Function at 0x100024b5
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x1007b430]
xor eax, ebp
mov dword [ebp + 0x194], eax
push ebx
push esi
push edi
mov esi, 0x103
push esi
xor ebx, ebx
lea eax, [ebp + 0x91]
push ebx
push eax
call fcn.1004db40
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x20119
push ebx
lea eax, [ebp + 0x90]
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x78], ebx
mov byte [ebp + 0x9a], 0x69
mov byte [ebp + 0xb6], 0x65
mov byte [ebp + 0x98], 0x5c
mov byte [ebp + 0xb1], 0x72
mov byte [ebp + 0xb4], 0x74
mov byte [ebp + 0xbb], 0x6e
mov byte [ebp + 0xba], 0x6f
mov byte [ebp + 0xa8], 0x77
mov byte [ebp + 0xa0], 0x66
mov byte [ebp + 0x9b], 0x63
mov byte [ebp + 0x9d], 0x6f
mov byte [ebp + 0xb2], 0x65
mov byte [ebp + 0x90], 0x53
mov byte [ebp + 0xa1], 0x74
mov byte [ebp + 0x93], 0x54
mov byte [ebp + 0xac], 0x54
mov byte [ebp + 0x92], 0x46
mov byte [ebp + 0x91], 0x4f
mov byte [ebp + 0xb7], 0x72
mov byte [ebp + 0x9e], 0x73
mov byte [ebp + 0x9f], 0x6f
mov byte [ebp + 0xaa], 0x20
mov byte [ebp + 0xae], 0x43
mov byte [ebp + 0xb3], 0x6e
mov byte [ebp + 0xad], 0x5c
mov byte [ebp + 0xa5], 0x6e
mov byte [ebp + 0x97], 0x45
mov byte [ebp + 0xaf], 0x75
mov byte [ebp + 0xa4], 0x69
mov byte [ebp + 0xa3], 0x57
mov byte [ebp + 0xb9], 0x69
mov byte [ebp + 0xab], 0x4e
mov byte [ebp + 0x95], 0x41
mov byte [ebp + 0xa7], 0x6f
mov byte [ebp + 0x9c], 0x72
mov byte [ebp + 0xb0], 0x72
mov byte [ebp + 0xa6], 0x64
mov byte [ebp + 0xa9], 0x73
mov byte [ebp + 0x99], 0x4d
mov byte [ebp + 0x94], 0x57
mov byte [ebp + 0x96], 0x52
mov byte [ebp + 0xb5], 0x56
mov byte [ebp + 0xb8], 0x73
mov byte [ebp + 0xa2], 0x5c
mov byte [ebp + 0xbd], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edi, [esi + 1]
test eax, eax
jne 0x1000279e
mov ecx, edi
lea eax, [ebp + 0x90]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10002657
push esi
lea eax, [ebp - 0x73]
push ebx
push eax
mov byte [ebp - 0x74], bl
call fcn.1004db40
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
lea eax, [ebp + 0x90]
push eax
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
mov byte [ebp + 0x9a], 0x65
mov byte [ebp + 0x97], 0x4e
mov byte [ebp + 0x93], 0x64
mov byte [ebp + 0x91], 0x72
mov byte [ebp + 0x96], 0x74
mov byte [ebp + 0x94], 0x75
mov byte [ebp + 0x90], 0x50
mov byte [ebp + 0x98], 0x61
mov byte [ebp + 0x95], 0x63
mov byte [ebp + 0x92], 0x6f
mov byte [ebp + 0x99], 0x6d
mov byte [ebp + 0x9c], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002787
mov ecx, edi
lea eax, [ebp + 0x90]
mov byte [eax], bl
inc eax
dec ecx
jne 0x100026ee
xor esi, esi
lea eax, [ebp + esi - 0x74]
mov cl, byte [eax]
mov dl, cl
sub dl, 0x41
cmp dl, 0x19
ja 0x10002709
add cl, 0x20
inc esi
cmp esi, edi
mov byte [eax], cl
jl 0x100026f6
lea eax, [ebp + 0x90]
push eax
lea eax, [ebp - 0x74]
push eax
mov byte [ebp + 0x91], 0x6e
mov byte [ebp + 0x99], 0x65
mov byte [ebp + 0x96], 0x72
mov byte [ebp + 0x93], 0x65
mov byte [ebp + 0x94], 0x72
mov byte [ebp + 0x90], 0x65
mov byte [ebp + 0x98], 0x73
mov byte [ebp + 0x97], 0x69
mov byte [ebp + 0x92], 0x74
mov byte [ebp + 0x95], 0x70
mov byte [ebp + 0x9b], bl
call fcn.1004dd20
pop ecx
pop ecx
test eax, eax
je 0x10002779
mov dword [ebp - 0x78], 8
mov ecx, edi
lea eax, [ebp + 0x90]
mov byte [eax], bl
inc eax
dec ecx
jne 0x10002781
mov ecx, edi
lea eax, [ebp + 0x90]
mov byte [eax], bl
inc eax
dec ecx
jne 0x1000278f
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x90]
mov byte [eax], bl
inc eax
dec edi
jne 0x100027a4
mov ecx, dword [ebp + 0x194]
mov eax, dword [ebp - 0x78]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004b8fc
add ebp, 0x198
leave
ret