Function at 0x4980b0
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x776262
mov eax, dword fs:[0]
push eax
sub esp, 0x354
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x40
mov dword [ebp - 0x1f8], eax
lea eax, [ebp - 0x53]
push 0
mov dword [ebp - 0x200], 0
push eax
mov dword [ebp - 0x1f0], esi
mov byte [ebp - 0x54], 0
call fcn.00723180
add esp, 0xc
mov ecx, esi
push 0
push 0x799e88
call fcn.0042fb60
push 0xffffffffffffffff
push 0
mov dword [ebp - 0xb8], 0
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xb4], 0
push 0x87dea0
mov dword [ebp - 0xb4], 0xf
mov dword [ebp - 0xb8], 0
mov byte [ebp - 0xc8], 0
call fcn.0042fa30
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xc8]
push 0xffffffffffffffff
push 0
push 0x87deb8
call fcn.004072f0
cmp dword [ebp - 0xb4], 0x10
lea esi, [ebp - 0xc8]
push 0
cmovae esi, dword [ebp - 0xc8]
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0
push 0x799e88
mov dword [ebp - 0x9c], 0xf
mov dword [ebp - 0xa0], 0
mov byte [ebp - 0xb0], 0
call fcn.0042fb60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe0]
push 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 0
push 0x799e88
mov dword [ebp - 0xcc], 0xf
mov dword [ebp - 0xd0], 0
mov byte [ebp - 0xe0], 0
call fcn.0042fb60
mov byte [ebp - 4], 2
lea eax, [ebp - 0xb0]
push eax
call fcn.00497d20
lea eax, [ebp - 0xe0]
push eax
call fcn.00497ed0
push 0x40
lea eax, [ebp - 0x97]
mov dword [ebp - 0x1fc], 1
push 0
push eax
mov byte [ebp - 0x98], 0
call fcn.00723180
add esp, 0x14
mov dword [ebp - 0x1f4], 0x41
cmp dword [ebp - 0xcc], 0x10
lea ecx, [ebp - 0xe0]
lea eax, [ebp - 0xb0]
cmovae ecx, dword [ebp - 0xe0]
lea edx, [ebp - 0x1f4]
cmp dword [ebp - 0x9c], 0x10
push edx
cmovae eax, dword [ebp - 0xb0]
lea edx, [ebp - 0x98]
push edx
lea edx, [ebp - 0x1fc]
push edx
push 0xffff
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [ebp - 0x1ec], eax
test eax, eax
jne 0x49854d
cmp dword [ebp - 0x1f4], 0x41
jne 0x49854d
lea eax, [esi + 0x3f]
xor edx, edx
lea ecx, [ebp - 0x54]
cmp ecx, eax
ja 0x4982fb
lea eax, [ebp - 0x15]
cmp eax, esi
jb 0x4982fb
lea eax, [ebp - 0x98]
sub esi, eax
lea eax, [ebp - 0x98]
add eax, edx
mov cl, byte [eax + esi]
xor cl, byte [eax]
mov byte [ebp + edx - 0x54], cl
inc edx
cmp edx, 0x40
jb 0x4982e2
jmp 0x49836c
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0x98]
sub ecx, esi
lea edi, [ebp - 0x44]
sub edx, esi
sub edi, esi
lea eax, [ebp - 0x88]
sub eax, esi
mov dword [ebp - 0x1ec], edi
mov dword [ebp - 0x1f8], eax
mov eax, 2
jmp 0x498330
mov edi, dword [ebp - 0x1f8]
lea esi, [esi + 0x20]
movdqu xmm0, xmmword [esi - 0x20]
movdqu xmm1, xmmword [edx + esi - 0x20]
pxor xmm1, xmm0
movdqu xmmword [ecx + esi - 0x20], xmm1
movdqu xmm1, xmmword [edi + esi - 0x20]
mov edi, dword [ebp - 0x1ec]
movdqu xmm0, xmmword [esi - 0x10]
pxor xmm1, xmm0
movdqu xmmword [edi + esi - 0x20], xmm1
dec eax
jne 0x498330
lea eax, [ebp - 0x248]
mov dword [ebp - 0x2b0], 0x79a9c4
mov dword [ebp - 0x2a0], 0x79a9cc
mov dword [ebp - 0x1ec], eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
mov byte [ebp - 4], 6
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x298]
push 0
push eax
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x200], 1
call fcn.00408d30
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x2b0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x2b4], eax
lea eax, [ebp - 0x298]
