Function at 0x10003c2c
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push 0xc0
mov eax, 0x1006b900
call fcn.10053b4c
lea eax, [ebp - 0xac]
xor ebx, ebx
push eax
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x3b], 0x73776f72
mov dword [ebp - 0x5c], 0x50207377
mov byte [ebp - 0x49], 0x2e
mov word [ebp - 0xa7], 0x7261
mov dword [ebp - 0x41], 0x736d2e61
mov dword [ebp - 0xab], 0x7774666f
mov dword [ebp - 0x46], 0x61206565
mov dword [ebp - 0xa4], 0x63694d5c
mov dword [ebp - 0x32], 0x796369
mov dword [ebp - 0x8a], 0x455c7265
mov word [ebp - 0x72], 0x2073
mov word [ebp - 0x4c], 0x6669
mov word [ebp - 0x8c], 0x726f
mov dword [ebp - 0x56], 0x20796369
mov word [ebp - 0x9c], 0x7466
mov word [ebp - 0x7e], 0x6365
mov byte [ebp - 0x62], 0x20
mov word [ebp - 0x3d], 0x622f
mov dword [ebp - 0x85], 0x50205050
mov dword [ebp - 0x99], 0x65746e49
mov word [ebp - 0x75], 0x2074
mov dword [ebp - 0x66], 0x666f206e
mov byte [ebp - 0x42], 0x6b
mov dword [ebp - 0x70], 0x69762061
mov word [ebp - 0x9f], 0x736f
mov dword [ebp - 0x37], 0x6f707265
mov word [ebp - 0x48], 0x5320
mov word [ebp - 0x78], 0x202d
mov byte [ebp - 0x73], 0x69
mov word [ebp - 0x52], 0x6f74
mov byte [ebp - 0xac], 0x53
mov word [ebp - 0x4f], 0x6f6d
mov dword [ebp - 0x91], 0x70784520
mov word [ebp - 0x81], 0x6f72
mov dword [ebp - 0x6c], 0x74616c6f
mov byte [ebp - 0x9d], 0x6f
mov dword [ebp - 0x95], 0x74656e72
mov byte [ebp - 0xa0], 0x72
mov word [ebp - 0x7b], 0x6465
mov byte [ebp - 0x76], 0x49
mov byte [ebp - 0x79], 0x20
mov word [ebp - 0x5e], 0x6f64
mov byte [ebp - 0x9a], 0x5c
mov word [ebp - 0x61], 0x6957
mov byte [ebp - 0x33], 0x6c
mov byte [ebp - 0xa5], 0x65
mov byte [ebp - 0x4d], 0x64
mov byte [ebp - 0x7f], 0x74
mov word [ebp - 0x58], 0x6c6f
mov byte [ebp - 0x8d], 0x6c
mov byte [ebp - 0x7c], 0x74
mov word [ebp - 0x68], 0x6f69
mov byte [ebp - 0x86], 0x55
mov byte [ebp - 0x5f], 0x6e
mov byte [ebp - 0x4a], 0x79
mov byte [ebp - 0x50], 0x20
mov dword [ebp - 0x20], 0x6f4e6f44
mov word [ebp - 0x15], 0x6e69
mov dword [ebp - 0x1a], 0x67416b73
mov byte [ebp - 0x13], bl
mov word [ebp - 0x1c], 0x4174
mov byte [ebp - 0x16], 0x61
mov dword [ebp - 0x26], 0x6d6f63
mov dword [ebp - 0x2c], 0x6f686179
mov word [ebp - 0x28], 0x2e6f
call fcn.1000608b
push str.DHP
mov edx, eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], ebx
call fcn.10006551
pop ecx
lea ecx, [ebp - 0xc4]
push ecx
push 0x20019
push ebx
push dword [eax]
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0xb0]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.10001821
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xb4]
lea ecx, [ecx - 0x10]
call fcn.10001821
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
inc bl
je 0x10003f09
lea eax, [ebp - 0xbc]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0xb4]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc4]
mov dword [ebp - 0xb4], 7
mov dword [ebp - 0xbc], ebx
call edi
test eax, eax
jne 0x10003efb
cmp dword [ebp - 0xbc], ebx
jbe 0x10003efb
push dword [ebp - 0xbc]
call fcn.1004b5a0
pop ecx
mov esi, eax
lea eax, [ebp - 0xbc]
push eax
push esi
lea eax, [ebp - 0xb4]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc4]
call edi
test eax, eax
jne 0x10003ef4
push dword [ebp - 0xbc]
mov edx, esi
lea ecx, [ebp - 0xb0]
call fcn.10003bfc
pop ecx
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xb0]
call fcn.100063b8
mov ecx, dword [ebp - 0xb0]
lea ecx, [ecx - 0x10]
call fcn.10001821
push esi
call fcn.1004d54b
pop ecx
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10003f0b
xor ebx, ebx
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0xb4]
call fcn.1000608b
push str.DSP
mov edx, eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 1
call fcn.10006551
pop ecx
lea ecx, [ebp - 0xc0]
push ecx
push 0x20019
push ebx
push dword [eax]
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 0xb0]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
call fcn.10001821
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xb4]
lea ecx, [ecx - 0x10]
call fcn.10001821
inc bl
je 0x1000402c
lea eax, [ebp - 0xb8]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0xcc]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc0]
mov dword [ebp - 0xcc], 7
mov dword [ebp - 0xb8], ebx
call edi
test eax, eax
jne 0x10004020
cmp dword [ebp - 0xb8], ebx
jbe 0x10004020
push dword [ebp - 0xb8]
call fcn.1004b5a0
pop ecx
mov esi, eax
lea eax, [ebp - 0xb8]
push eax
push esi
lea eax, [ebp - 0xcc]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc0]
call edi
test eax, eax
jne 0x10004019
push dword [ebp - 0xb8]
mov edx, esi
lea ecx, [ebp - 0xc8]
call fcn.10003bfc
pop ecx
push ebx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100063b8
mov ecx, dword [ebp - 0xc8]
lea ecx, [ecx - 0x10]
call fcn.10001821
push esi
call fcn.1004d54b
pop ecx
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.10053b0a
ret