dword [ebp - 0x274], 0x450046
mov dword [ebp - 0x270], 0x540041
mov dword [ebp - 0x26c], 0x520055
mov dword [ebp - 0x268], 0x5f0045
mov dword [ebp - 0x264], 0x520042
mov dword [ebp - 0x260], 0x57004f
mov dword [ebp - 0x25c], 0x450053
mov dword [ebp - 0x258], 0x5f0052
mov dword [ebp - 0x254], 0x4d0045
mov dword [ebp - 0x250], 0x4c0055
mov dword [ebp - 0x24c], 0x540041
mov dword [ebp - 0x248], 0x4f0049
mov dword [ebp - 0x244], 0x4e
call fcn.00409bb0
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, eax
test ecx, ecx
je 0x40787e
mov eax, dword [ecx]
push 2
push 0x19
call dword [eax]
test eax, eax
je 0x407888
cmp dword [eax + 8], 0x19
lea ecx, [eax + 0x10]
mov dword [ebp - 0x23c], ecx
jl 0x40788d
xor eax, eax
mov dword [ecx - 0xc], 0x19
mov word [ecx + 0x32], ax
mov edx, 0x32
lea eax, [ebp - 0x274]
push 0x32
push eax
call fcn.0040a070
add esp, 8
mov byte [ebp - 4], 2
mov edx, 0x2af9
lea ecx, [ebp - 0x23c]
call fcn.00406d10
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x240], eax
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x4077de
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4078d3
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4078d3
push 0
push dword [edx + 4]
call ebx
jmp 0x4077de
push 0
push 0x54bc7c
lea ecx, [ebp - 0x234]
call fcn.00407fb0
test eax, eax
jne 0x4074e9
mov dword [ebp - 0x2a8], 0x450046
mov dword [ebp - 0x2a4], 0x540041
mov dword [ebp - 0x2a0], 0x520055
mov dword [ebp - 0x29c], 0x5f0045
mov dword [ebp - 0x298], 0x520042
mov dword [ebp - 0x294], 0x57004f
mov dword [ebp - 0x290], 0x450053
mov dword [ebp - 0x28c], 0x5f0052
mov dword [ebp - 0x288], 0x4d0045
mov dword [ebp - 0x284], 0x4c0055
mov dword [ebp - 0x280], 0x540041
mov dword [ebp - 0x27c], 0x4f0049
mov dword [ebp - 0x278], 0x4e
call fcn.00409bb0
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, eax
test ecx, ecx
je 0x407897
mov eax, dword [ecx]
push 2
push 0x19
call dword [eax]
test eax, eax
je 0x4078a1
cmp dword [eax + 8], 0x19
lea ecx, [eax + 0x10]
mov dword [ebp - 0x23c], ecx
jl 0x40788d
xor eax, eax
mov dword [ecx - 0xc], 0x19
mov word [ecx + 0x32], ax
mov edx, 0x32
lea eax, [ebp - 0x2a8]
push 0x32
push eax
call fcn.0040a070
add esp, 8
mov byte [ebp - 4], 3
mov edx, 0x2711
jmp 0x407386
push 0
push 0x54bc84
lea ecx, [ebp - 0x234]
call fcn.00407fb0
test eax, eax
jne 0x4075ee
mov dword [ebp - 0x2dc], 0x450046
mov dword [ebp - 0x2d8], 0x540041
mov dword [ebp - 0x2d4], 0x520055
mov dword [ebp - 0x2d0], 0x5f0045
mov dword [ebp - 0x2cc], 0x520042
mov dword [ebp - 0x2c8], 0x57004f
mov dword [ebp - 0x2c4], 0x450053
mov dword [ebp - 0x2c0], 0x5f0052
mov dword [ebp - 0x2bc], 0x4d0045
mov dword [ebp - 0x2b8], 0x4c0055
mov dword [ebp - 0x2b4], 0x540041
mov dword [ebp - 0x2b0], 0x4f0049
mov dword [ebp - 0x2ac], 0x4e
call fcn.00409bb0
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, eax
test ecx, ecx
je 0x4078a6
mov eax, dword [ecx]
push 2
push 0x19
call dword [eax]
test eax, eax
je 0x4078b0
cmp dword [eax + 8], 0x19
lea ecx, [eax + 0x10]
