Function at 0x413514
Capabilities:
Encode data using xor

Disassembly:
dec ebx
dec esp
or edi, 0x12
lcall 0xcc6, 0x75331904
dec edx
daa
mul dword [edi + edi*8]
out 0x61, eax
ret 0x2d9a
lodsb al, byte [esi]
mov cl, 0xfe
aad 0x80
daa
ror byte [ecx + 0x4f], cl
inc ebp
pop ebp
sar al, 0x88
fist dword [eax*8 - 0x15cae8b5]
les eax, [ebx + 0x70]
dec ebx
push edx
shr byte [eax + 0x35930df5], 1
sbb dword [0xa493db3c], 0xffffffc6
jecxz 0x4135b6
cmpsb byte [esi], byte es:[edi]
push esi
or ecx, dword [ebx - 0x4c]
sub bl, al
jg 0x4134e3
clc
and ah, byte [ecx + ecx*4]
btc dword [esi + edx - 0x3c], 0x59
pop esi
push ds
cmp dword fs:[esi], ebx
cmp dh, byte [edi]
mov gs, ebx
push es
xchg byte [ecx + 0x5d], bl
xlatb
cdq
lodsd eax, dword [esi]
mov edi, dword [edi - 2]
or eax, 0x5d54ab19
pop ebp
int1
popal
sbb ecx, dword [ebx + 0x2e]
jmp 0x413571
pop edx
inc eax
ja 0x413588
stc
aam 0x26
dec eax
or dh, dh
cmp dword [edi + 0x7b], eax
and ah, byte [ecx + 0x6d]
out 0xb5, eax
jp 0x4135aa
inc eax
cmc
test al, 0x95
xchg ebp, eax
xor al, 0xc7
xchg esp, eax
pop esp
imul dword [eax + 0x5a5864bb]
jmp 0x4135ad
cli
push 0x793a4e43
invalid
dec esi
cmp bh, byte [ecx - 0x71]
jmp dword [ebx + 0x47]
in al, dx
jne 0x413568
and eax, 0x3587ac25
xchg byte [eax + 0x31], ch
ficom dword [edi + ebx - 0x7a]
cld
aas
in al, dx
inc ebp
push ss
les edi, [ebp + 0x31]
jge 0x4135fe
in eax, dx
xchg ebx, eax
mov ch, 0xb
sbb al, 0xae
fist dword [esi + 1]
stc
pop es
mov ecx, 0xb42870ea
mov eax, dword [ebp - 0x38]
inc edx
sbb edx, edi
not dword [ebx]
pop ds
xchg edx, eax
popfd
rol dword [ebp + 0x5b], cl
xor byte [0x631563a7], 0x36
loop 0x4135cb
sbb ebx, edi
retf 0x25e1
in eax, dx
fdivp st(3)
int 0x8f
mov edx, 0x5f6634f6
mov dword [edi + 0x5a], edi
sbb ebp, edx
cwde
fiadd word [edi]
cmpsd dword [esi], dword es:[edi]
push 0x60
js 0x4135d7
mov edi, 0x4c4f59aa
retf 0x6b96

Function at 0x418c50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x4c4f44
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x418c6d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDEA92A799_267E_4DF5_A6ED_6A7E0684BB8AVersionIndependentProgID
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0x4c624c], eax
jne 0x418cea
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x4c4f44
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0x4c624c], eax
jne 0x418cd2
cmp dword [esp + 8], ebx
je 0x418cd4
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x418cea
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4c624c]
test ecx, ecx
jne 0x418d0d
test eax, eax
jle 0x418d08
and eax, 0xffff
or eax, 0x80070000
mov dword [0x4c624c], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret

Function at 0x426c7c
Capabilities:
Encode data using xor

Disassembly:
mov ch, bh
jo 0x426ce2
jmp 0x6a56d7fd
push esi
mov bh, 0x4b
invalid