Function at 0x41f8e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value

Disassembly:
sub esp, 0x70
mov eax, dword [0x4310d8]
mov dword [esp + 0x6c], eax
mov al, 0x78
push ebx
mov byte [esp + 0x54], al
mov byte [esp + 0x63], al
mov al, 0x92
push ebp
push esi
mov byte [esp + 0x6c], al
mov byte [esp + 0x72], al
mov al, 0x10
mov esi, ecx
mov bl, 0x87
mov dl, 0x5c
mov cl, 0x91
mov byte [esp + 0x32], al
mov byte [esp + 0x35], al
push edi
mov byte [esp + 0x5c], 0x7b
mov byte [esp + 0x5d], 0x3a
mov byte [esp + 0x5e], 0x59
mov byte [esp + 0x5f], 0xfe
mov byte [esp + 0x61], 0xb0
mov byte [esp + 0x62], 0xb1
mov byte [esp + 0x63], 0x27
mov byte [esp + 0x64], 0x34
mov byte [esp + 0x65], 0xf8
mov byte [esp + 0x66], 0x7f
mov byte [esp + 0x67], 0x7a
mov byte [esp + 0x68], 6
mov byte [esp + 0x69], 0x30
mov byte [esp + 0x6a], 0xcb
mov byte [esp + 0x6b], 0xef
mov byte [esp + 0x6c], bl
mov byte [esp + 0x6d], 0xae
mov byte [esp + 0x6e], 0xc9
mov byte [esp + 0x71], 0x32
mov byte [esp + 0x72], 0xab
mov byte [esp + 0x73], 0x86
mov byte [esp + 0x74], 0x63
mov byte [esp + 0x75], 0x79
mov byte [esp + 0x77], dl
mov byte [esp + 0x78], cl
mov byte [esp + 0x2c], 0x28
mov byte [esp + 0x2d], 0x75
mov byte [esp + 0x2e], 0x1f
mov byte [esp + 0x2f], 0xaa
mov byte [esp + 0x30], 0x2f
mov byte [esp + 0x31], 0xf1
mov byte [esp + 0x32], 0xe3
mov byte [esp + 0x33], 0x62
mov byte [esp + 0x34], 0x68
mov byte [esp + 0x35], 0xa2
mov byte [esp + 0x37], 0x14
mov byte [esp + 0x38], 0x63
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0x8e
mov byte [esp + 0x3c], 0xe5
mov byte [esp + 0x3d], 0xdd
mov byte [esp + 0x3e], 0x95
mov byte [esp + 0x3f], 0x22
mov byte [esp + 0x40], 0xfd
mov byte [esp + 0x41], dl
mov byte [esp + 0x42], 0xce
mov byte [esp + 0x43], 0xc7
mov byte [esp + 0x44], 0xf
mov byte [esp + 0x45], 0x18
mov byte [esp + 0x46], 0xe0
mov byte [esp + 0x47], 0x31
mov byte [esp + 0x48], cl
xor eax, eax
mov bl, byte [esp + eax + 0x5c]
mov cl, byte [esp + eax + 0x2c]
xor bl, cl
mov byte [esp + eax + 0x5c], bl
inc eax
cmp eax, 0x1d
jl 0x41fa16
mov eax, dword [0x431f34]
mov cx, word [0x431f38]
add eax, 0x32
mov bl, 0x65
mov dword [0x431f34], eax
mov byte [esp + 0x2c], 0x2f
mov byte [esp + 0x2d], 0x3f
mov byte [esp + 0x2e], 0xb5
mov byte [esp + 0x2f], 0xfe
mov byte [esp + 0x30], 0xf6
mov byte [esp + 0x31], 0x46
mov byte [esp + 0x32], 0xde
mov byte [esp + 0x33], 0xbf
mov byte [esp + 0x34], 0xa3
mov byte [esp + 0x35], 0x8b
mov byte [esp + 0x36], 0xe9
mov byte [esp + 0x37], 0x55
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], 0xc3
mov byte [esp + 0x3a], 0xad
mov byte [esp + 0x1c], 0x14
mov byte [esp + 0x1d], 0x36
mov byte [esp + 0x1e], 0xbd
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], 0x6f
mov byte [esp + 0x21], 0x28
mov byte [esp + 0x22], 0x96
mov byte [esp + 0x23], 0x97
mov byte [esp + 0x24], 0xc2
mov byte [esp + 0x25], 0xe7
mov byte [esp + 0x26], 0x8a
