Function at 0x41b940
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5599b8
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x5aeb30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004433a7
push 0
push 0x588b58
lea esi, [edi + 0x94]
push 0x78
mov ecx, esi
call fcn.00442b96
push 0x444
mov ecx, edi
call fcn.0043e8d8
test esi, esi
jne 0x41b99c
xor ecx, ecx
jmp 0x41b99f
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0x20]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
push 1
push ecx
push 0x30
push eax
call ebx
push 0x43e
mov ecx, edi
call fcn.0043e8d8
test esi, esi
jne 0x41b9c4
xor ecx, ecx
jmp 0x41b9c7
mov ecx, dword [esi + 4]
push 1
push ecx
mov ecx, dword [eax + 0x20]
push 0x30
push ecx
call ebx
push 0x441
mov ecx, edi
call fcn.0043e8d8
test esi, esi
je 0x41b9e5
mov esi, dword [esi + 4]
mov edx, dword [eax + 0x20]
push 1
push esi
push 0x30
push edx
call ebx
push 0x14b
lea ecx, [edi + 0x9c]
push 0x58a480
call fcn.004042c0
mov esi, dword [0x5b6a8c]
call fcn.0044271b
mov dword [eax + 0xc], esi
call fcn.0044271b
mov eax, dword [eax + 0xc]
push 0
push 0
push 0
push 0
push 0x41f
push eax
call dword [sym.imp.user32.dll_LoadImageW]
mov ecx, eax
xor eax, eax
lea edx, [edi + 0x118]
call fcn.00405f30
mov ebx, dword [0x5b6a90]
call fcn.0044271b
push 0x208
mov dword [eax + 0xc], ebx
lea ebx, [edi + 0x2b4]
push 0
push ebx
call fcn.00536390
push 0x104
push str.http:__www.sharebank.com.cn_soft_softbuy.php_soid34920
push 0x104
push ebx
call fcn.0053523d
add esp, 0x1c
lea ecx, [edi + 0x118]
call fcn.004060d0
mov eax, dword [edi + 0x1f4]
xor ebx, ebx
cmp eax, ebx
je 0x41ba9b
push eax
call dword [sym.imp.user32.dll_DestroyCursor_1]
mov dword [edi + 0x1f4], ebx
call fcn.0044271b
mov eax, dword [eax + 0xc]
push ebx
push ebx
push ebx
push 2
push 0x9a
push eax
call dword [sym.imp.user32.dll_LoadImageW]
push 1
mov dword [edi + 0x1f4], eax
mov eax, dword [edi + 0x138]
push ebx
push eax
call dword [sym.imp.user32.dll_InvalidateRect]
cmp dword [edi + 0x4bc], ebx
je 0x41bae4
mov ecx, dword [edi + 0x4c4]
mov edx, dword [edi + 0x4c0]
push 0x1e
push ecx
push edx
jmp 0x41bafc
cmp dword [edi + 0x4d4], ebx
je 0x41bb18
mov eax, dword [edi + 0x4dc]
mov ecx, dword [edi + 0x4d8]
push 0x1e
push eax
push ecx
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
lea ecx, [edi + 0x118]
mov dword [edi + 0x190], ebx
mov dword [edi + 0x194], ebx
call fcn.0043ec9c
push 0x127
push 0x12d
push 0x12e
push 0x12c
push 0x132
lea esi, [edi + 0x50c]
mov dword [edi + 0x1c8], ebx
call fcn.00436740
push 0x127
push ebx
push 0x126
push 0x130
lea esi, [edi + 0x660]
push 0x12f
call fcn.00436740
xor eax, eax
push ebx
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x44]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREm1a2t3h4j8e4r5p9_
xor edx, edx
push 0x80000002
mov word [ebp - 0x3c], dx
mov dword [ebp - 0x4c], 0x2a
mov dword [ebp - 0x50], 3
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x50]
push eax
push ebx
push str.z2c4m7
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
lea eax, [ebp - 0x3c]
cmp word [ebp - 0x3c], bx
je 0x41bc01
lea esp, [esp]
mov dx, word [eax]
add dx, 0x25
xor dx, 0x3e
not dx
add dx, 0x13
xor dx, 0x57
mov word [eax], dx
add eax, 2
cmp word [eax], bx
jne 0x41bbe0
lea eax, [ebp - 0x3c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41bc07
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [edi + 0xa0]
call fcn.004042c0
mov ecx, dword [ebp - 0x44]
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
push ecx
call esi
push 0
lea edx, [ebp - 0x44]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARE_a2t3h4m1_r3m5g9d_
push 0x80000002
mov dword [ebp - 0x40], 0x1e
mov dword [ebp - 0x4c], 4
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x50]
push edx
push 0
push str.fsa91
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
xor ecx, 0x56bf
sub ecx, 0x1781c3
not ecx
xor ecx, 0x8f11
add ecx, 0x2b829c7
push edx
mov dword [ebp - 0x40], ecx
call esi
mov esi, dword [edi + 0xa0]
push ecx
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x54], esp
mov dword [ebp - 0x48], esp
call edx
cmp dword [esi - 4], ebx
lea edx, [esi - 4]
jl 0x41bcd8
cmp eax, dword [esi - 0x10]
jne 0x41bcd8
lea ebx, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x41bd10
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x41bd7b
mov eax, dword [esi - 0xc]
mov dword [ebx + 4], eax
mov eax, dword [esi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [ebx + 0x10]
push eax
call fcn.00534a5a
add esp, 0x10
mov ecx, dword [ebp - 0x48]
add ebx, 0x10
mov dword [ecx], ebx
call fcn.0041e1e0
test al, al
nop
nop
push 0x58a824
push 0x444
mov ecx, edi
call fcn.0043e8d8
mov ecx, eax
call fcn.0043e9ee
mov edx, dword [edi + 0xc4]
push 0
push 0x64
push 0x402
push edx
call dword [sym.imp.user32.dll_SendMessageW]
push 0
push 0x43e
mov ecx, edi
call fcn.0043e8d8
mov ecx, eax
call fcn.0043eafb
push 0
push 0x43d
mov ecx, edi
call fcn.0043e8d8
mov ecx, eax
call fcn.0043eafb
jmp 0x41bda2
call fcn.00404180
mov eax, 0x1e
sub eax, dword [ebp - 0x40]
jns 0x41bded
push 0x5888a0
push 0x444
mov ecx, edi
call fcn.0043e8d8
mov ecx, eax
call fcn.0043e9ee
push 0x127
push 0
push 0x12a
push 0x129
push 0x128
lea esi, [edi + 0x660]
call fcn.00436740
push 0
mov ecx, edi
call fcn.0043a761
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00534a4b
mov esp, ebp
pop ebp
ret
test eax, eax
js 0x41bdc3
call fcn.00437cf1
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x41becd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 0
mov ecx, 0x1e
sub ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x48]
push ecx
push 0x5892b4
push edx
call fcn.00403cd0
mov ebx, dword [ebp - 0x48]
add esp, 0xc
push ebx
push 0x444
mov ecx, edi
call fcn.0043e8d8
mov ecx, eax
call fcn.0043e9ee
mov eax, 0x1e
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
fild dword [ebp - 0x54]
fmul qword [0x58d560]
fdiv qword [0x58d558]
call fcn.00538280
mov ecx, dword [edi + 0xc4]
push 0
push eax
push 0x402
push ecx
call dword [sym.imp.user32.dll_SendMessageW]
push 0x127
push 0
push 0x126
push 0x130
push 0x12f
lea esi, [edi + 0x660]
call fcn.00436740
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41bdc3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41bdc3
push 0x80004005
call fcn.00404270
int3