Function at 0x42b8b0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51fe38
mov eax, dword fs:[0]
push eax
sub esp, 0x538
mov eax, dword [0x57c8b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x53c], 4
mov edi, 1
mov dword [ebp - 0x540], 0
mov dword [ebp - 0x538], 4
mov dword [ebp - 0x94], 0x4f0053
mov dword [ebp - 0x90], 0x540046
mov dword [ebp - 0x8c], 0x410057
mov dword [ebp - 0x88], 0x450052
mov dword [ebp - 0x84], 0x4d005c
mov dword [ebp - 0x80], 0x630069
mov dword [ebp - 0x7c], 0x6f0072
mov dword [ebp - 0x78], 0x6f0073
mov dword [ebp - 0x74], 0x740066
mov dword [ebp - 0x70], 0x57005c
mov dword [ebp - 0x6c], 0x6e0069
mov dword [ebp - 0x68], 0x6f0064
mov dword [ebp - 0x64], 0x730077
mov dword [ebp - 0x60], 0x43005c
mov dword [ebp - 0x5c], 0x720075
mov dword [ebp - 0x58], 0x650072
mov dword [ebp - 0x54], 0x74006e
mov dword [ebp - 0x50], 0x650056
mov dword [ebp - 0x4c], 0x730072
mov dword [ebp - 0x48], 0x6f0069
mov dword [ebp - 0x44], 0x5c006e
mov dword [ebp - 0x40], 0x700041
mov dword [ebp - 0x3c], 0x200070
mov dword [ebp - 0x38], 0x610050
mov dword [ebp - 0x34], 0x680074
mov dword [ebp - 0x30], 0x5c0073
mov dword [ebp - 0x2c], 0x360033
mov dword [ebp - 0x28], 0x770030
mov dword [ebp - 0x24], 0x610070
mov dword [ebp - 0x20], 0x700070
mov dword [ebp - 0x1c], 0x65002e
mov dword [ebp - 0x18], 0x650078
mov word [ebp - 0x14], ax
call fcn.00409390
mov ecx, eax
test ecx, ecx
je 0x42bf60
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x52c], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x52c]
call fcn.0040ac20
test al, al
jne 0x42ba62
lea ecx, [ebp - 0x94]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ba40
sub ecx, edx
lea eax, [ebp - 0x94]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x52c]
call fcn.0040a4c0
mov esi, dword [ebp - 0x52c]
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x540]
mov dword [ebp - 4], 0xffffffff
push eax
lea eax, [ebp - 0x53c]
push eax
push 0x539b24
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42baa9
cmp dword [ebp - 0x540], 1
mov byte [ebp - 0x52d], 1
je 0x42bab0
mov byte [ebp - 0x52d], 0
or ebx, 0xffffffff
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42baca
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x52d], 0
jne 0x42bf42
push 0x208
lea eax, [ebp - 0x320]
push 0
push eax
call fcn.004a99f0
add esp, 0xc
mov dword [ebp - 0x53c], 1
xor eax, eax
mov dword [ebp - 0x538], 0x104
mov dword [ebp - 0x118], 0x4f0053
mov dword [ebp - 0x114], 0x540046
mov dword [ebp - 0x110], 0x410057
mov dword [ebp - 0x10c], 0x450052
mov dword [ebp - 0x108], 0x4d005c
mov dword [ebp - 0x104], 0x630069
mov dword [ebp - 0x100], 0x6f0072
mov dword [ebp - 0xfc], 0x6f0073
mov dword [ebp - 0xf8], 0x740066
mov dword [ebp - 0xf4], 0x57005c
mov dword [ebp - 0xf0], 0x6e0069
mov dword [ebp - 0xec], 0x6f0064
mov dword [ebp - 0xe8], 0x730077
mov dword [ebp - 0xe4], 0x43005c
mov dword [ebp - 0xe0], 0x720075
mov dword [ebp - 0xdc], 0x650072
mov dword [ebp - 0xd8], 0x74006e
mov dword [ebp - 0xd4], 0x650056
mov dword [ebp - 0xd0], 0x730072
mov dword [ebp - 0xcc], 0x6f0069
mov dword [ebp - 0xc8], 0x5c006e
mov dword [ebp - 0xc4], 0x700041
mov dword [ebp - 0xc0], 0x200070
mov dword [ebp - 0xbc], 0x610050
mov dword [ebp - 0xb8], 0x680074
mov dword [ebp - 0xb4], 0x5c0073
mov dword [ebp - 0xb0], 0x360033
mov dword [ebp - 0xac], 0x770030
mov dword [ebp - 0xa8], 0x610070
mov dword [ebp - 0xa4], 0x700070
mov dword [ebp - 0xa0], 0x65002e
