Function at 0x40986c
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push 0x144
mov eax, 0x4527a2
call fcn.004387b7
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], esi
call fcn.00423024
push eax
lea ecx, [ebp - 0x134]
call fcn.00421c70
lea ecx, [ebp - 0x138]
mov eax, 0x400
push ecx
push eax
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], esi
mov byte [ebp - 0x30], 0x40
mov byte [ebp - 0x2f], 0x60
mov byte [ebp - 0x2e], 0x8f
mov byte [ebp - 0x2d], 0xc6
mov byte [ebp - 0x2c], 0xea
mov byte [ebp - 0x2b], 0x8a
mov byte [ebp - 0x2a], 0x21
mov byte [ebp - 0x29], 0x47
mov byte [ebp - 0x28], 0x12
mov byte [ebp - 0x27], 0xa4
mov byte [ebp - 0x26], 0x97
mov byte [ebp - 0x25], 0x7a
mov byte [ebp - 0x24], 0x61
mov byte [ebp - 0x23], 0xac
mov byte [ebp - 0x22], 0xc
mov byte [ebp - 0x21], 0xa1
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1f], 0xd4
mov byte [ebp - 0x1e], 0x3e
mov byte [ebp - 0x1d], 0x49
mov byte [ebp - 0x1c], 0xe0
mov byte [ebp - 0x1b], 0x9b
mov byte [ebp - 0x1a], 4
mov byte [ebp - 0x19], 0x57
mov byte [ebp - 0x18], 0xa6
mov byte [ebp - 0x17], 0x99
mov byte [ebp - 0x16], 0xb5
mov byte [ebp - 0x15], 0xd8
mov byte [ebp - 0x14], 9
mov byte [ebp - 0x13], 0x56
mov byte [ebp - 0x12], 0xac
mov byte [ebp - 0x11], 5
mov dword [ebp - 0x138], eax
call fcn.00409312
push eax
push 0x20
lea eax, [ebp - 0x30]
push eax
push str.a12dc3cr32
call fcn.0040d5ac
add esp, 0x14
push 0xffffffffffffffff
lea ecx, [ebp - 0x134]
call fcn.004091a3
push esi
lea eax, [ebp - 0x140]
push eax
push 1
push dword [ebp - 0x134]
mov ebx, reloc.WSOCK32.dll_bind
push ebx
mov dword [ebp - 0x13c], esi
call fcn.004095df
add esp, 0x14
test eax, eax
jne 0x409ab3
mov edi, 0xff
mov ecx, dword [ebp - 0x150]
push edi
lea eax, [ebp - 0x130]
push eax
call fcn.00417b9c
lea eax, [ebp - 0x144]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x130]
push esi
push eax
call fcn.004376f0
add esp, 0xc
cmp dword [ebp - 0x148], esi
jne 0x409a34
lea eax, [ebp - 0x138]
push eax
push 0x20019
push esi
push str.version
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x409a6a
cmp dword [ebp - 0x13c], esi
jne 0x409a95
push dword [ebp - 0x144]
mov dword [ebp - 0x13c], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x140]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409a46
cmp dword [ebp - 0x13c], esi
jne 0x409ab3
mov dword [ebp - 0x13c], 1
push 1
lea eax, [ebp - 0x140]
push eax
push 1
push dword [ebp - 0x134]
push ebx
call fcn.004095df
add esp, 0x14
test eax, eax
je 0x409990
jmp 0x409ab3
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
push eax
push esi
push esi
push 0x4605a7
push dword [ebp - 0x138]
mov dword [ebp - 0x148], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x138]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x144]
call esi
push dword [ebp - 0x140]
call esi
mov ecx, dword [ebp - 0x134]
mov esi, dword [ebp - 0x14c]
add ecx, 0xfffffff0
call fcn.00409012
mov eax, esi
call fcn.0043883a
ret