Function at 0x40c788
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push 0x100
mov eax, 0x4a9fd5
call fcn.00490b44
mov eax, dword [ebp + 8]
and dword [ebp - 0xd8], 0
mov dword [ebp - 0xf4], eax
test eax, eax
je 0x40cb8d
push 0x7e
pop esi
xor eax, eax
push esi
push eax
mov word [ebp - 0xb0], ax
lea eax, [ebp - 0xae]
push eax
call fcn.0048e0e0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xfc]
push eax
push str.usruid
push str.SoftwareJHotNews
push 0x80000001
mov dword [ebp - 0xfc], 1
mov dword [ebp - 0x108], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ebx, 0x4c2d64
test eax, eax
jne 0x40c8c8
lea eax, [ebp - 0xb0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40c81c
sub eax, edx
sar eax, 1
cmp eax, 0x28
jne 0x40c8c8
push 0x40
lea esi, [ebp - 0xb0]
call fcn.00407608
mov dword [ebp - 0xd4], eax
pop ecx
xor eax, eax
xor byte [ebp + eax - 0xd4], 0x6b
inc eax
cmp eax, 4
jb 0x40c849
push 7
xor eax, eax
pop ecx
push dword [ebp - 0xd4]
mov word [ebp - 0x30], ax
lea edi, [ebp - 0x2e]
rep stosd dword es:[edi], eax
push str._08X
stosw word es:[edi], ax
lea eax, [ebp - 0x30]
push 0xf
push eax
call fcn.00488ec0
add esp, 0x10
lea ecx, [ebp - 0x70]
lea eax, [ebp - 0x30]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c8ac
test dx, dx
je 0x40c8a8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c8ac
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c886
xor eax, eax
jmp 0x40c8b1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40c8c8
mov word [ebp - 0x70], ax
mov dword [ebp - 0xd8], 1
jmp 0x40cb6d
and dword [ebp - 0x20], 0
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x40cb85
push 0x80
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.0048e0e0
add esp, 0xc
push 0x40
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.00404b9b
and dword [ebp - 4], 0
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0xd4]
push eax
push 0xc
pop eax
push 0x19
pop ecx
call fcn.00404d62
mov esi, eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xd4]
push eax
push 4
pop eax
push 0x14
pop ecx
mov byte [ebp - 4], 1
call fcn.00404d62
mov edi, eax
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xd4]
push eax
push 4
pop eax
push 0xf
pop ecx
mov byte [ebp - 4], 2
call fcn.00404d62
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xd4]
push eax
push 4
pop eax
push 0xa
pop ecx
mov byte [ebp - 4], 3
call fcn.00404d62
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xd4]
push eax
push 8
xor ecx, ecx
pop eax
inc ecx
mov byte [ebp - 4], 4
call fcn.00404d62
mov byte [ebp - 4], 5
push dword [ebp - 0xd8]
lea ecx, [ebp - 0xe0]
push ecx
mov ecx, eax
call fcn.00409505
push dword [ebp - 0x104]
lea ecx, [ebp - 0xe8]
push ecx
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.00409505
lea ecx, [ebp - 0x10c]
push edi
push ecx
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.00409505
lea ecx, [ebp - 0xdc]
push esi
push ecx
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.00409505
mov eax, dword [ebp - 0x10c]
add esp, 0x20
add eax, 0xfffffff0
call fcn.00404bfa
mov eax, dword [ebp - 0xe8]
add eax, 0xfffffff0
call fcn.00404bfa
mov eax, dword [ebp - 0xe0]
add eax, 0xfffffff0
call fcn.00404bfa
mov eax, dword [ebp - 0xf0]
add eax, 0xfffffff0
call fcn.00404bfa
mov eax, dword [ebp - 0x100]
add eax, 0xfffffff0
call fcn.00404bfa
mov eax, dword [ebp - 0xf8]
add eax, 0xfffffff0
call fcn.00404bfa
mov eax, dword [ebp - 0xe4]
add eax, 0xfffffff0
call fcn.00404bfa
mov eax, dword [ebp - 0xec]
add eax, 0xfffffff0
call fcn.00404bfa
push dword [ebp - 0xdc]
lea eax, [ebp - 0xb0]
push ebx
push 0x3f
push eax
call fcn.00488ec0
push 0x40
lea esi, [ebp - 0xb0]
call fcn.00407608
add esp, 0x14
mov dword [ebp - 0xd8], eax
xor eax, eax
xor byte [ebp + eax - 0xd8], 0x6b
inc eax
cmp eax, 4
jb 0x40cab8
push 7
xor eax, eax
pop ecx
push dword [ebp - 0xd8]
mov word [ebp - 0xd0], ax
lea edi, [ebp - 0xce]
rep stosd dword es:[edi], eax
push str._08X
stosw word es:[edi], ax
lea eax, [ebp - 0xd0]
push 0xf
push eax
call fcn.00488ec0
lea eax, [ebp - 0xd0]
push eax
push ebx
lea eax, [ebp - 0x70]
push 0x1f
push eax
call fcn.00488ec0
lea eax, [ebp - 0xb0]
add esp, 0x20
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x40cb14
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0xb0]
push eax
xor esi, esi
inc esi
push esi
push str.usruid
push str.SoftwareJHotNews
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
mov word [ebp - 0x70], ax
mov eax, dword [ebp - 0xdc]
add eax, 0xfffffff0
mov dword [ebp - 0xd8], esi
call fcn.00404bfa
mov eax, dword [ebp - 0xd4]
add eax, 0xfffffff0
call fcn.00404bfa
lea eax, [ebp - 0xb0]
push eax
push ebx
push 0x40
push dword [ebp - 0xf4]
call fcn.00488ec0
add esp, 0x10
mov eax, dword [ebp - 0xd8]
jmp 0x40cb8f
xor eax, eax
call fcn.00490bc7
ret