Function at 0x411cfd
Capabilities:
Encode data using xor
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5ac
mov eax, dword [0x427040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x4027d0]
push ebx
movups xmmword [ebp - 0x56c], xmm0
xor ebx, ebx
mov dword [ebp - 0x54c], 0x595d4f6e
movaps xmm0, xmmword [0x402a80]
mov ecx, ebx
movups xmmword [ebp - 0x55c], xmm0
mov dword [ebp - 0x548], 0x7d817d37
mov byte [ebp - 0x544], bl
movsx eax, byte [ebp - 0x56c]
and eax, 0x8000000f
jns 0x411d5e
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x56b], al
inc ecx
cmp ecx, 0x27
jb 0x411d4b
movaps xmm0, xmmword [0x402bb0]
mov ecx, ebx
movups xmmword [ebp - 0x58c], xmm0
mov byte [ebp - 0x544], bl
movaps xmm0, xmmword [0x402090]
movups xmmword [ebp - 0x57c], xmm0
movsx eax, byte [ebp - 0x58c]
and eax, 0x8000000f
jns 0x411da2
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x58b], al
inc ecx
cmp ecx, 0x1e
jb 0x411d8f
lea eax, [ebp - 0x5a0]
mov byte [ebp - 0x56d], bl
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x58b]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412205
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5a4]
mov dword [ebp - 0x5a8], ebx
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x5a4], 0x100
push eax
push ebx
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x4121f9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4121b6
lea eax, [ebp - 0x59c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4121b6
xor edx, edx
mov dword [ebp - 0x598], 0x100
mov al, 0x1f
mov dword [ebp - 0x510], 0x827e571f
mov word [ebp - 0x50c], 0x83
mov ecx, edx
movsx eax, al
and eax, 0x8000000f
jns 0x411e7f
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x50f], al
inc ecx
cmp ecx, 4
jae 0x411e94
mov al, byte [ebp - 0x510]
jmp 0x411e70
lea eax, [ebp - 0x598]
mov byte [ebp - 0x50b], dl
push eax
lea eax, [ebp - 0x208]
push eax
push edx
push edx
lea eax, [ebp - 0x50f]
push eax
push dword [ebp - 0x59c]
call ebx
test eax, eax
jne 0x411f22
mov al, 0x6c
mov dword [ebp - 0x530], 0x7f7b546c
mov dword [ebp - 0x52c], 0x2c4680
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x411ee4
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x52f], al
inc ecx
cmp ecx, 6
jae 0x411ef9
mov al, byte [ebp - 0x530]
jmp 0x411ed5
lea edx, [ebp - 0x52f]
mov byte [ebp - 0x529], 0
lea ecx, [ebp - 0x56b]
call fcn.0041aea4
lea edx, [ebp - 0x208]
lea ecx, [ebp - 0x56b]
call fcn.0041aea4
xor edx, edx
mov dword [ebp - 0x598], 0x100
mov al, 0xc
mov dword [ebp - 0x518], 0x717f610c
mov word [ebp - 0x514], 0x7e
mov ecx, edx
movsx eax, al
and eax, 0x8000000f
jns 0x411f54
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x517], al
inc ecx
cmp ecx, 4
jae 0x411f69
mov al, byte [ebp - 0x518]
jmp 0x411f45
lea eax, [ebp - 0x598]
mov byte [ebp - 0x513], dl
push eax
lea eax, [ebp - 0x308]
push eax
push edx
push edx
lea eax, [ebp - 0x517]
push eax
push dword [ebp - 0x59c]
call ebx
test eax, eax
jne 0x411fe6
mov cl, 0x38
mov dword [ebp - 0x538], 0x5d4b6d38
mov dword [ebp - 0x534], 0x18024a
xor byte [ebp + eax - 0x537], cl
inc eax
cmp eax, 6
jae 0x411fbd
mov cl, byte [ebp - 0x538]
jmp 0x411fa8
lea edx, [ebp - 0x537]
mov byte [ebp - 0x531], 0
lea ecx, [ebp - 0x56b]
call fcn.0041aea4
lea edx, [ebp - 0x308]
lea ecx, [ebp - 0x56b]
call fcn.0041aea4
xor edx, edx
mov dword [ebp - 0x598], 0x100
mov cl, 2
mov dword [ebp - 0x520], 0x6f634c02
mov word [ebp - 0x51c], 0x67
mov eax, edx
xor byte [ebp + eax - 0x51f], cl
inc eax
cmp eax, 4
jae 0x41201e
mov cl, byte [ebp - 0x520]
jmp 0x412009
lea eax, [ebp - 0x598]
mov byte [ebp - 0x51b], dl
push eax
lea eax, [ebp - 0x408]
push eax
push edx
push edx
lea eax, [ebp - 0x51f]
push eax
push dword [ebp - 0x59c]
call ebx
test eax, eax
jne 0x4120ac
mov al, 0x6f
mov dword [ebp - 0x540], 0x7c705d6f
mov dword [ebp - 0x53c], 0x2f4974
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x41206e
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x53f], al
inc ecx
cmp ecx, 6
jae 0x412083
mov al, byte [ebp - 0x540]
jmp 0x41205f
lea edx, [ebp - 0x53f]
mov byte [ebp - 0x539], 0
lea ecx, [ebp - 0x56b]
call fcn.0041aea4
lea edx, [ebp - 0x408]
lea ecx, [ebp - 0x56b]
call fcn.0041aea4
xor edx, edx
mov dword [ebp - 0x598], 0x100
mov cl, 0x41
mov dword [ebp - 0x594], 0x161141
mov eax, edx
xor byte [ebp + eax - 0x593], cl
inc eax
cmp eax, 2
jae 0x4120db
mov cl, byte [ebp - 0x594]
jmp 0x4120c6
lea eax, [ebp - 0x598]
mov byte [ebp - 0x591], dl
push eax
lea eax, [ebp - 0x508]
push eax
push edx
push edx
lea eax, [ebp - 0x593]
push eax
push dword [ebp - 0x59c]
call ebx
test eax, eax
jne 0x412157
mov cl, 0x27
mov dword [ebp - 0x528], 0x1d707727
mov word [ebp - 0x524], 7
xor byte [ebp + eax - 0x527], cl
inc eax
cmp eax, 4
jae 0x41212e
mov cl, byte [ebp - 0x528]
jmp 0x412119
lea edx, [ebp - 0x527]
mov byte [ebp - 0x523], 0
lea ecx, [ebp - 0x56b]
call fcn.0041aea4
lea edx, [ebp - 0x508]
lea ecx, [ebp - 0x56b]
call fcn.0041aea4
movaps xmm0, xmmword [0x402290]
xor ecx, ecx
movups xmmword [ebp - 0x590], xmm0
mov dword [ebp - 0x570], 0x272727
movaps xmm0, xmmword [0x4022a0]
movups xmmword [ebp - 0x580], xmm0
mov al, byte [ebp - 0x590]
xor byte [ebp + ecx - 0x58f], al
inc ecx
cmp ecx, 0x22
jb 0x41217f
lea edx, [ebp - 0x58f]
mov byte [ebp - 0x56d], 0
lea ecx, [ebp - 0x56b]
call fcn.0041aea4
push dword [ebp - 0x59c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5a8]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x5a4]
mov dword [ebp - 0x5a4], 0x100
push ecx
lea ecx, [ebp - 0x108]
inc eax
push ecx
push eax
push dword [ebp - 0x5a0]
mov dword [ebp - 0x5a8], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x411e1c
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0041fa65
leave
ret