Function at 0x40b080
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a7c
call fcn.0043e420
mov eax, dword [0x471080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1da
lea eax, [ebp - 0x3ec]
mov dword [ebp - 0x41c], 0x4f0053
push 0
push eax
mov dword [ebp - 0x418], 0x540046
mov dword [ebp - 0x414], 0x410057
mov dword [ebp - 0x410], 0x450052
mov dword [ebp - 0x40c], 0x54005c
mov dword [ebp - 0x408], 0x6e0065
mov dword [ebp - 0x404], 0x650063
mov dword [ebp - 0x400], 0x74006e
mov dword [ebp - 0x3fc], 0x51005c
mov dword [ebp - 0x3f8], 0x500051
mov dword [ebp - 0x3f4], 0x4d0043
mov dword [ebp - 0x3f0], 0x720067
call fcn.0043fa60
push 0x1f2
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x834], 0x51005c
push 0
push eax
mov dword [ebp - 0x830], 0x500051
mov dword [ebp - 0x82c], 0x520043
mov dword [ebp - 0x828], 0x700074
mov dword [ebp - 0x824], 0x65002e
mov dword [ebp - 0x820], 0x650078
call fcn.0043fa60
mov eax, 0x65
mov dword [ebp - 0x628], 0x51005c
push 0x1f0
mov word [ebp - 0x610], ax
lea eax, [ebp - 0x60e]
push 0
push eax
mov dword [ebp - 0x624], 0x500051
mov dword [ebp - 0x620], 0x540043
mov dword [ebp - 0x61c], 0x610072
mov dword [ebp - 0x618], 0x2e0079
mov dword [ebp - 0x614], 0x780065
call fcn.0043fa60
mov eax, 0x65
mov dword [ebp - 0x210], 0x51005c
push 0x1d4
mov word [ebp - 0x1dc], ax
lea eax, [ebp - 0x1da]
push 0
push eax
mov dword [ebp - 0x20c], 0x55004d
mov dword [ebp - 0x208], 0x640070
mov dword [ebp - 0x204], 0x740061
mov dword [ebp - 0x200], 0x5c0065
mov dword [ebp - 0x1fc], 0x510051
mov dword [ebp - 0x1f8], 0x430050
mov dword [ebp - 0x1f4], 0x67004d
mov dword [ebp - 0x1f0], 0x550072
mov dword [ebp - 0x1ec], 0x640070
mov dword [ebp - 0x1e8], 0x740061
mov dword [ebp - 0x1e4], 0x2e0065
mov dword [ebp - 0x1e0], 0x780065
call fcn.0043fa60
mov eax, 0x65
mov dword [ebp - 0xa40], 0x55005c
push 0x1f4
mov word [ebp - 0xa2c], ax
lea eax, [ebp - 0xa2a]
push 0
push eax
mov dword [ebp - 0xa3c], 0x69006e
mov dword [ebp - 0xa38], 0x73006e
mov dword [ebp - 0xa34], 0x2e0074
mov dword [ebp - 0xa30], 0x780065
call fcn.0043fa60
push 0x804
lea eax, [ebp - 0x1a74]
push 0
push eax
call fcn.0043fa60
add esp, 0x48
mov dword [ebp - 0x1a7c], 0
mov dword [ebp - 0x1a78], 0
push str.IsWow64Process
push 0x463e28
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40b318
lea eax, [ebp - 0x1a78]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x1a78], 0
lea eax, [ebp - 0x1a7c]
push eax
mov ecx, 0x20219
mov eax, 0x20019
cmovne eax, ecx
push eax
push 0
lea eax, [ebp - 0x41c]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b546
mov esi, dword [ebp - 0x1a7c]
test esi, esi
je 0x40b546
push 0x20c
push eax
lea eax, [ebp - 0xc4c]
push eax
call fcn.0043fa60
add esp, 0xc
mov dword [ebp - 0x1a78], 0x20b
lea eax, [ebp - 0x1a78]
push eax
lea eax, [ebp - 0xc4c]
push eax
push 0
push 0
push str.InstallDir
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b53a
push 0xffffffffffffffff
lea eax, [ebp - 0xc4c]
push eax
lea eax, [ebp - 0x1a74]
push 0x103
push eax
call fcn.0044646d
add esp, 0x10
push dword [ebp - 0x1a7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1a74]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40b3d5
sub eax, edx
sar eax, 1
je 0x40b546
push 0x20a
lea eax, [ebp - 0xe58]
push 0
push eax
call fcn.0043fa60
push 0x20a
lea eax, [ebp - 0x1064]
push 0
push eax
call fcn.0043fa60
push 0x20a
lea eax, [ebp - 0x1270]
push 0
push eax
call fcn.0043fa60
push 0x20a
lea eax, [ebp - 0xc4c]
push 0
push eax
call fcn.0043fa60
push 0xffffffffffffffff
lea eax, [ebp - 0x1a74]
push eax
lea eax, [ebp - 0xe58]
push 0x104
push eax
call fcn.0044646d
add esp, 0x40
lea eax, [ebp - 0x1a74]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x1064]
push 0x104
push eax
call fcn.0044646d
push 0xffffffffffffffff
lea eax, [ebp - 0x1a74]
push eax
lea eax, [ebp - 0x1270]
push 0x104
push eax
call fcn.0044646d
push 0xffffffffffffffff
lea eax, [ebp - 0x1a74]
push eax
lea eax, [ebp - 0xc4c]
push 0x104
push eax
call fcn.0044646d
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x834]
add esp, 0x30
push eax
lea eax, [ebp - 0xe58]
push eax
call esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x1064]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x1270]
push eax
call esi
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0xc4c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0xe58]
push eax
call esi
test eax, eax
je 0x40b546
lea eax, [ebp - 0x1064]
push eax
call esi
test eax, eax
je 0x40b546
lea eax, [ebp - 0x1270]
push eax
call esi
test eax, eax
je 0x40b546
lea eax, [ebp - 0xc4c]
push eax
call esi
test eax, eax
je 0x40b546
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x1a7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043dbb2
mov esp, ebp
pop ebp
ret