Function at 0x40faf5
Capabilities:
Encode data using xor
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x5b1911
call fcn.005b0d74
sub esp, 0x498
push ebx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x168], esi
mov dword [ebp - 0x58], eax
push edi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xe2], 0xd30080
mov dword [ebp - 0xde], 0xc600cf
mov dword [ebp - 0xda], 0xd700d4
mov dword [ebp - 0xd6], 0xd200c1
mov dword [ebp - 0xd2], 0xdc00c5
mov dword [ebp - 0xce], 0xef00d7
mov dword [ebp - 0xca], 0xb600f7
mov dword [ebp - 0xc6], 0xb300b4
mov dword [ebp - 0xc2], 0xce00b2
mov dword [ebp - 0xbe], 0xe400ef
mov dword [ebp - 0xba], 0xdc00e5
mov dword [ebp - 0xb6], 0xe900cd
mov dword [ebp - 0xb2], 0xf200e3
mov dword [ebp - 0xae], 0xf300ef
mov dword [ebp - 0xaa], 0xe600ef
mov dword [ebp - 0xa6], 0xdc00f4
mov dword [ebp - 0xa2], 0xe900d7
mov dword [ebp - 0x9e], 0xe400ee
mov dword [ebp - 0x9a], 0xf700ef
mov dword [ebp - 0x96], 0xdc00f3
mov dword [ebp - 0x92], 0xf500c3
mov dword [ebp - 0x8e], 0xf200f2
mov dword [ebp - 0x8a], 0xee00e5
mov dword [ebp - 0x86], 0xd600f4
mov dword [ebp - 0x82], 0xf200e5
mov dword [ebp - 0x7e], 0xe900f3
mov dword [ebp - 0x7a], 0xee00ef
mov dword [ebp - 0x76], 0xd500dc
mov dword [ebp - 0x72], 0xe900ee
mov dword [ebp - 0x6e], 0xf300ee
mov dword [ebp - 0x6a], 0xe100f4
mov dword [ebp - 0x66], 0xec00ec
mov word [ebp - 0x62], ax
xor word [ebp + eax*2 - 0xe0], cx
inc eax
cmp eax, 0x3f
jge 0x40fc75
mov cx, word [ebp - 0xe2]
jmp 0x40fc5e
xor eax, eax
mov word [ebp - 0x62], ax
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
lea eax, [ebp - 0xe0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ff1d
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x4a4]
push ebx
push eax
call fcn.00576ac0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x4a4]
push eax
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, eax
mov dword [ebp - 0x60], edi
test edi, edi
jne 0x40ff0b
and dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x4a4]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ff0b
push 0x104
push eax
lea eax, [ebp - 0x164]
mov dword [ebp - 0x38], 1
push eax
mov dword [ebp - 0x34], 0x103
call fcn.00576ac0
push 0x104
lea eax, [ebp - 0x29c]
push edi
push eax
call fcn.00576ac0
add esp, 0x18
mov dword [ebp - 0x26], 0x70736944
xor edx, edx
mov dword [ebp - 0x22], 0x4e79616c
mov cl, dl
mov dword [ebp - 0x1e], 0x656d61
mov byte [ebp - 0x27], cl
mov eax, edx
xor byte [ebp + eax - 0x26], cl
inc eax
cmp eax, 0xb
jge 0x40fd61
mov cl, byte [ebp - 0x27]
jmp 0x40fd52
lea eax, [ebp - 0x34]
mov byte [ebp - 0x1b], dl
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x38]
push eax
push edx
lea eax, [ebp - 0x26]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ff02
lea edx, [ebp - 0x164]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40fd92
sub edx, ecx
mov dword [ebp - 0x1a], 0xc8b6a100
xor cl, cl
mov dword [ebp - 0x16], 0xbdaad1c8
mov dword [ebp - 0x12], 0xa1febaad
xor eax, eax
mov word [ebp - 0xe], 0xb7
xor byte [ebp + eax - 0x19], cl
inc eax
cmp eax, 0xc
jge 0x40fdc9
mov cl, byte [ebp - 0x1a]
jmp 0x40fdba
lea ecx, [ebp - 0x19]
mov byte [ebp - 0xd], 0
lea eax, [ecx + 1]
mov dword [ebp - 0x3c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fdd6
sub ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x19]
push ecx
push eax
push 0
lea ecx, [ebp - 0x164]
call fcn.00411487
add esp, 0xc
cmp eax, 0xffffffff
je 0x40ff02
movaps xmm0, xmmword [0x605de0]
xor edx, edx
mov dword [ebp - 0x38], 1
mov ecx, edx
mov dword [ebp - 0x34], 0x103
movups xmmword [ebp - 0x52], xmm0
mov dword [ebp - 0x42], 0x74615020
mov word [ebp - 0x3e], 0x68
mov al, byte [ebp - 0x52]
xor byte [ebp + ecx - 0x51], al
inc ecx
cmp ecx, 0x14
jl 0x40fe28
lea eax, [ebp - 0x34]
mov byte [ebp - 0x3d], dl
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x38]
push eax
push edx
lea eax, [ebp - 0x51]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ff02
and dword [ebp - 0x188], eax
lea ecx, [ebp - 0x198]
mov byte [ebp - 0x198], al
lea eax, [ebp - 0x164]
push eax
mov dword [ebp - 0x184], 0xf
call fcn.00406876
mov dword [ebp - 4], 1
lea eax, [ebp - 0x29c]
mov byte [ebp - 0x5c], 0
lea edx, [ebp - 0x3c]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x3c], eax
call fcn.004115a3
pop ecx
mov dword [ebp - 4], 2
lea eax, [ebp - 0x198]
mov edi, dword [esi + 4]
push eax
cmp dword [esi + 8], edi
je 0x40fedd
mov ecx, edi
call fcn.004066ca
lea eax, [ebp - 0x180]
lea ecx, [edi + 0x18]
push eax
call fcn.0041213f
add dword [esi + 4], 0x30
jmp 0x40fee5
push edi
mov ecx, esi
call fcn.00411352
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 0
call fcn.00412ad9
lea ecx, [ebp - 0x198]
call fcn.0040672a
mov edi, dword [ebp - 0x60]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
test edi, edi
je 0x40fcb7
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret