Function at 0x413361
Capabilities:
Enumerate files on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a0
push ebx
xor ebx, ebx
cmp dword [0x484cf4], ebx
push esi
push edi
jne 0x413719
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x413719
cmp byte [esi], bl
je 0x413719
mov al, byte [0x480cf8]
push 0x40
mov byte [ebp - 0x154], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x153]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x104
lea eax, [ebp - 0x154]
push edi
push eax
push ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.00413274
add esp, 0xc
mov dword [ebp - 0x10], ebx
jmp 0x4133e4
mov edi, 0x104
cmp dword [0x484cf4], ebx
jne 0x413719
push 0x5c
push esi
call fcn.0043c2e0
pop ecx
test eax, eax
pop ecx
jne 0x4134b1
cmp dword [ebp - 0x10], ebx
jne 0x413418
lea eax, [ebp - 0x154]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x413497
lea eax, [ebp - 0x34]
push eax
push 0x20019
push ebx
push str.softwareGator.comGatordyn
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413497
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push str.AppPath
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x34]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x413719
lea eax, [ebp - 0x154]
push eax
call fcn.0043c6e0
cmp byte [ebp + eax - 0x155], 0x5c
pop ecx
je 0x413497
lea eax, [ebp - 0x154]
push 0x476204
push eax
call fcn.0043c3b0
pop ecx
pop ecx
lea eax, [ebp - 0x154]
push 0x5c
push eax
call fcn.0043c2a0
pop ecx
cmp eax, ebx
pop ecx
push dword [ebp + 8]
je 0x4134b2
inc eax
jmp 0x4134b8
push esi
lea eax, [ebp - 0x154]
push eax
call fcn.0043c3a0
pop ecx
lea eax, [ebp - 0x154]
pop ecx
push 0x5c
push eax
call fcn.0043c2a0
pop ecx
mov edi, eax
pop ecx
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x154]
push eax
inc edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x38], eax
je 0x4136fb
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
xor esi, esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x268]
push eax
push edi
call fcn.0043c3a0
pop ecx
lea eax, [ebp - 0x154]
pop ecx
push 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, ebx
mov dword [ebp - 0x28], eax
je 0x413632
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.00413274
push dword [ebp - 0x30]
push dword [ebp - 0x24]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.00413343
add esp, 0x1c
test eax, eax
jne 0x4135a4
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004132f0
add esp, 0x10
test eax, eax
je 0x413632
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x5a0]
jmp 0x41362a
push dword [ebp - 0x2c]
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.00413343
add esp, 0x10
cmp eax, 1
jg 0x4135f2
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004132f0
add esp, 0x10
test eax, eax
je 0x413632
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x398]
jmp 0x41362a
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004132f0
add esp, 0x10
test eax, eax
je 0x413632
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.0043c3a0
pop ecx
pop ecx
lea eax, [ebp - 0x294]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x413519
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x41367a
mov dword [0x484cf4], eax
mov eax, dword [ebp - 0x24]
mov dword [0x484e08], eax
mov eax, dword [ebp - 0x30]
mov dword [0x484e0c], eax
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x5a0]
jmp 0x4136c4
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x41369f
mov dword [0x484cf4], eax
mov eax, dword [ebp - 0x2c]
mov dword [0x484e0c], eax
mov dword [ebp - 4], ebx
mov dword [0x484e08], esi
lea eax, [ebp - 0x398]
jmp 0x4136c4
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x4136fb
mov dword [0x484cf4], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x484e08], eax
mov eax, dword [ebp - 0x14]
mov dword [0x484e0c], eax
mov dword [ebp - 0xc], ebx
lea eax, [ebp - 0x49c]
push eax
push 0x484d04
call fcn.0043c3a0
cmp dword [ebp - 8], ebx
pop ecx
pop ecx
je 0x4136df
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 4], ebx
je 0x4136ed
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0xc], ebx
je 0x4136fb
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp + 8]
push 0x5c
push esi
call fcn.0043c2e0
pop ecx
test eax, eax
pop ecx
jne 0x413719
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x4133df
xor eax, eax
cmp dword [0x484cf4], ebx
pop edi
pop esi
setne al
pop ebx
leave
ret