Function at 0x409630
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff764
mov eax, 0x48e5d4
push ebx
push esi
push edi
call fcn.004696b8
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x40965c
mov ecx, dword [ebp + 8]
push ecx
call fcn.00408c94
pop ecx
jmp 0x409937
push 0x10000
call fcn.00468dd0
pop ecx
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x448], 0x10000
xor eax, eax
lea edx, [ebp - 0x44c]
mov dword [ebp - 0x444], eax
push edx
push 0x409504
push 0xff
push 0
push 0
call dword [0x49a860]
mov word [ebp - 0x20], 8
mov edx, 0x48bc69
lea eax, [ebp - 4]
call fcn.00474b48
inc dword [ebp - 0x14]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
call fcn.004578d8
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00474d44
mov ebx, dword [ebp - 0x44c]
jmp 0x40972f
mov esi, ebx
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
add ebx, eax
mov edi, ebx
push ebx
call sub.KERNEL32.DLL_lstrlenA
push edi
inc eax
add ebx, eax
push esi
lea eax, [ebp - 0x84c]
push 0x48bc73
push eax
call sub.USER32.DLL_wsprintfA
mov word [ebp - 0x20], 0x14
add esp, 0x10
lea edx, [ebp - 0x84c]
lea eax, [ebp - 8]
call fcn.00474b48
inc dword [ebp - 0x14]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
call fcn.004578d8
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.00474d44
mov cl, byte [ebx]
test cl, cl
jne 0x4096d2
mov eax, dword [ebp - 0x44c]
push eax
call fcn.00468de0
pop ecx
mov esi, 0x48a760
lea edi, [ebp - 0x860]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x38], 0x80000003
lea ebx, [ebp - 0x860]
jmp 0x4097b0
lea edx, [ebp - 0x3c]
push edx
push 0x20019
push 0
push eax
mov eax, dword [ebp - 0x38]
push eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov esi, eax
mov eax, dword [ebp - 0x38]
cmp eax, 0x80000003
je 0x40978d
mov edx, dword [ebp - 0x38]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
test esi, esi
je 0x4097a7
push 0x48bcb1
lea ecx, [ebp - 0x440]
push ecx
call sub.KERNEL32.DLL_lstrcpyA
jmp 0x409906
mov eax, dword [ebp - 0x3c]
add ebx, 4
mov dword [ebp - 0x38], eax
mov eax, dword [ebx]
mov dl, byte [eax]
test dl, dl
jne 0x409763
mov dword [ebp - 0x34], 0x200
lea ecx, [ebp - 0x34]
push ecx
lea eax, [ebp - 0x240]
push eax
push 0
push 0
push 0x48bcc0
mov edx, dword [ebp - 0x38]
push edx
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4097f6
push 0x48bcd0
lea ecx, [ebp - 0x440]
push ecx
call sub.KERNEL32.DLL_lstrcpyA
jmp 0x4098fd
xor eax, eax
mov dword [ebp - 0x40], eax
lea ebx, [ebp - 0x240]
lea esi, [ebp - 0x240]
jmp 0x409881
mov al, byte [esi]
movsx edx, al
cmp edx, 0x41
jl 0x40981c
cmp edx, 0x46
jg 0x40981c
add al, 0xc9
jmp 0x40983c
movsx edx, al
cmp edx, 0x61
jl 0x40982d
cmp edx, 0x66
jg 0x40982d
add al, 0xa9
jmp 0x40983c
movsx edx, al
cmp edx, 0x30
jl 0x40983c
cmp edx, 0x39
jg 0x40983c
add al, 0xd0
mov dl, byte [esi + 1]
movsx ecx, dl
cmp ecx, 0x41
jl 0x409851
cmp ecx, 0x46
jg 0x409851
add dl, 0xc9
jmp 0x409873
movsx ecx, dl
cmp ecx, 0x61
jl 0x409863
cmp ecx, 0x66
jg 0x409863
add dl, 0xa9
jmp 0x409873
movsx ecx, dl
cmp ecx, 0x30
jl 0x409873
cmp ecx, 0x39
jg 0x409873
add dl, 0xd0
shl eax, 4
or dl, al
mov byte [ebx], dl
inc dword [ebp - 0x40]
inc ebx
add esi, 2
mov eax, dword [ebp - 0x34]
shr eax, 1
mov edx, dword [ebp - 0x40]
cmp eax, edx
ja 0x409809
mov esi, 0x48a774
lea edi, [ebp - 0x89c]
mov ecx, 0xf
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x34]
shr eax, 1
cmp eax, 0x3c
jbe 0x4098b2
mov eax, 0x3c
xor edx, edx
mov dword [ebp - 0x40], edx
lea esi, [ebp - 0x240]
lea ebx, [ebp - 0x89c]
mov edx, dword [ebp - 0x40]
cmp eax, edx
jbe 0x4098da
mov cl, byte [ebx]
xor byte [esi], cl
inc dword [ebp - 0x40]
inc esi
inc ebx
mov edx, dword [ebp - 0x40]
cmp eax, edx
ja 0x4098ca
mov byte [ebp + eax - 0x240], 0
lea eax, [ebp - 0x240]
lea ecx, [ebp - 0x440]
push eax
push 0x48bce9
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 0xc
mov eax, dword [ebp - 0x38]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov word [ebp - 0x20], 0x20
lea edx, [ebp - 0x440]
lea eax, [ebp - 0xc]
call fcn.00474b48
inc dword [ebp - 0x14]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
call fcn.004578d8
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00474d44
xor eax, eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret