Function at 0x4024a0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x5035d0]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x4f6630]
lea eax, [ebp - 0x178]
push ebx
movups xmmword [ebp - 0x74], xmm0
mov ebx, 0xd
movaps xmm0, xmmword [0x4f6620]
push esi
movups xmmword [ebp - 0x64], xmm0
push edi
movaps xmm0, xmmword [str.Network4D36E972_E325_11CE_BFCRtlGetNtVersionNntrolSetControlSystemCurrentCo]
mov edi, ecx
movups xmmword [ebp - 0x54], xmm0
push 0x104
movaps xmm0, xmmword [0x4f6600]
movups xmmword [ebp - 0x44], xmm0
push 0
movaps xmm0, xmmword [str.1_08002BE10318]
push eax
movups xmmword [ebp - 0x34], xmm0
call fcn.004a4df0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x190]
add esp, 0xc
mov dword [ebp - 0x180], 0x104
mov dword [ebp - 0x184], 1
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x18c], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
mov dword [ebp - 0x188], 0
push eax
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x402722
push edi
push str._sConnection
push 0xffffffffffffffff
lea eax, [ebp - 0x178]
push 0x103
push eax
call fcn.00401120
add esp, 0x14
lea eax, [ebp - 0x18c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x178]
push eax
push dword [ebp - 0x190]
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40271a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x188]
mov dword [ebp - 0x184], 4
push eax
lea eax, [ebp - 0x184]
mov dword [ebp - 0x180], 4
push eax
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x6964654d
push eax
push dword [ebp - 0x18c]
mov dword [ebp - 0x10], 0x62755361
mov dword [ebp - 0xc], 0x65707954
mov byte [ebp - 8], 0
call esi
test eax, eax
jne 0x402712
push 0x104
push eax
lea eax, [ebp - 0x178]
mov dword [ebp - 0x184], 1
push eax
mov dword [ebp - 0x180], 0x103
call fcn.004a4df0
add esp, 0xc
mov dword [ebp - 0x24], 0x49706e50
lea eax, [ebp - 0x180]
mov dword [ebp - 0x20], 0x6174736e
mov dword [ebp - 0x1c], 0x4965636e
mov word [ebp - 0x18], 0x44
push eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x184]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x18c]
call esi
test eax, eax
jne 0x402712
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x17c], 0x494350
cmp eax, 1
jne 0x402703
lea ecx, [ebp - 0x17c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402695
sub ecx, edx
lea eax, [ebp - 0x17c]
push ecx
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.004b8960
add esp, 0xc
test eax, eax
jne 0x4026be
lea ebx, [eax + 0xa]
jmp 0x402712
mov eax, dword [ebp - 0x188]
cmp eax, 1
jne 0x402703
lea ecx, [ebp - 0x17c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4026d2
sub ecx, edx
lea eax, [ebp - 0x17c]
push ecx
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.004b8960
add esp, 0xc
test eax, eax
je 0x4026fd
mov ebx, 0xc
jmp 0x402712
mov eax, dword [ebp - 0x188]
xor ebx, ebx
cmp eax, 2
setne bl
lea ebx, [ebx*2 + 0xb]
push dword [ebp - 0x18c]
call edi
push dword [ebp - 0x190]
call edi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a1365
mov esp, ebp
pop ebp
ret