mov dword [ebp - 0x9c], 0x650078
mov word [ebp - 0x98], ax
call fcn.00409390
mov ecx, eax
test ecx, ecx
je 0x42bf6a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x52c], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x52c]
call fcn.0040ac20
test al, al
jne 0x42bcb2
lea ecx, [ebp - 0x118]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42bc90
sub ecx, edx
lea eax, [ebp - 0x118]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x52c]
call fcn.0040a4c0
mov esi, dword [ebp - 0x52c]
mov eax, ebx
mov dword [ebp - 4], 0xffffffff
lea edx, [esi - 0x10]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42bcd6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x53c]
push eax
push 0x535c84
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42bf42
push str.birdwp.exe
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42bf42
push 0x208
lea eax, [ebp - 0x528]
push 0
push eax
call fcn.004a99f0
add esp, 0xc
lea eax, [ebp - 0x528]
push 0x104
push eax
push dword [0x57fc98]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.00409390
mov ecx, eax
test ecx, ecx
je 0x42bf74
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x544], eax
mov dword [ebp - 4], 2
call fcn.00409390
mov ecx, eax
test ecx, ecx
je 0x42bf7e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x52c], eax
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x52c]
call fcn.0040ac20
test al, al
jne 0x42bde2
lea ecx, [ebp - 0x320]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42bdc0
sub ecx, edx
lea eax, [ebp - 0x320]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x52c]
call fcn.0040a4c0
lea eax, [ebp - 0x544]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x52c]
push eax
call fcn.00408df0
mov edx, dword [ebp - 0x52c]
add esp, 8
mov byte [ebp - 4], 2
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42be1d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00409390
mov ecx, eax
test ecx, ecx
je 0x42bf88
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x534], eax
mov byte [ebp - 4], 5
call fcn.00409390
mov ecx, eax
test ecx, ecx
je 0x42bf92
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x52c], eax
lea eax, [ebp - 0x528]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x52c]
call fcn.0040ac20
test al, al
jne 0x42bea2
lea eax, [ebp - 0x528]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42be80
sub eax, edx
lea ecx, [ebp - 0x52c]
sar eax, 1
push eax
lea eax, [ebp - 0x528]
push eax
call fcn.0040a4c0
lea eax, [ebp - 0x534]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x52c]
push eax
call fcn.00408df0
mov edx, dword [ebp - 0x52c]
add esp, 8
mov byte [ebp - 4], 5
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42bedd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x544]
mov esi, dword [ebp - 0x534]
push edi
push esi
call fcn.0041c100
xor edx, edx
mov byte [ebp - 4], 2
add esp, 8
mov ecx, 1
test eax, eax
mov eax, ebx
cmovs ecx, edx
add esi, 0xfffffff0
mov dword [ebp - 0x534], ecx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x42bf20
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x42bf3c
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, dword [ebp - 0x534]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00490238
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00408b70
push 0x80004005
call fcn.00408b70
push 0x80004005
call fcn.00408b70
push 0x80004005
call fcn.00408b70
push 0x80004005
call fcn.00408b70
push 0x80004005
call fcn.00408b70
int3