Function at 0x436ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
lea ebp, [esp - 0x5c]
sub esp, 0x5c
push 0xffffffffffffffff
push 0x480e99
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
push ebx
push esi
push edi
mov eax, dword [0x4bb27c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp + 0x20], esi
mov dword [ebp - 4], 1
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 3
call fcn.00436930
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], esi
mov eax, dword [0x4be0cc]
mov edx, dword [eax + 0xc]
mov ecx, 0x4be0cc
mov byte [ebp - 4], 4
call edx
add eax, 0x10
mov dword [ebp + 0x28], eax
mov ecx, dword [0x4ba54c]
mov ebx, dword [ebp + 0x68]
lea eax, [ebp + 0x44]
push eax
push ecx
lea edx, [ebp + 0x4c]
push edx
mov ecx, ebx
mov byte [ebp - 4], 5
mov dword [ebp + 0x44], esi
call fcn.0040cd80
push eax
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 6
call fcn.00403000
mov eax, dword [ebp + 0x4c]
add eax, 0xfffffff0
mov byte [ebp - 4], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436f90
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [ebx]
mov ecx, dword [ebp + 0x28]
cmp dword [ecx - 0xc], 0
mov eax, dword [ebp + 0x38]
je 0x436ffe
mov ecx, dword [eax + 4]
lea edi, [eax + 4]
lea edx, [ebp + 0x28]
push edx
push ecx
push eax
lea ecx, [ebp + 0x34]
call fcn.004369c0
push 1
lea ecx, [ebp + 0x34]
mov esi, eax
call fcn.00436d20
mov dword [edi], esi
mov eax, dword [esi + 4]
lea edx, [ebp + 0x44]
mov dword [eax], esi
mov eax, dword [0x4ba54c]
push edx
push eax
lea ecx, [ebp + 0x4c]
push ecx
mov ecx, ebx
call fcn.0040cd80
push eax
lea ecx, [ebp + 0x28]
mov byte [ebp - 4], 7
call fcn.00403000
mov eax, dword [ebp + 0x4c]
add eax, 0xfffffff0
mov byte [ebp - 4], 5
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x436f7e
mov esi, dword [eax]
cmp esi, eax
jne 0x437009
call fcn.00465ea2
mov eax, dword [esi + 8]
sub eax, 0x10
push eax
call fcn.00403120
lea esi, [eax + 0x10]
add esp, 4
mov dword [ebp + 0x44], esi
mov ecx, dword [ebp + 0x38]
mov eax, dword [ecx]
push eax
lea ecx, [ebp + 0x34]
push ecx
lea edx, [ebp + 0x2c]
push edx
mov byte [ebp - 4], 8
call fcn.00436bb0
mov ecx, str.HKEY_LOCAL_MACHINE
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x437066
test dx, dx
je 0x437062
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x437066
add eax, 4
add ecx, 4
test dx, dx
jne 0x437040
xor eax, eax
jmp 0x43706b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x43707e
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x43713c
mov ecx, str.HKEY_CURRENT_USER
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4370ab
test dx, dx
je 0x4370a7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4370ab
add eax, 4
add ecx, 4
test dx, dx
jne 0x437085
xor eax, eax
jmp 0x4370b0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x4370c0
mov esi, SysReAllocString
jmp 0x43713c
mov ecx, str.HKEY_CURRENT_CONFIG
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4370ed
test dx, dx
je 0x4370e9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4370ed
add eax, 4
add ecx, 4
test dx, dx
jne 0x4370c7
xor eax, eax
jmp 0x4370f2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x437102
mov esi, SysStringLen
jmp 0x43713c
lea eax, [ebp + 0x44]
push str.HKEY_USERS
push eax
call fcn.004196d0
add esp, 8
test al, al
je 0x43711e
mov esi, SysStringLen
jmp 0x43713c
lea ecx, [ebp + 0x44]
push str.HKEY_CLASSES_ROOT
push ecx
call fcn.004196d0
add esp, 8
test al, al
je 0x43754d
mov esi, SysReAllocString
cmp dword [ebp + 0x3c], 0
mov byte [ebp - 4], 0xc
mov dword [ebp + 0x24], esi
jbe 0x43753f
mov eax, dword [ebp + 0x38]
mov ecx, dword [eax + 4]
cmp ecx, eax
mov dword [ebp + 0x4c], ecx
jne 0x437162
call fcn.00465ea2
mov eax, dword [ebp + 0x38]
cmp byte [ebp + 0x78], 0
mov dword [ebp + 0x40], 0x20019
je 0x437176
mov dword [ebp + 0x40], 0x20119
mov ebx, dword [eax]
