Function at 0x412f39
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x442008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0xdc]
call fcn.004124d7
mov eax, dword [edi + 0x10]
lea esi, [ebp - 0xdc]
and dword [ebp - 0x40], 0
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
call fcn.00403b62
test al, al
je 0x412f86
xor ebx, ebx
inc ebx
mov byte [ebp - 0xdc], bl
jmp 0x412fc3
movzx ecx, byte [0x443f39]
neg ecx
push 1
sbb ecx, ecx
pop ebx
and ecx, 0x443f40
je 0x412fc3
push ebx
push ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x10], ebx
call fcn.00406320
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push str._ConfigManager::LoadGroupPolicies__Machine_is_not_Enterprise_Managed_
push eax
call fcn.00403144
pop ecx
pop ecx
mov ecx, str.HKLMSoftwarePoliciesGoogleUpdate_
call fcn.004084d2
test al, al
jne 0x413020
movzx ecx, byte [0x443f39]
neg ecx
mov byte [ebp - 0xdc], al
sbb ecx, ecx
and ecx, 0x443f40
je 0x413480
push ebx
push ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x10], ebx
call fcn.00406320
push str.HKLMSoftwarePoliciesGoogleUpdate_
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push str._ConfigManager::LoadGroupPolicies__No_Group_Policies_found_under_key___s_
push eax
call fcn.00403144
add esp, 0xc
jmp 0x413480
and dword [ebp - 0x34], 0
lea ecx, [ebp - 0x38]
push 0x20019
push str.HKLMSoftwarePoliciesGoogleUpdate_
mov dword [ebp - 0x38], 0x43b6d8
mov dword [ebp - 0x30], 0x200
call fcn.00407feb
test eax, eax
jns 0x413059
cmp byte [ebp - 0xdc], 0
je 0x413052
int3
mov ebx, eax
jmp 0x413471
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push 0
mov byte [ebp - 0xdb], bl
mov edx, str.CloudPolicyOverridesPlatformPolicy
push eax
mov ebx, str.HKLMSoftwarePoliciesGoogleUpdate_
push 4
mov ecx, ebx
call fcn.00408034
add esp, 0xc
test eax, eax
js 0x41308d
cmp dword [ebp - 0x1c], 0
setne al
mov byte [edi + 0x20], al
lea edx, [ebp - 0xd4]
mov ecx, str.AutoUpdateCheckPeriodMinutes
call fcn.004138e1
lea edx, [ebp - 0xcc]
mov ecx, str.DownloadPreference
call fcn.004125b7
lea edx, [ebp - 0xc4]
mov ecx, str.PackageCacheSizeLimit
call fcn.004138e1
lea edx, [ebp - 0xbc]
mov ecx, str.PackageCacheLifeLimit
call fcn.004138e1
lea edx, [ebp - 0xb4]
mov ecx, str.UpdatesSuppressedStartHour
call fcn.004138e1
lea edx, [ebp - 0xac]
mov ecx, str.UpdatesSuppressedStartMin
call fcn.004138e1
lea edx, [ebp - 0xa4]
mov ecx, str.UpdatesSuppressedDurationMin
call fcn.004138e1
lea edx, [ebp - 0x9c]
mov ecx, str.ProxyMode
call fcn.004125b7
lea edx, [ebp - 0x98]
mov ecx, str.ProxyServer
call fcn.004125b7
lea edx, [ebp - 0x94]
mov ecx, str.ProxyPacUrl
call 0x564125b7
push ebp
push dword [ebp + 8]
call fcn.00413180
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4134a9
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec