Function at 0x41d076
Capabilities:
Encode data using xor
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4af6fb
mov eax, dword fs:[0]
push eax
mov eax, 0x1dd38
call fcn.00492330
mov eax, dword [0x505ef8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1dd20], edi
mov eax, dword [ebp + 8]
mov ecx, dword [0x507340]
mov dword [ebp - 0x1dd34], eax
mov eax, ecx
imul eax, ecx
push 0x13
cdq
pop esi
idiv esi
xor ebx, ebx
mov dword [ebp - 0x1dd00], ebx
mov dword [ebp - 0x1dcf4], ebx
cmp edx, 0xd
jne 0x41d0fa
mov edx, ebx
mov eax, dword [ebp + edx*4 - 0x290]
imul eax, eax, 0x3e
add ecx, eax
inc edx
cmp edx, 0x280
jb 0x41d0df
mov dword [0x507340], ecx
xor eax, eax
push 0x40e
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push ebx
push eax
mov dword [ebp - 0x1dcf8], ebx
mov dword [ebp - 0x1dd2c], ebx
mov dword [ebp - 0x1dd30], ebx
mov dword [ebp - 0x1dd1c], 0x208
call fcn.004913e0
add esp, 0xc
lea ecx, [ebp - 0x1dd28]
push 0x505ab0
call fcn.00408fd9
mov dword [ebp - 4], ebx
call fcn.0041d8f4
test al, al
jne 0x41d16f
mov esi, dword [0x507340]
xor ecx, ecx
inc ecx
cmp esi, ecx
jle 0x41d169
mov eax, esi
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, esi
jl 0x41d15d
mov dword [0x507340], ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1dd00]
push ecx
or eax, 0x20019
push eax
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push dword [ebp - 0x1dd34]
mov dword [ebp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x41d1cf
call fcn.0041d8f4
mov ecx, dword [0x5079c0]
test al, al
push esi
mov edx, 0x5f40c3dc
lea eax, [ebp - 0x1dd28]
cmove ecx, edx
push str.RegOpenKeyEx_main__x
push eax
mov dword [0x5079c0], ecx
call fcn.00405092
add esp, 0xc
jmp 0x41d8c8
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1dd1c]
push eax
lea eax, [ebp - 0x420]
push eax
mov byte [ebp - 0x1dce9], bl
push ebx
jmp 0x41d841
mov ecx, dword [0x507340]
mov dword [ebp - 0x1dcf0], 0x16
lea edx, [ecx + 1]
lea eax, [ecx + 2]
imul eax, edx
imul eax, ecx
mov dword [ebp - 0x1dd44], edx
cdq
idiv dword [ebp - 0x1dcf0]
cmp edx, 9
jne 0x41d2b7
mov eax, ecx
cdq
sub eax, edx
mov edx, eax
mov dword [ebp - 0x1dd08], 0xf
mov edi, dword [ebp - 0x1dd08]
sar edx, 1
mov dword [ebp - 0x1dd14], ebx
mov dword [ebp - 0x1dcf0], edx
mov eax, ebx
test edx, edx
jle 0x41d2a6
mov eax, ecx
cdq
and edx, 3
add edx, eax
mov eax, dword [ebp - 0x1dcf0]
mov dword [ebp - 0x1dd38], eax
mov eax, dword [ebp - 0x1dd14]
sar edx, 2
mov dword [ebp - 0x1dd0c], ebx
mov edi, ebx
test edx, edx
jle 0x41d290
mov eax, edi
mov dword [ebp - 0x1dd0c], edx
add dword [ebp - 0x1dd08], eax
dec eax
dec dword [ebp - 0x1dd0c]
jne 0x41d27b
mov eax, dword [ebp - 0x1dd14]
add edi, eax
dec dword [ebp - 0x1dd38]
jne 0x41d26f
mov edx, dword [ebp - 0x1dcf0]
mov edi, dword [ebp - 0x1dd08]
inc eax
mov dword [ebp - 0x1dd14], eax
cmp eax, edi
jl 0x41d246
mov edi, dword [ebp - 0x1dd20]
test esi, esi
jne 0x41d736
mov eax, dword [edi + 0x10]
cmp eax, dword [edi + 0x14]
je 0x41d32b
mov eax, dword [ebp - 0x1dd44]
imul eax, ecx
push 0xc
cdq
pop ecx
idiv ecx
push 4
pop eax
cmp edx, eax
jne 0x41d2fa
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x507340]
test eax, eax
push 7
pop eax
cmove ecx, eax
mov dword [0x507340], ecx
lea eax, [ebp - 0x420]
push eax
push dword [edi + 0x14]
push dword [edi + 0x10]
call fcn.0041cc5b
add esp, 0xc
cmp eax, dword [edi + 0x14]
jne 0x41d85d
call fcn.0041d95c
test al, al
jne 0x41d32b
call fcn.0048f9e0
mov dword [0x507340], eax
mov eax, dword [edi + 0x2c]
sub eax, dword [edi + 0x28]
mov esi, ebx
sar eax, 2
test eax, eax
je 0x41d382
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x1dd24]