lea eax, [ebp + 0x34]
test eax, eax
je 0x437185
mov ecx, eax
cmp eax, ecx
je 0x43718a
call fcn.00465ea2
mov edi, dword [ebp + 0x4c]
cmp ebx, edi
je 0x43721e
lea eax, [ebp + 0x34]
test eax, eax
jne 0x4371a1
call fcn.00465ea2
lea eax, [ebp + 0x34]
cmp ebx, dword [eax + 4]
jne 0x4371ae
call fcn.00465ea2
cmp byte [ebp + 0x74], 0
mov eax, dword [ebx + 8]
mov dword [ebp + 0x58], 0
lea ecx, [ebp + 0x58]
je 0x4371dc
lea edx, [ebp + 0x30]
push edx
mov edx, dword [ebp + 0x40]
push ecx
push 0
push edx
push 0
push 0
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
jmp 0x4371eb
mov edx, dword [ebp + 0x40]
push ecx
push edx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x437200
test esi, esi
je 0x4371fa
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x58]
mov dword [ebp + 0x24], esi
mov edi, eax
test edi, edi
jne 0x4372bf
lea eax, [ebp + 0x34]
cmp ebx, dword [eax + 4]
jne 0x437217
call fcn.00465ea2
mov ebx, dword [ebx]
jmp 0x437178
cmp byte [ebp + 0x70], 0
mov ebx, dword [ebp + 0x40]
je 0x43722d
or ebx, 0x20006
cmp byte [ebp + 0x74], 0
lea eax, [ebp + 0x34]
je 0x437271
test eax, eax
jne 0x43723f
call fcn.00465ea2
lea eax, [ebp + 0x34]
cmp edi, dword [eax + 4]
jne 0x43724c
call fcn.00465ea2
mov edi, dword [edi + 8]
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp + 0x58]
push ecx
push 0
push ebx
push 0
push 0
push 0
push edi
push esi
mov dword [ebp + 0x58], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
jmp 0x4372a0
test eax, eax
jne 0x43727a
call fcn.00465ea2
lea eax, [ebp + 0x34]
cmp edi, dword [eax + 4]
jne 0x437287
call fcn.00465ea2
mov edi, dword [edi + 8]
lea edx, [ebp + 0x58]
push edx
push ebx
push 0
push edi
push esi
mov dword [ebp + 0x58], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4372b5
test esi, esi
je 0x4372af
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x58]
mov dword [ebp + 0x24], esi
mov edi, eax
test edi, edi
je 0x43753f
cmp byte [ebp + 0x6c], 0
jne 0x437360
cmp byte [ebp + 0x74], 0
jne 0x437360
mov edi, dword [ebp + 0x64]
mov dword [edi], 0
or dword [ebp + 0x20], 1
test esi, esi
je 0x4372eb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x44]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 5
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43730e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x28]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 4
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437331
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 3
call fcn.00436c30
mov ecx, dword [ebp + 0x38]
push ecx
call fcn.004657f0
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x5c
mov esp, ebp
pop ebp
ret
push str.CNRegistry::RegOpenRegKey
lea ecx, [ebp + 0x40]
call fcn.004031f0
push str..NRegistry.cpp
lea ecx, [ebp + 0x58]
mov byte [ebp - 4], 0xd
call fcn.004031f0
test edi, edi
mov byte [ebp - 4], 0xe
mov esi, edi
jle 0x437394
and esi, 0xffff
or esi, 0x80070000
push 0
lea edx, [ebp + 0x30]
push edi
push edx
call fcn.00435510
add esp, 0xc
lea ecx, [ebp + 0x40]
push ecx
push 0x5c
lea edx, [ebp + 0x58]
push edx
push esi
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xf
call fcn.0041fce0
mov eax, dword [ebp + 0x30]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4373de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x58]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x12
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437401
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x40]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x13
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437424
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.CNRegistry::RegOpenRegKey
lea ecx, [ebp + 0x4c]
call fcn.004031f0
push str..NRegistry.cpp
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x14
call fcn.004031f0
mov bl, 0x15
push str.Failed_to_open_registry_key.
