Function at 0x40bb4a
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x12c
lea ebp, [esp - 4]
mov eax, dword [0x474ea0]
xor eax, ebp
mov dword [ebp + 0x12c], eax
push 0x2c
mov eax, 0x452c59
call fcn.0043874e
mov eax, dword [ebp + 0x13c]
mov ebx, dword [ebp + 0x138]
mov dword [ebp - 0x30], eax
call fcn.00423024
push eax
lea ecx, [ebp - 0x1c]
call fcn.00421c70
lea ecx, [ebp - 0x20]
mov eax, 0x400
push ecx
xor edi, edi
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], edi
mov byte [ebp + 0x10c], 0x40
mov byte [ebp + 0x10d], 0x60
mov byte [ebp + 0x10e], 0x8f
mov byte [ebp + 0x10f], 0xc6
mov byte [ebp + 0x110], 0xea
mov byte [ebp + 0x111], 0x8a
mov byte [ebp + 0x112], 0x21
mov byte [ebp + 0x113], 0x47
mov byte [ebp + 0x114], 0x12
mov byte [ebp + 0x115], 0xa4
mov byte [ebp + 0x116], 0x97
mov byte [ebp + 0x117], 0x7a
mov byte [ebp + 0x118], 0x61
mov byte [ebp + 0x119], 0xac
mov byte [ebp + 0x11a], 0xc
mov byte [ebp + 0x11b], 0xa1
mov byte [ebp + 0x11c], 0x61
mov byte [ebp + 0x11d], 0xd4
mov byte [ebp + 0x11e], 0x3e
mov byte [ebp + 0x11f], 0x49
mov byte [ebp + 0x120], 0xe0
mov byte [ebp + 0x121], 0x9b
mov byte [ebp + 0x122], 4
mov byte [ebp + 0x123], 0x57
mov byte [ebp + 0x124], 0xa6
mov byte [ebp + 0x125], 0x99
mov byte [ebp + 0x126], 0xb5
mov byte [ebp + 0x127], 0xd8
mov byte [ebp + 0x128], 9
mov byte [ebp + 0x129], 0x56
mov byte [ebp + 0x12a], 0xac
mov byte [ebp + 0x12b], 5
mov dword [ebp - 0x20], eax
call fcn.00409312
push eax
push 0x20
lea eax, [ebp + 0x10c]
push eax
push str.a12dc3cr32
call fcn.0040d5ac
add esp, 0x14
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
call fcn.004091a3
mov ecx, ebx
mov dword [ebp - 0x14], edi
call fcn.004091d2
push edi
mov esi, reloc.WSOCK32.dll_bind
jmp 0x40bd53
push 8
lea eax, [ebp - 0x38]
push edi
push eax
call fcn.004376f0
mov ecx, dword [ebp - 0x30]
add esp, 0xc
push 0xff
lea eax, [ebp]
push eax
call fcn.00417b9c
lea eax, [ebp - 0x20]
push eax
push 0x20019
push edi
lea eax, [ebp]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xff
mov dword [ebp - 0x18], eax
lea eax, [ebp]
push edi
push eax
call fcn.004376f0
add esp, 0xc
cmp dword [ebp - 0x18], edi
jne 0x40be66
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push edi
push str.data
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40bd72
cmp dword [ebp - 0x14], edi
jne 0x40be5d
push str.ACLU_BBDS_1234_5233
mov ecx, ebx
call fcn.004095a7
push dword [ebp - 0x24]
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
lea eax, [ebp - 0x24]
push eax
push 1
push dword [ebp - 0x1c]
push esi
call fcn.004095df
add esp, 0x14
test eax, eax
je 0x40bcbb
jmp 0x40be66
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push str.fern
push dword [ebp - 0x2c]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], 3
call esi
cmp dword [ebp - 0x18], 3
je 0x40bdad
push str.ACLU_BBDS_1234_5233
mov ecx, ebx
call fcn.004095a7
jmp 0x40be54
push dword [ebp - 0x10]
call fcn.0041ab3d
pop ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push edi
push str.fern
push dword [ebp - 0x2c]
call esi
push 0x244adf
push str._08X
lea eax, [ebp + 0x100]
push 0xa
push eax
call fcn.00438bf5
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x10]
lea eax, [ebp + 0x100]
push dword [ebp - 0x14]
mov dword [ebp - 0x28], edi
push eax
call fcn.0040d105
mov eax, dword [ebp - 0x10]
add esp, 0x20
cmp eax, dword [ebp - 0x28]
ja 0x40be0c
mov eax, dword [ebp - 0x28]
push eax
mov ecx, ebx
call fcn.00409312
push dword [ebp - 0x10]
mov esi, eax
push dword [ebp - 0x14]
push esi
call fcn.00438890
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x10]
lea eax, [ebp + 0x100]
push esi
push eax
call fcn.0040d105
add esp, 0x1c
push 0xffffffffffffffff
mov ecx, ebx
call fcn.004091a3
push dword [ebp - 0x14]
call fcn.0041ab38
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebx]
add ecx, 0xfffffff0
call fcn.00409012
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x12c]
xor ecx, ebp
call fcn.004377fb
add ebp, 0x130
leave
ret