Function at 0x4111e5
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x120
lea ebp, [esp - 4]
mov eax, dword [0x474ea0]
xor eax, ebp
mov dword [ebp + 0x120], eax
push 0x4c
mov eax, 0x453359
call fcn.0043874e
mov esi, dword [ebp + 0x12c]
mov dword [ebp - 0x18], ecx
call fcn.00423024
push eax
lea ecx, [ebp - 0x24]
call fcn.00421c70
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00423024
push eax
lea ecx, [ebp - 0x1c]
call fcn.00421c70
lea eax, [ebp - 0x20]
mov edi, 0x400
push eax
push edi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
mov byte [ebp + 0x100], 0x40
mov byte [ebp + 0x101], 0x60
mov byte [ebp + 0x102], 0x8f
mov byte [ebp + 0x103], 0xc6
mov byte [ebp + 0x104], 0xea
mov byte [ebp + 0x105], 0x8a
mov byte [ebp + 0x106], 0x21
mov byte [ebp + 0x107], 0x47
mov byte [ebp + 0x108], 0x12
mov byte [ebp + 0x109], 0xa4
mov byte [ebp + 0x10a], 0x97
mov byte [ebp + 0x10b], 0x7a
mov byte [ebp + 0x10c], 0x61
mov byte [ebp + 0x10d], 0xac
mov byte [ebp + 0x10e], 0xc
mov byte [ebp + 0x10f], 0xa1
mov byte [ebp + 0x110], 0x61
mov byte [ebp + 0x111], 0xd4
mov byte [ebp + 0x112], 0x3e
mov byte [ebp + 0x113], 0x49
mov byte [ebp + 0x114], 0xe0
mov byte [ebp + 0x115], 0x9b
mov byte [ebp + 0x116], 4
mov byte [ebp + 0x117], 0x57
mov byte [ebp + 0x118], 0xa6
mov byte [ebp + 0x119], 0x99
mov byte [ebp + 0x11a], 0xb5
mov byte [ebp + 0x11b], 0xd8
mov byte [ebp + 0x11c], 9
mov byte [ebp + 0x11d], 0x56
mov byte [ebp + 0x11e], 0xac
mov byte [ebp + 0x11f], 5
mov dword [ebp - 0x20], edi
call fcn.00409312
push eax
push 0x20
lea eax, [ebp + 0x100]
push eax
push str.a12dc3cr32
call fcn.0040d5ac
add esp, 0x14
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
call fcn.004091a3
push ebx
lea eax, [ebp - 0x28]
push eax
push 1
push dword [ebp - 0x1c]
push reloc.WSOCK32.dll_bind
call fcn.004095df
add esp, 0x14
test eax, eax
jne 0x41140e
push 8
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.004376f0
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0xff
lea eax, [ebp]
push eax
add ecx, 0xcab0
call fcn.00417b9c
lea eax, [ebp - 0x20]
push eax
push 0x20019
push ebx
lea eax, [ebp]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0xff
mov dword [ebp - 0x18], eax
lea eax, [ebp]
push ebx
push eax
call fcn.004376f0
add esp, 0xc
cmp dword [ebp - 0x18], ebx
jne 0x411405
push 0x401
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x18], edi
call fcn.00409312
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.sizeinfo
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x24]
call fcn.004091a3
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x24]
push 0x459974
push edi
lea ecx, [ebp - 0x50]
call fcn.0041aa00
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.0041a690
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x411545
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x50]
call fcn.0041a760
push dword [eax]
call fcn.00438ca6
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov dword [esi + 4], eax
call fcn.00409012
cmp dword [ebp - 0x14], ebx
je 0x411545
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x50]
call fcn.0041a760
push dword [eax]
call fcn.00438ca6
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov dword [esi], eax
call fcn.00409012
cmp dword [ebp - 0x14], ebx
je 0x411545
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x50]
call fcn.0041a760
push dword [eax]
call fcn.00438ca6
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov dword [esi + 0xc], eax
call fcn.00409012
cmp dword [ebp - 0x14], ebx
je 0x411545
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x50]
call fcn.0041a760
push dword [eax]
call fcn.00438ca6
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov dword [esi + 8], eax
call fcn.00409012
cmp dword [ebp - 0x14], ebx
je 0x411545
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x50]
call fcn.0041a760
push dword [eax]
call fcn.00438ca6
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00409012
cmp dword [ebp - 0x14], ebx
je 0x411545
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x50]
call fcn.0041a760
push dword [eax]
call fcn.00438ca6
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00409012
xor eax, eax
cmp esi, ebx
setg al
mov esi, eax
jmp 0x411548
or esi, 0xffffffff
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.0041a6a0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00409012
lea ecx, [edi - 0x10]
call fcn.00409012
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.004377fb
add ebp, 0x124
leave
ret 4