lea ecx, [ebp + 0x50]
mov byte [ebp - 4], bl
call fcn.004031f0
lea ecx, [ebp + 0x4c]
push ecx
push 0x5d
lea edx, [ebp + 0x54]
push edx
push 0x7d4
lea eax, [ebp + 0x50]
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x16
call fcn.0041fbe0
mov eax, dword [ebp + 0x50]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437495
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x54]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x14
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4374b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x4c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x13
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4374db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.Registry_key
lea ecx, [ebp + 0x4c]
call fcn.004031f0
mov ecx, dword [ebp + 0x68]
push ecx
lea edx, [ebp + 0x4c]
push edx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x17
call fcn.0041e440
mov eax, dword [ebp + 0x4c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x13
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43751f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0xf0]
call fcn.0041f780
push 0x4b1c2c
lea edx, [ebp - 0xf0]
push edx
call fcn.00466ffb
mov edi, dword [ebp + 0x64]
or dword [ebp + 0x20], 1
mov dword [edi], esi
jmp 0x4372eb
push str.CNRegistry::RegOpenRegKey
lea ecx, [ebp + 0x30]
call fcn.004031f0
push str..NRegistry.cpp
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 9
call fcn.004031f0
push 0x4993ac
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0xa
call fcn.004031f0
lea edx, [ebp + 0x30]
push edx
push 0x29
lea eax, [ebp + 0x4c]
push eax
push 0x3f2
lea ecx, [ebp + 0x54]
push ecx
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xb
call fcn.0041fce0
push 0x4b1c2c
lea edx, [ebp - 0x80]
push edx
call fcn.00466ffb
push str.CNRegistry::RegOpenRegKey
lea ecx, [ebp + 0x30]
call fcn.004031f0
push str..NRegistry.cpp
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0x19
call fcn.004031f0
push 0x497188
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x1a
call fcn.004031f0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x1b
call fcn.0041f900
lea ecx, [ebp + 0x30]
push ecx
push 0x64
lea edx, [ebp + 0x4c]
push edx
push 0x3ed
lea ecx, [ebp + 0x54]
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x1c
call fcn.0041fbe0
push eax
lea ecx, [ebp - 0x1d0]
call fcn.0041f780
push 0x4b1c2c
lea edx, [ebp - 0x1d0]
push edx
call fcn.00466ffb
push str.CNRegistry::RegOpenRegKey
lea ecx, [ebp + 0x50]
call fcn.004031f0
push str..NRegistry.cpp
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x1d
call fcn.004031f0
push str.Stacktrace.
