Function at 0x406550
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51bb9b
mov eax, dword fs:[0]
push eax
sub esp, 0x858
mov eax, dword [0x562494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x802
mov dword [ebp - 0x860], eax
lea eax, [ebp - 0x814]
push 0
push eax
call fcn.004dcf80
add esp, 0xc
mov dword [ebp - 0x81c], 1
xor eax, eax
mov dword [ebp - 0x818], 0x400
mov dword [ebp - 0x838], 0x650053
mov dword [ebp - 0x834], 0x750074
mov dword [ebp - 0x830], 0x200070
mov dword [ebp - 0x82c], 0x610050
mov dword [ebp - 0x828], 0x680074
mov word [ebp - 0x824], ax
call fcn.00409bb0
mov ecx, eax
test ecx, ecx
je 0x406821
mov eax, dword [ecx]
push 2
push 0xa
call dword [eax]
test eax, eax
je 0x40682b
cmp dword [eax + 8], 0xa
lea edi, [eax + 0x10]
mov dword [ebp - 0x864], edi
jl 0x406817
xor eax, eax
mov dword [edi - 0xc], 0xa
mov word [edi + 0x14], ax
mov edx, 0x14
lea eax, [ebp - 0x838]
mov ecx, edi
push 0x14
push eax
call fcn.0040a070
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x85c], 0x4f0053
mov dword [ebp - 0x858], 0x540046
mov dword [ebp - 0x854], 0x410057
mov dword [ebp - 0x850], 0x450052
mov dword [ebp - 0x84c], 0x41005c
mov dword [ebp - 0x848], 0x79006e
mov dword [ebp - 0x844], 0x680074
mov dword [ebp - 0x840], 0x6e0069
mov dword [ebp - 0x83c], 0x67
call fcn.00409bb0
mov ecx, eax
test ecx, ecx
je 0x406830
mov eax, dword [ecx]
push 2
push 0x11
call dword [eax]
test eax, eax
je 0x40683a
cmp dword [eax + 8], 0x11
lea esi, [eax + 0x10]
jl 0x406817
xor eax, eax
mov dword [esi - 0xc], 0x11
mov word [esi + 0x22], ax
mov edx, 0x22
lea eax, [ebp - 0x85c]
mov ecx, esi
push 0x22
push eax
call fcn.0040a070
add esp, 8
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x81c]
push eax
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
sete byte [ebp - 0x81d]
or ebx, 0xffffffff
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x406763
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x40683f
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x40683f
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi - 0x10]
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4067a8
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x406846
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x406846
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp byte [ebp - 0x81d], 0
je 0x406813
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406813
lea edx, [ebp - 0x814]
lea esi, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4067d0
mov ecx, dword [ebp - 0x860]
lea eax, [ebp - 0x814]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.00408a10
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004affa8
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x4067f7
push 0x80070057
call fcn.0040a130
push 0x80004005
call fcn.0040a130
call fcn.00409240
push 0x80004005
call fcn.0040a130
call fcn.00409240
call edx
jmp 0x406763
mov ecx, edx
call esi
jmp 0x4067a8