Function at 0x40d9b0
Capabilities:
Delete registry key
Delete registry value
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov ecx, dword [0x42bc0c]
sub esp, 0x44
mov edx, dword [ecx*4 + 0x42b9c0]
push ebx
test edx, edx
push esi
je 0x40ddc2
mov esi, dword [ecx*4 + 0x42b900]
xor eax, eax
test esi, esi
jbe 0x40d9f4
mov bl, byte [eax + edx]
mov cl, al
add cl, 0x41
xor bl, cl
mov byte [eax + edx], bl
mov ecx, dword [0x42bc0c]
inc eax
cmp eax, dword [ecx*4 + 0x42b900]
jb 0x40d9d7
xor eax, eax
mov ax, word [edx]
add edx, 2
test eax, eax
jbe 0x40ddc2
push ebp
push edi
mov dword [esp + 0x30], eax
jmp 0x40da10
mov edx, dword [esp + 0x34]
mov esi, dword [edx]
mov al, byte [edx + 4]
add edx, 4
mov byte [esp + 0x13], al
inc edx
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, edx
lea edx, [edx + ecx + 1]
or ecx, 0xffffffff
mov edi, edx
mov ebx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [edx + ecx + 1]
or ecx, 0xffffffff
mov edi, edx
mov dword [esp + 0x38], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, 0x14
lea ecx, [edx + ecx + 1]
mov dword [esp + 0x34], ecx
jb 0x40da66
mov edx, dword [0x426048]
mov dword [esp + 0x1c], edx
jmp 0x40da71
mov eax, dword [esi*4 + 0x426044]
mov dword [esp + 0x1c], eax
push 0xffdc
push ebp
push 0
call fcn.0040d680
mov edi, eax
lea esi, [edi + 1]
push esi
call fcn.0041af50
push esi
push ebp
push eax
mov dword [esp + 0x34], eax
call fcn.0040d680
push 0xffdc
push ebx
push 0
call fcn.0040d680
lea esi, [eax + 1]
push esi
call fcn.0041af50
push esi
push ebx
push eax
mov dword [esp + 0x58], eax
call fcn.0040d680
mov ebp, dword [esp + 0x54]
add esp, 0x38
xor esi, esi
cmp ebp, 0x80000002
mov dword [esp + 0x28], esi
jne 0x40db23
cmp edi, 0xa
jb 0x40db23
mov edi, dword [esp + 0x18]
push 0xa
push str.Software64
push edi
call fcn.0041b5a0
add esp, 0xc
test eax, eax
jne 0x40db27
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
add ecx, 0xfffffff6
push ecx
lea ecx, [eax + 0xa]
add eax, 8
push ecx
push eax
call fcn.0041b6e0
mov eax, dword [0x42bbac]
mov edi, dword [esp + 0x24]
add esp, 0xc
test eax, eax
je 0x40db27
mov dword [esp + 0x28], 0x100
mov esi, dword [esp + 0x28]
jmp 0x40db27
mov edi, dword [esp + 0x18]
mov bl, byte [esp + 0x13]
test bl, 4
je 0x40dba0
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x40db77
cmp byte [ebx], 0
je 0x40db77
lea edx, [esp + 0x14]
or esi, 0xf003f
push edx
push esi
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ddb1
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ddb1
mov eax, dword [0x42bbac]
test eax, eax
je 0x40db93
shr esi, 8
and esi, 1
push esi
push edi
push ebp
call fcn.0040ddd0
jmp 0x40ddae
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40ddb1
test bl, 1
je 0x40dc32
lea edx, [esp + 0x14]
or esi, 0x20019
push edx
push esi
push 0
push edi
push ebp
mov dword [esp + 0x50], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40dc19
test bl, 2
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 0x14
je 0x40dbed
mov eax, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, 2
je 0x40dc26
mov eax, dword [esp + 0x3c]
test eax, eax
jmp 0x40dc2c
mov al, byte [esp + 0x3c]
test al, al
jne 0x40ddb1
mov edi, dword [esp + 0x38]
push 0xffdc
push edi
push 0
call fcn.0040d680
mov esi, eax
add esp, 0xc
lea eax, [esi + esi + 1]
cmp eax, 4
ja 0x40dc56
mov eax, 4
push eax
call fcn.0041af50
mov ebp, eax
lea eax, [esi + 1]
push eax
push edi
push ebp
call fcn.0040d680
add esp, 0x10
mov edi, 1
test bl, 2
je 0x40dc8e
push ebp
call fcn.0041b64d
mov esi, 4
add esp, 4
mov dword [ebp], eax
mov edi, esi
jmp 0x40dd45
push 5
push str.:hex:
push ebp
call fcn.0041b5a0
add esp, 0xc
test eax, eax
jne 0x40dd45
mov al, byte [ebp + 5]
lea esi, [ebp + 5]
mov ecx, ebp
test al, al
mov dword [esp + 0x24], ecx
je 0x40dd3c
movsx ecx, al
push ecx
xor bl, bl
call fcn.0041b4ce
add esp, 4
inc esi
cmp al, 0x30
jl 0x40dcd5
cmp al, 0x39
jg 0x40dcd5
sub al, 0x30
jmp 0x40dcdf
cmp al, 0x41
jl 0x40dce1
cmp al, 0x46
jg 0x40dce1
sub al, 0x37
mov bl, al
mov al, byte [esi]
test al, al
je 0x40dd1a
cmp al, 0x2c
je 0x40dd1a
movsx edx, al
push edx
call fcn.0041b4ce
add esp, 4
inc esi
cmp al, 0x30
jl 0x40dd0a
cmp al, 0x39
jg 0x40dd0a
sub bl, 3
shl bl, 4
add bl, al
jmp 0x40dd1a
cmp al, 0x41
jl 0x40dd1a
cmp al, 0x46
jg 0x40dd1a
shl bl, 4
add bl, al
sub bl, 0x37
mov eax, dword [esp + 0x24]
mov byte [eax], bl
inc eax
mov dword [esp + 0x24], eax
mov al, byte [esi]
cmp al, 0x20
je 0x40dd2f
cmp al, 0x2c
jne 0x40dd32
inc esi
jmp 0x40dd25
mov al, byte [esi]
test al, al
jne 0x40dcba
mov ecx, dword [esp + 0x24]
sub ecx, ebp
mov edi, 3
mov esi, ecx
lea eax, [esp + 0x14]
push 0
mov ebx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
or eax, 0xf003f
push 0
push eax
push 0
push 0
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40dd98
cmp edi, 1
jne 0x40dd78
inc esi
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push esi
push ebp
push edi
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0041b0b3
mov edx, dword [esp + 0x24]
push edx
call fcn.0041b0b3
push ebx
call fcn.0041b0b3
add esp, 0xc
mov eax, dword [esp + 0x30]
dec eax
mov dword [esp + 0x30], eax
jne 0x40da0c
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x44
ret