call fcn.00401b1e
mov eax, dword [edi + 0x28]
push ebx
push dword [eax + esi*4]
lea ecx, [ebp - 0x1dd24]
call fcn.004095ae
mov ecx, dword [ebp - 0x1dd24]
lea ecx, [ecx - 0x10]
test eax, eax
jns 0x41d866
call fcn.00407864
mov eax, dword [edi + 0x2c]
sub eax, dword [edi + 0x28]
inc esi
sar eax, 2
cmp esi, eax
jb 0x41d33a
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x1dcfc]
call fcn.00401b1e
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x1dd3c]
mov byte [ebp - 4], 1
call fcn.00401b1e
push eax
lea eax, [ebp - 0x1dd40]
push 0x4c0b70
push eax
mov byte [ebp - 4], 2
call fcn.00409288
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0x1dcfc]
push dword [eax - 0xc]
mov byte [ebp - 4], 3
push eax
call fcn.00409334
mov ecx, dword [ebp - 0x1dd40]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x1dd3c]
mov byte [ebp - 4], 1
lea ecx, [ecx - 0x10]
call fcn.00407864
lea eax, [ebp - 0x1dcf4]
push eax
push dword [ebp + 0xc]
push ebx
push dword [ebp - 0x1dcfc]
push dword [ebp - 0x1dd34]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41d442
push eax
lea eax, [ebp - 0x1dd28]
push str.RegOpenKeyEx_sub__x
push eax
call fcn.00405092
mov ecx, dword [ebp - 0x1dcfc]
add esp, 0xc
lea ecx, [ecx - 0x10]
mov byte [ebp - 4], bl
call fcn.00407864
jmp 0x41d829
mov eax, dword [edi + 0x1c]
cmp eax, dword [edi + 0x20]
je 0x41d587
push 0x505ab0
lea ecx, [ebp - 0x1dd04]
mov dword [ebp - 0x1dcf8], 0x208
call fcn.00408fd9
push 4
pop eax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x1dcf8]
shr eax, 1
push eax
lea ecx, [ebp - 0x1dd04]
call fcn.00406eed
lea ecx, [ebp - 0x1dcf8]
push ecx
push eax
lea eax, [ebp - 0x1dd2c]
push eax
push ebx
push str.DisplayName
push dword [ebp - 0x1dcf4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41d4b4
push 0xffffffffffffffff
lea ecx, [ebp - 0x1dd04]
call fcn.00409a5b
mov esi, dword [ebp - 0x1dd04]
cmp dword [esi - 0xc], 0
je 0x41d516
lea eax, [ebp - 0x1dd04]
push eax
push dword [edi + 0x20]
push dword [edi + 0x1c]
call fcn.0041cc7f
mov ecx, dword [0x507340]
mov edi, eax
mov eax, ecx
imul eax, ecx
imul eax, ecx
add esp, 0xc
cdq
push 0x14
pop ecx
idiv ecx
push 0xe
pop eax
cmp edx, eax
jne 0x41d505
push 4
pop eax
push eax
call fcn.0048e498
pop ecx
mov ecx, eax
mov eax, dword [0x507340]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1dd20]
cmp edi, dword [eax + 0x20]
jne 0x41d86f
mov edi, eax
mov edx, dword [0x507340]
push 0xe
lea ecx, [edx + 2]
lea eax, [edx + 1]
imul eax, ecx
imul eax, edx
cdq
pop ecx
idiv ecx
push 7
pop eax
cmp edx, eax
jne 0x41d57b
mov ecx, dword [0x507340]
mov eax, ebx
mov dword [ebp - 0x1dcf0], eax
push 8
mov edx, eax
pop esi
mov eax, edx
and eax, 1
dec eax
not eax
and eax, ecx
sar edx, 1
xor edx, eax
dec esi
jne 0x41d548
mov eax, dword [ebp - 0x1dcf0]
add ecx, edx
inc eax
mov dword [ebp - 0x1dcf0], eax
cmp eax, 0x100
jl 0x41d543
mov esi, dword [ebp - 0x1dd04]
mov dword [0x507340], ecx
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.00407864
mov eax, dword [edi + 0x34]
cmp eax, dword [edi + 0x38]
je 0x41d62d
push 0x505ab0
lea ecx, [ebp - 0x1dd10]
mov dword [ebp - 0x1dcf8], 0x208
call fcn.00408fd9
mov eax, dword [ebp - 0x1dcf8]
shr eax, 1
push eax
lea ecx, [ebp - 0x1dd10]
mov byte [ebp - 4], 5
call fcn.00406eed
lea ecx, [ebp - 0x1dcf8]
push ecx
push eax
lea eax, [ebp - 0x1dd2c]
push eax
push ebx
push str.Publisher
push dword [ebp - 0x1dcf4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41d5f7
push 0xffffffffffffffff
lea ecx, [ebp - 0x1dd10]
call fcn.00409a5b
mov esi, dword [ebp - 0x1dd10]
cmp dword [esi - 0xc], 0