mov ecx, eax
mov dword [ebp - 0x1ec], eax
call fcn.00408ea0
mov byte [ebp - 4], 9
mov dword [ebp - method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x2a0]
push 1
push 0
push eax
lea ecx, [ebp - 0x1e4]
call fcn.0062ce70
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x54]
push 1
push 0
push 0x40
push eax
lea ecx, [ebp - 0x360]
call fcn.0061eba0
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x184]
push 0x2000
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.0061e9c0
push dword [ebp - 0x1f0]
lea eax, [ebp - 0x2b0]
push eax
call fcn.00497450
add esp, 0x14
mov byte [ebp - 0x1e5], 1
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2f8]
call fcn.0061ed10
lea eax, [ebp - 0x2f8]
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 0xc
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0070de67
add esp, 4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x174]
call fcn.0062d030
lea eax, [ebp - 0x174]
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 0xb
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0070de67
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x248]
call fcn.00409eb0
lea eax, [ebp - 0x248]
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 2
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.0070de67
add esp, 4
jmp 0x49868e
push 0x26
mov dword [ebp - 0xe8], 0
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0xe4], 0
push str.Could_not_RegGetValue__Err:__d_Len:__d
mov dword [ebp - 0xe4], 0xf
mov dword [ebp - 0xe8], 0
mov byte [ebp - 0xf8], 0
call fcn.0042fb60
mov byte [ebp - 4], 3
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x12c]
call fcn.00483380
mov edi, eax
mov byte [ebp - 4], 4
mov ecx, edi
push dword [ebp - 0x1ec]
mov esi, dword [ebp - 0x1f4]
call fcn.004836e0
push esi
mov ecx, edi
call fcn.004836e0
lea eax, [ebp - 0x110]
mov ecx, edi
push eax
call fcn.00483750
mov edi, eax
mov byte [ebp - 4], 5
mov esi, dword [ebp - 0x1f8]
cmp esi, edi
je 0x49860c
cmp dword [esi + 0x14], 0x10
jb 0x4985f3
push dword [esi]
call fcn.00489b60
add esp, 4
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push edi
mov byte [esi], 0
call fcn.00407250
mov byte [ebp - 4], 4
cmp dword [ebp - 0xfc], 0x10
jb 0x498627
push dword [ebp - 0x110]
call fcn.00489b60
add esp, 4
mov dword [ebp - 0xfc], 0xf
mov dword [ebp - 0x100], 0
mov byte [ebp - 0x110], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x12c]
call fcn.00483470
mov byte [ebp - 4], 2
cmp dword [ebp - 0xe4], 0x10
jb 0x49866c
push dword [ebp - 0xf8]
call fcn.00489b60
add esp, 4
mov dword [ebp - 0xe4], 0xf
mov dword [ebp - 0xe8], 0
mov byte [ebp - 0xf8], 0
mov byte [ebp - 0x1e5], 0
mov byte [ebp - 4], 1
cmp dword [ebp - 0xcc], 0x10
jb 0x4986a9
push dword [ebp - 0xe0]
call fcn.00489b60
add esp, 4
mov dword [ebp - 0xcc], 0xf
mov dword [ebp - 0xd0], 0
mov byte [ebp - 0xe0], 0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x9c], 0x10
jb 0x4986df
push dword [ebp - 0xb0]
call fcn.00489b60
add esp, 4
mov dword [ebp - 0x9c], 0xf
mov dword [ebp - 0xa0], 0
mov byte [ebp - 0xb0], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xb4], 0x10
jb 0x498718
push dword [ebp - 0xc8]
call fcn.00489b60
add esp, 4
mov al, byte [ebp - 0x1e5]
mov dword [ebp - 0xb4], 0xf
mov dword [ebp - 0xb8], 0
mov byte [ebp - 0xc8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00722035
mov esp, ebp
pop ebp
ret