mov byte [esp + 0x27], 0x14
mov byte [esp + 0x28], 0xa
mov byte [esp + 0x29], 0xab
mov byte [esp + 0x2a], 0x53
xor eax, eax
jmp 0x41fae0
mov dl, byte [esp + eax + 0x1c]
add byte [esp + eax + 0x2c], dl
mov dl, byte [esp + eax + 0x1d]
add byte [esp + eax + 0x2d], dl
mov dl, byte [esp + eax + 0x1e]
add byte [esp + eax + 0x2e], dl
mov dl, byte [esp + eax + 0x1f]
add byte [esp + eax + 0x2f], dl
mov dl, byte [esp + eax + 0x20]
add byte [esp + eax + 0x30], dl
add cx, 0x6d
add cx, 0x6d
add cx, 0x6d
add cx, 0x6d
add eax, 5
add cx, 0x6d
cmp eax, 0xf
jl 0x41fae0
mov al, 0xd
mov byte [esp + 0x58], al
mov byte [esp + 0x4c], al
lea eax, [esp + 0x54]
push eax
lea edx, [esp + 0x50]
mov eax, 6
mov word [0x431f38], cx
mov byte [esp + 0x58], 0xc4
mov byte [esp + 0x59], 0xd4
mov byte [esp + 0x5a], 0x79
mov byte [esp + 0x5b], 0xbe
mov byte [esp + 0x5d], 0xdb
mov byte [esp + 0x51], 0x7b
mov byte [esp + 0x52], 8
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], 0xa
mov byte [esp + 0x55], 0x64
call fcn.0041e250
mov dword [esp + 0x4c], eax
mov ax, word [0x431f38]
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
mov cl, 0x41
push 0xff
add ax, 0x6d
push 8
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], 0x63
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x28], 0x76
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x5a
mov byte [esp + 0x2b], cl
mov byte [esp + 0x2c], 0
mov word [0x431f38], ax
mov dword [esp + 0x20], 0xff
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
lea edx, [esp + 0x68]
push edx
push 0x80000002
mov edi, eax
mov bl, 0x3d
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
je 0x41fc29
call ebp
mov dword [esi + 0x14], eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push edi
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41fc51
call ebp
mov dword [esi + 0x14], eax
jmp 0x41fcbd
push 0x42e310
push edi
call fcn.00425a4d
add esp, 8
test eax, eax
je 0x41fc6f
push eax
call fcn.004259c0
add esp, 4
mov dword [esi + 4], eax
push 0x42e310
push 0
call fcn.00425a4d
add esp, 8
test eax, eax
je 0x41fc8e
push eax
call fcn.004259c0
add esp, 4
mov dword [esi + 8], eax
push 0x42e310
push 0
call fcn.00425a4d
add esp, 8
test eax, eax
je 0x41fcad
push eax
call fcn.004259c0
add esp, 4
mov dword [esi + 0xc], eax
xor bl, bl
mov dword [esi + 0x10], 0x14
mov dword [esi + 0x18], 1
mov ecx, dword [esp + 0x4c]
lea ebp, [esi + 0x14]
push ebp
push ecx
mov ecx, esi
call fcn.0041f020
push ebp
lea edx, [esp + 0x20]
push edx
mov ecx, esi
mov dword [esi + 0x1c], eax
call fcn.0041f100
mov dword [esi + 0x20], eax
mov al, bl
mov cl, 0x38
imul cl
mov ecx, dword [0x431f2c]
and al, bl
imul ecx, ecx, 0x3b11
and al, 0x50
movsx dx, al
movsx ax, byte [0x431f30]
push edi
push 0
mov dword [0x431f2c], ecx
imul edx, dword [0x431f38]
add edx, eax
or edx, 0x5b
mov word [0x431f38], dx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.00424873
add esp, 0x70
ret