je 0x41d621
lea eax, [ebp - 0x1dd10]
push eax
push dword [edi + 0x38]
push dword [edi + 0x34]
call fcn.0041cc7f
add esp, 0xc
cmp eax, dword [edi + 0x38]
jne 0x41d86f
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.00407864
mov eax, dword [edi + 0x40]
cmp eax, dword [edi + 0x44]
je 0x41d6fb
push 0x505ab0
lea ecx, [ebp - 0x1dd18]
mov dword [ebp - 0x1dcf8], 0x208
call fcn.00408fd9
mov eax, dword [ebp - 0x1dcf8]
shr eax, 1
push eax
lea ecx, [ebp - 0x1dd18]
mov byte [ebp - 4], 6
call fcn.00406eed
lea ecx, [ebp - 0x1dcf8]
push ecx
push eax
lea eax, [ebp - 0x1dd2c]
push eax
push ebx
push str.InstallLocation
push dword [ebp - 0x1dcf4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41d69d
push 0xffffffffffffffff
lea ecx, [ebp - 0x1dd18]
call fcn.00409a5b
mov esi, dword [ebp - 0x1dd18]
cmp dword [esi - 0xc], 0
je 0x41d6f3
mov edx, dword [edi + 0x40]
mov eax, dword [edi + 0x44]
sub eax, edx
sar eax, 2
mov ecx, ebx
mov dword [ebp - 0x1dcf0], ebx
test eax, eax
je 0x41d6f3
push ebx
push dword [edx + ecx*4]
lea ecx, [ebp - 0x1dd18]
call fcn.004095ae
test eax, eax
jns 0x41d86f
mov edx, dword [edi + 0x40]
mov eax, dword [edi + 0x44]
mov ecx, dword [ebp - 0x1dcf0]
sub eax, edx
inc ecx
sar eax, 2
mov dword [ebp - 0x1dcf0], ecx
cmp ecx, eax
jb 0x41d6c0
lea ecx, [esi - 0x10]
call fcn.00407864
cmp dword [ebp - 0x1dcf4], 0
je 0x41d716
push dword [ebp - 0x1dcf4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1dcf4], ebx
call fcn.0041d91c
test al, al
jne 0x41d725
inc dword [0x507340]
mov ecx, dword [ebp - 0x1dcfc]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00407864
inc dword [ebp - 0x1dd30]
call fcn.0041d93e
test al, al
jne 0x41d7cb
xor eax, eax
push 0x1d8c6
mov word [ebp - 0x1dce8], ax
lea eax, [ebp - 0x1dce6]
push ebx
push eax
call fcn.004913e0
mov eax, ebx
add esp, 0xc
mov dword [ebp - 0x1dcf0], eax
mov esi, ebx
mov edx, ebx
test eax, eax
je 0x41d7a1
test edx, edx
je 0x41d7a1
lea eax, [esi + edx]
lea ecx, [esi + edx]
mov ax, word [ebp + eax*2 - 0x1ded4]
inc ax
add ax, word [ebp + ecx*2 - 0x1dcea]
mov word [ebp + ecx*2 - 0x1dce8], ax
mov eax, dword [ebp - 0x1dcf0]
inc edx
cmp edx, 0xf6
jl 0x41d773
inc eax
add esi, 0xf6
mov dword [ebp - 0x1dcf0], eax
cmp esi, 0xec64
jl 0x41d771
movsx eax, word [ebp - 0x422]
mov dword [0x507340], eax
push 0x410
lea eax, [ebp - 0x420]
push ebx
push eax
mov dword [ebp - 0x1dd1c], 0x208
call fcn.004913e0
mov ecx, dword [0x507340]
mov eax, ecx
imul eax, ecx
add esp, 0xc
cdq
push 0xa
pop esi
idiv esi
push 7
pop eax
cmp edx, eax
jne 0x41d829
mov eax, ecx
push 0x64
cdq
pop ecx
idiv ecx
xor ecx, ecx
push 4
lea eax, [edx + 0x63]
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048dbeb
push eax
call fcn.0048fbd7
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1dd1c]
push eax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x1dd30]
push dword [ebp - 0x1dd00]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, 0x103
jne 0x41d1ed
jmp 0x41d88c
mov byte [ebp - 0x1dce9], 1
jmp 0x41d88c
mov byte [ebp - 0x1dce9], 1
jmp 0x41d887
lea ecx, [esi - 0x10]
mov byte [ebp - 0x1dce9], 1
call fcn.00407864
mov ecx, dword [ebp - 0x1dcfc]
lea ecx, [ecx - 0x10]
call fcn.00407864
cmp dword [ebp - 0x1dcf4], 0
je 0x41d8a7
push dword [ebp - 0x1dcf4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1dcf4], ebx
cmp dword [ebp - 0x1dd00], 0
je 0x41d8c2
push dword [ebp - 0x1dd00]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1dd00], ebx
mov bl, byte [ebp - 0x1dce9]
mov ecx, dword [ebp - 0x1dd28]
add ecx, 0xfffffff0
call fcn.00407864
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f354
leave
ret 8