Function at 0x404720
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434d44
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x1d8
mov eax, dword [0x448050]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x13c], edi
mov dword [ebp - 0x1d4], edi
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0xf
mov byte [ebp - 0x184], 0
mov dword [ebp - 4], 1
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 0x1d0], 1
mov dl, 0x5d
mov dword [ebp - 0x1cc], 0x1e12115d
xor ecx, ecx
mov dword [ebp - 0x1c8], 0xd1c111c
mov dword [ebp - 0x1c4], 0x91c190d
mov word [ebp - 0x1c0], 0x1c
lea eax, [ebp - 0x1cb]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x4047fc
mov dl, byte [ebp - 0x1cc]
jmp 0x4047e5
lea eax, [ebp - 0x1cb]
mov byte [ebp - 0x1bf], 0
push eax
call fcn.0041d298
mov edx, eax
mov dword [ebp - 0x144], 0
mov ecx, edx
mov dword [ebp - 0x140], 0xf
add esp, 4
mov byte [ebp - 0x154], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404834
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x154]
call fcn.0040c5e0
mov byte [ebp - 4], 3
xor ecx, ecx
movaps xmm0, xmmword [0x443a80]
mov dword [ebp - 0x13c], 0xff
movups xmmword [ebp - 0x134], xmm0
mov dword [ebp - 0x124], 0x3d352c
mov al, byte [ebp - 0x134]
xor byte [ebp + ecx - 0x133], al
inc ecx
cmp ecx, 0x12
jb 0x404872
lea eax, [ebp - 0x1b8]
mov byte [ebp - 0x121], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x133]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x120]
push eax
push 0
push 2
push str.path
push 0
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea ecx, [ebp - 0x120]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4048e0
sub ecx, edx
lea eax, [ebp - 0x120]
push ecx
push eax
lea ecx, [ebp - 0x184]
call fcn.0040c5e0
push dword [ebp - 0x1b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 2
jmp 0x404985
mov byte [ebp - 4], 5
xor ecx, ecx
movaps xmm0, xmmword [0x443a10]
movups xmmword [ebp - 0x130], xmm0
nop dword [eax]
mov al, byte [ebp - 0x130]
xor byte [ebp + ecx - 0x12f], al
inc ecx
cmp ecx, 0xe
jb 0x4049a0
lea ecx, [ebp - 0x12f]
mov byte [ebp - 0x121], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4049c3
sub ecx, edx
mov eax, 0x7fffffff
mov edx, dword [ebp - 0x174]
sub eax, edx
cmp eax, ecx
jb 0x40500c
cmp dword [ebp - 0x170], 0x10
lea eax, [ebp - 0x184]
push ecx
cmovae eax, dword [ebp - 0x184]
lea ecx, [ebp - 0x12f]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x1b4]
call fcn.00410030
mov dword [ebp - 0x1d0], 3
push 0xb8
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 6
push 0
push eax
call fcn.00416150
cmp dword [ebp - 0x1a0], 0x10
lea eax, [ebp - 0x1b4]
lea ecx, [ebp - 0xe0]
cmovae eax, dword [ebp - 0x1b4]
push eax
call fcn.0040bfd0
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xe4], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x16c]
mov eax, dword [ebp - 0xe0]
mov byte [ebp - 0x13c], 0
push dword [ebp - 0x13c]
mov word [ebp - 0x1b8], 1
mov eax, dword [eax + 4]
push dword [ebp - 0x1b8]
mov byte [ebp - 0x123], 0
push 0
mov eax, dword [ebp + eax - 0xa8]
test eax, eax
mov dword [ebp - 0x15c], 0
sete byte [ebp - 0x124]
mov dword [ebp - 0x158], 0xf
push dword [ebp - 0x124]
mov byte [ebp - 0x16c], 0
push eax
call fcn.004104e0
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 8
call fcn.0040beb0
test eax, eax
jne 0x404b26
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0xe0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.004021a0
movaps xmm0, xmmword [0x443ad0]
xor ecx, ecx
movups xmmword [ebp - 0x134], xmm0
mov byte [ebp - 0x124], 0
nop dword [eax]
mov al, byte [ebp - 0x134]
xor byte [ebp + ecx - 0x133], al
inc ecx
cmp ecx, 0xf
jb 0x404b40
lea ecx, [ebp - 0x133]
mov byte [ebp - 0x124], 0
mov dword [ebp - 0x18c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x188], 0xf
mov byte [ebp - 0x19c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404b80
sub ecx, edx
lea eax, [ebp - 0x133]
push ecx
