Function at 0x43e8fb
Capabilities:
Encode data using xor
Query or enumerate registry value
Set file attributes

Disassembly:
push 0x1c0
mov eax, 0x5809ad
call fcn.0055ddbc
and dword [ebp - 0x11c], 0
and dword [ebp - 0x120], 0
mov dword [ebp - 0x118], 0x594d18
mov ebx, dword [ebp - 0x118]
mov edi, dword [ebp - 0x118]
add edi, 0x14
mov dword [ebp - 0x124], 0x104
cmp byte [ebx + 0x13], 0
je 0x43e986
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
xor edx, edx
mov dword [ebp - 0x118], eax
pop ecx
test esi, esi
je 0x43e979
sub edi, eax
lea ecx, [edx + eax]
mov eax, edx
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
inc edx
mov byte [ecx], al
mov eax, dword [ebp - 0x118]
cmp edx, dword [ebx + 0xf]
jb 0x43e95c
mov eax, dword [ebx + 0xf]
mov ecx, dword [ebp - 0x118]
mov byte [ecx + eax], 0
mov dword [ebp - 0x118], 0x594d18
mov ebx, dword [ebp - 0x118]
mov edi, dword [ebp - 0x118]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x43e9ec
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x118], eax
pop ecx
test esi, esi
je 0x43e9e3
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp eax, dword [ebx + 0xf]
jb 0x43e9c2
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0x11c]
push eax
push 1
push 0
push edi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jle 0x43ea11
call fcn.0043f270
jmp 0x43eba9
mov dword [ebp - 0x118], 0x594d18
mov ebx, dword [ebp - 0x118]
mov edi, dword [ebp - 0x118]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x43ea77
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x118], eax
pop ecx
test esi, esi
je 0x43ea6e
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp eax, dword [ebx + 0xf]
jb 0x43ea4d
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0x11c]
push eax
push 1
push 0
push edi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43eb9d
lea eax, [ebp - 0x124]
mov dword [ebp - 0x120], 1
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x120]
push eax
push 0
push 0x594d48
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43eb98
push 1
push 0x40
push 8
push str.Temp
lea ecx, [ebp - 0x1cc]
call fcn.0042443d
and dword [ebp - 4], 0
mov dword [ebp - 0x118], 0x594d4c
mov ebx, dword [ebp - 0x118]
mov edi, dword [ebp - 0x118]
add edi, 0x14
cmp byte [ebx + 0x13], 0
je 0x43eb50
mov esi, dword [ebx + 0xf]
lea eax, [esi + 1]
push eax
call fcn.00562163
mov edx, eax
xor eax, eax
mov dword [ebp - 0x118], eax
pop ecx
test esi, esi
je 0x43eb47
sub edi, edx
lea ecx, [eax + edx]
and eax, 7
mov al, byte [eax + ebx + 7]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp eax, dword [ebx + 0xf]
jb 0x43eb26
mov eax, dword [ebx + 0xf]
mov edi, edx
mov byte [edx + eax], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x1cc]
push edi
push eax
call fcn.0042141f
pop ecx
pop ecx
push eax
call fcn.0042141f
pop ecx
pop ecx
lea ecx, [ebp - 0x1cc]
call fcn.00424a62
push 2
push str.Temp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.0043f270
lea ecx, [ebp - 0x1cc]
call fcn.00424592
jmp 0x43eb9d
call fcn.0043f270
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0055dd7a
ret