lea ecx, [ebp + 0x4c]
mov byte [ebp - 4], 0x1e
call fcn.004031f0
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x50]
push eax
push 0x64
lea ecx, [ebp + 0x54]
push ecx
push 0x3ed
lea edx, [ebp + 0x4c]
push edx
mov ecx, esi
mov byte [ebp - 4], 0x1f
call fcn.0041fbe0
lea ecx, [ebp + 0x4c]
call fcn.004032a0
lea ecx, [ebp + 0x54]
call fcn.004032a0
lea ecx, [ebp + 0x50]
mov byte [ebp - 4], 0x18
call fcn.004032a0
push esi
lea ecx, [ebp - 0x160]
call fcn.0041f780
push 0x4b1c2c
lea eax, [ebp - 0x160]
push eax
call fcn.00466ffb
push str.std_exception_caught:
lea ecx, [ebp + 0x4c]
call fcn.004031f0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
mov byte [ebp - 4], 0x20
call eax
push eax
lea ecx, [ebp + 0x4c]
call fcn.00401ba0
push str.CNRegistry::RegOpenRegKey
lea ecx, [ebp + 0x30]
call fcn.004031f0
push str..NRegistry.cpp
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x21
call fcn.004031f0
lea ecx, [ebp + 0x30]
push ecx
push 0x64
lea edx, [ebp + 0x54]
push edx
push 0x3ea
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x22
call fcn.0041fce0
push 0x4b1c2c
lea ecx, [ebp - 0x240]
push ecx
call fcn.00466ffb
push str.char_exception_caught:
lea ecx, [ebp + 0x54]
call fcn.004031f0
mov edx, dword [ebp + 4]
push edx
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 0x23
call fcn.00401ba0
push str.CNRegistry::RegOpenRegKey
lea ecx, [ebp + 0x30]
call fcn.004031f0
push str..NRegistry.cpp
lea ecx, [ebp + 0x50]
mov byte [ebp - 4], 0x24
call fcn.004031f0
lea eax, [ebp + 0x30]
push eax
push 0x64
lea ecx, [ebp + 0x50]
push ecx
push 0x3eb
lea edx, [ebp + 0x54]
push edx
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x25
call fcn.0041fce0
push 0x4b1c2c
lea eax, [ebp - 0xb8]
push eax
call fcn.00466ffb
push str.wchar_t_exception_caught:
lea ecx, [ebp + 0x50]
call fcn.004031f0
mov ecx, dword [ebp + 0x1c]
push ecx
lea ecx, [ebp + 0x50]
mov byte [ebp - 4], 0x26
call fcn.00401b60
push str.CNRegistry::RegOpenRegKey
lea ecx, [ebp + 0x30]
call fcn.004031f0
push str..NRegistry.cpp
lea ecx, [ebp + 0x58]
mov byte [ebp - 4], 0x27
call fcn.004031f0
lea edx, [ebp + 0x30]
push edx
push 0x64
lea eax, [ebp + 0x58]
push eax
push 0x3ec
lea ecx, [ebp + 0x50]
push ecx
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x28
call fcn.0041fce0
push 0x4b1c2c
lea edx, [ebp - 0x128]
push edx
call fcn.00466ffb
push str.Unhandled_exception_caught__Possibly_caused_by_access_violation_
lea ecx, [ebp + 0x44]
call fcn.004031f0
push str.CNRegistry::RegOpenRegKey
lea ecx, [ebp + 0x30]
mov byte [ebp - 4], 0x29
call fcn.004031f0
push str..NRegistry.cpp
lea ecx, [ebp + 0x58]
mov byte [ebp - 4], 0x2a
call fcn.004031f0
lea eax, [ebp + 0x30]
push eax
push 0x64
lea ecx, [ebp + 0x58]
push ecx
push 0x3e9
lea edx, [ebp + 0x44]
push edx
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x2b
call fcn.0041fce0
push 0x4b1c2c
lea eax, [ebp - 0x198]
push eax
call fcn.00466ffb
mov ecx, dword [ebp + 0x18]
push ecx
lea ecx, [ebp - 0x208]
call fcn.0041f780
push 0x4b1c2c
lea edx, [ebp - 0x208]
push edx
call fcn.00466ffb
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x278]
call fcn.0041f780
push 0x4b1c2c
lea ecx, [ebp - 0x278]
push ecx
call fcn.00466ffb
int3