push eax
lea ecx, [ebp - 0x19c]
call fcn.0040c5e0
mov byte [ebp - 4], 9
lea eax, [ebp - 0x19c]
cmp dword [ebp - 0x188], 0x10
lea ecx, [ebp - 0x16c]
mov esi, dword [ebp - 0x18c]
cmovae eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x158], 0x10
mov edx, dword [ebp - 0x15c]
cmovae ecx, dword [ebp - 0x16c]
push esi
push eax
push 0
call fcn.0040ef30
lea edx, [esi + 1]
mov dword [ebp - 0x128], 0
add edx, eax
mov dword [ebp - 0x124], 0xf
mov eax, dword [ebp - 0x15c]
add esp, 0xc
mov byte [ebp - 0x138], 0
cmp eax, edx
jb 0x405011
sub eax, edx
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp dword [ebp - 0x158], 0x10
lea eax, [ebp - 0x16c]
cmovae eax, dword [ebp - 0x16c]
push ecx
add eax, edx
lea ecx, [ebp - 0x138]
push eax
call fcn.0040c5e0
mov dword [ebp - 0x1d0], 7
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x138]
mov ecx, 8
mov dword [ebp - 0x1dc], 0
cmp dword [ebp - 0x128], ecx
mov dword [ebp - 0x1d8], 0xf
cmovb ecx, dword [ebp - 0x128]
cmp dword [ebp - 0x124], 0x10
push ecx
cmovae eax, dword [ebp - 0x138]
lea ecx, [ebp - 0x1ec]
push eax
mov byte [ebp - 0x1ec], 0
call fcn.0040c5e0
lea eax, [ebp - 0x1ec]
mov dword [ebp - 0x1d0], 0xf
push eax
lea ecx, [ebp - 0x138]
call fcn.0040ae30
mov edx, dword [ebp - 0x1d8]
cmp edx, 0x10
jb 0x404cee
mov ecx, dword [ebp - 0x1ec]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404ce4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405016
push edx
push ecx
call fcn.004143ed
add esp, 8
lea eax, [ebp - 0x138]
cmp edi, eax
je 0x404d14
cmp dword [ebp - 0x124], 0x10
mov ecx, edi
push dword [ebp - 0x128]
cmovae eax, dword [ebp - 0x138]
push eax
call fcn.0040c5e0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x124]
cmp edx, 0x10
jb 0x404d52
mov ecx, dword [ebp - 0x138]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404d48
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405016
push edx
push ecx
call fcn.004143ed
add esp, 8
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x188]
cmp eax, 0x10
jb 0x404d92
mov edx, dword [ebp - 0x19c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x404d88
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405016
push ecx
push edx
call fcn.004143ed
add esp, 8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x158]
cmp edx, 0x10
jb 0x404dd0
mov ecx, dword [ebp - 0x16c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404dc6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405016
push edx
push ecx
call fcn.004143ed
add esp, 8
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0xf
mov byte [ebp - 0x16c], 0
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xe4], eax
lea ecx, [ebp - 0xd0]
call fcn.0040a5d0
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xe0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xe4], eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0xb
push eax
mov dword [ebp - 0x70], vtable.std::ios_base.0
call fcn.0041323a
mov edx, dword [ebp - 0x1a0]
add esp, 4
cmp edx, 0x10
jb 0x404f61
mov ecx, dword [ebp - 0x1b4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404e8f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405016
push edx
push ecx
call fcn.004143ed
add esp, 8
jmp 0x404f61
mov edx, dword [ebp - 0x140]
cmp edx, 0x10
jb 0x404f9b
mov ecx, dword [ebp - 0x154]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404f91
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40501b
push edx
push ecx
call fcn.004143ed
add esp, 8
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0xf
mov byte [ebp - 0x154], 0
cmp edx, 0x10
jb 0x404fec
mov ecx, dword [ebp - 0x184]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404fe2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40501b
push edx
push ecx
call fcn.004143ed
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00413f5b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004015e0
call fcn.0040d5c0
call fcn.0041cfb6
call fcn.0041cfb6
int3