mov dword [ebp - 0x23c], ecx
jl 0x40788d
xor eax, eax
mov dword [ecx - 0xc], 0x19
mov word [ecx + 0x32], ax
mov edx, 0x32
lea eax, [ebp - 0x2dc]
push 0x32
push eax
call fcn.0040a070
add esp, 8
mov byte [ebp - 4], 4
mov edx, 0x270f
jmp 0x407386
push 0
push 0x54bc8c
lea ecx, [ebp - 0x234]
call fcn.00407fb0
test eax, eax
jne 0x4076f3
mov dword [ebp - 0x310], 0x450046
mov dword [ebp - 0x30c], 0x540041
mov dword [ebp - 0x308], 0x520055
mov dword [ebp - 0x304], 0x5f0045
mov dword [ebp - 0x300], 0x520042
mov dword [ebp - 0x2fc], 0x57004f
mov dword [ebp - 0x2f8], 0x450053
mov dword [ebp - 0x2f4], 0x5f0052
mov dword [ebp - 0x2f0], 0x4d0045
mov dword [ebp - 0x2ec], 0x4c0055
mov dword [ebp - 0x2e8], 0x540041
mov dword [ebp - 0x2e4], 0x4f0049
mov dword [ebp - 0x2e0], 0x4e
call fcn.00409bb0
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, eax
test ecx, ecx
je 0x4078b5
mov eax, dword [ecx]
push 2
push 0x19
call dword [eax]
test eax, eax
je 0x4078bf
cmp dword [eax + 8], 0x19
lea ecx, [eax + 0x10]
mov dword [ebp - 0x23c], ecx
jl 0x40788d
xor eax, eax
mov dword [ecx - 0xc], 0x19
mov word [ecx + 0x32], ax
mov edx, 0x32
lea eax, [ebp - 0x310]
push 0x32
push eax
call fcn.0040a070
add esp, 8
mov byte [ebp - 4], 5
mov edx, 0x22b8
jmp 0x407386
mov dword [ebp - 0x344], 0x450046
mov dword [ebp - 0x340], 0x540041
mov dword [ebp - 0x33c], 0x520055
mov dword [ebp - 0x338], 0x5f0045
mov dword [ebp - 0x334], 0x520042
mov dword [ebp - 0x330], 0x57004f
mov dword [ebp - 0x32c], 0x450053
mov dword [ebp - 0x328], 0x5f0052
mov dword [ebp - 0x324], 0x4d0045
mov dword [ebp - 0x320], 0x4c0055
mov dword [ebp - 0x31c], 0x540041
mov dword [ebp - 0x318], 0x4f0049
mov dword [ebp - 0x314], 0x4e
call fcn.00409bb0
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, eax
test ecx, ecx
je 0x4078c4
mov eax, dword [ecx]
push 2
push 0x19
call dword [eax]
test eax, eax
je 0x4078ce
cmp dword [eax + 8], 0x19
lea ecx, [eax + 0x10]
mov dword [ebp - 0x23c], ecx
jl 0x40788d
xor eax, eax
mov dword [ecx - 0xc], 0x19
mov word [ecx + 0x32], ax
mov edx, 0x32
lea eax, [ebp - 0x344]
push 0x32
push eax
call fcn.0040a070
add esp, 8
mov byte [ebp - 4], 6
mov edx, 0x270f
jmp 0x407386
mov edx, dword [ebp - 0x220]
cmp edx, 8
jb 0x40781e
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407814
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4078dc
push edx
push ecx
call fcn.004af923
add esp, 8
xor eax, eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
test edi, edi
je 0x407846
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004affa8
mov esp, ebp
pop ebp
ret
mov ecx, edx
call dword [ebp - 0x238]
jmp 0x4071aa
mov ecx, edx
call ebx
jmp 0x4071aa
push 0x80004005
call fcn.0040a130
call fcn.00409240
push 0x80070057
call fcn.0040a130
push 0x80004005
call fcn.0040a130
call fcn.00409240
push 0x80004005
call fcn.0040a130
call fcn.00409240
push 0x80004005
call fcn.0040a130
call fcn.00409240
push 0x80004005
call fcn.0040a130
call fcn.00409240
mov ecx, edx
call esi
jmp 0x4077de
call fcn.004e03e9
int3