Function at 0x100161f0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f32f
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x1020f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x248], eax
movq qword [ebp - 0x21c], xmm0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
lea eax, [ebp - 0x359]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x32a]
movq qword [ebp - 0x244], xmm0
push ecx
lea edx, [ebp - 0x358]
mov dword [ebp - 0x23c], 0
push edx
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x358], 0x54464f53
mov dword [ebp - 0x354], 0x45524157
mov dword [ebp - 0x350], 0x63694d5c
mov dword [ebp - 0x34c], 0x6f736f72
mov dword [ebp - 0x348], 0x535c7466
mov dword [ebp - 0x344], 0x72756365
mov dword [ebp - 0x340], 0x20797469
mov dword [ebp - 0x33c], 0x746e6543
mov dword [ebp - 0x338], 0x505c7265
mov dword [ebp - 0x334], 0x69766f72
mov dword [ebp - 0x330], 0x5c726564
mov word [ebp - 0x32c], 0x7641
call fcn.10005a30
mov eax, dword [ebp - 0x244]
xorps xmm0, xmm0
mov edi, dword [ebp - 0x240]
mov byte [ebp - 4], 1
mov dword [ebp - 0x224], 0
movups xmmword [ebp - 0x234], xmm0
cmp eax, edi
jne 0x1001634e
mov ecx, 0xf
mov byte [ebp - 0x234], 0
mov dword [ebp - 0x220], ecx
jmp 0x100163f0
sub edi, eax
mov dword [ebp - 0x220], 0xf
cmp edi, 0x7fffffff
ja 0x10016d91
mov eax, 0xf
cmp edi, eax
jbe 0x100163be
mov eax, edi
or eax, 0xf
cmp eax, 0x7fffffff
jbe 0x10016382
mov eax, SysReAllocString
jmp 0x1001638c
mov ecx, 0x16
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0x320], eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.10001ee0
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x220], eax
jmp 0x100163c4
mov ecx, dword [ebp - 0x234]
cmp eax, 0xf
lea esi, [ebp - 0x234]
push edi
push dword [ebp - 0x244]
cmova esi, ecx
push esi
call fcn.10176510
mov dword [ebp - 0x224], edi
add esp, 0xc
mov byte [esi + edi], 0
mov ecx, dword [ebp - 0x220]
cmp ecx, 0xf
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x324]
push ecx
push 0x20119
lea eax, [ebp - 0x234]
cmova eax, dword [ebp - 0x234]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001653a
push 0xb0
lea eax, [ebp - 0xc0]
push 0
push eax
call fcn.10176a90
add esp, 0xc
lea ecx, [ebp - 0xc0]
push 1
call fcn.10012f90
mov edi, dword [ebp - 0x328]
lea ecx, [ebp - 0xc0]
push edi
mov byte [ebp - 4], 3
call fcn.100186b0
lea ecx, [ebp - 0xc0]
call fcn.10013f30
mov ecx, dword [ebp - 0x220]
cmp ecx, 0xf
jbe 0x100164a4
mov edx, dword [ebp - 0x234]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001649a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016d96
push ecx
push edx
call fcn.10172723
add esp, 8
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
lea ecx, [ebp - 0x244]
call fcn.100021e0
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x10016cc3
lea ecx, [ebp - 0x21c]
push ecx
push dword [ebp - 0x218]
push eax
call fcn.1000b0e0
mov ecx, dword [ebp - 0x214]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x21c]
add esp, 0xc
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x100165d4
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016d96
jmp 0x100165d4
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x238], 0
push eax
lea eax, [ebp - 0x238]
push eax
push 0
push 0
push 0
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x100165e3
push 0xb0
lea eax, [ebp - 0xc0]
push 0
push eax
call fcn.10176a90
add esp, 0xc
lea ecx, [ebp - 0xc0]
push 1
call fcn.10012f90
push dword [ebp - 0x324]
mov byte [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x328]
lea ecx, [ebp - 0xc0]
push edi
call fcn.100186b0
lea ecx, [ebp - 0xc0]
call fcn.10013f30
lea ecx, [ebp - 0x234]
call fcn.10002190
jmp 0x100164bf
push ecx
push esi
call fcn.10172723
add esp, 8
jmp 0x10016cc3
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp dword [ebp - 0x238], edi
jbe 0x10016ae5
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x24c], 0x100
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10016a28
push 0x101b44ec
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x344]
push eax
call fcn.10012130
add esp, 0xc
mov edx, eax
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 7
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10016656
sub ecx, esi
lea eax, [ebp - 0x210]
push ecx
push eax
mov ecx, edx
call fcn.1000a0a0
mov dword [ebp - 0x258], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x268], xmm0
mov dword [ebp - 0x254], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x268], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x258], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x330]
mov byte [ebp - 4], 9
cmp ecx, 0xf
jbe 0x100166f2
mov edx, dword [ebp - 0x344]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100166e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016d96
push ecx
push edx
call fcn.10172723
add esp, 8
cmp dword [ebp - 0x254], 0xf
lea ecx, [ebp - 0x320]
push ecx
push 0x20119
lea eax, [ebp - 0x268]
mov dword [ebp - 0x334], 0
cmova eax, dword [ebp - 0x268]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x330], 0xf
mov byte [ebp - 0x344], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x100168ae
lea eax, [ebp - 0x250]
mov dword [ebp - 0x250], 0x100
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x248]
push eax
push esi
push str.displayName
push dword [ebp - 0x320]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100167c4
cmp dword [ebp - 0x248], 1
jne 0x100167c4
xorps xmm0, xmm0
mov dword [ebp - 0x364], eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x360], eax
movups xmmword [ebp - 0x374], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100167a2
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x374]
call fcn.100052b0
mov byte [ebp - 4], 0xa
jmp 0x10016810
xorps xmm0, xmm0
mov dword [ebp - 0x364], 0
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x360], 0
movups xmmword [ebp - 0x374], xmm0
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100167f0
sub ecx, edx
lea eax, [ebp - 0x210]
push ecx
push eax
lea ecx, [ebp - 0x374]
call fcn.100052b0
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x214]
je 0x1001684a
movups xmm0, xmmword [ebp - 0x374]
mov ecx, 0xf
mov byte [ebp - 0x374], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x364]
movq qword [eax + 0x10], xmm0
add dword [ebp - 0x218], 0x18
jmp 0x10016863
lea ecx, [ebp - 0x374]
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.1000efe0
mov ecx, dword [ebp - 0x360]
mov byte [ebp - 4], 9
cmp ecx, 0xf
jbe 0x1001689b
mov edx, dword [ebp - 0x374]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016891
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016d96
push ecx
push edx
call fcn.10172723
add esp, 8
push dword [ebp - 0x320]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x100169d8
push 0xb0
lea eax, [ebp - 0xc0]
push 0
push eax
call fcn.10176a90
add esp, 0xc
lea ecx, [ebp - 0xc0]
push 1
call fcn.10012f90
push str._Code:
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0xb0]
push str._subkey:
push eax
call fcn.10011e90
add esp, 8
push eax
call fcn.10011e90
add esp, 8
push eax
call fcn.10011e90
add esp, 8
mov ecx, eax
push esi
call fcn.10013bd0
push eax
call fcn.10012840
add esp, 4
lea eax, [ebp - 0x344]
lea ecx, [ebp - 0xc0]
push eax
call fcn.100186b0
mov ecx, eax
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0xd
cmp eax, dword [ebp - 0x214]
je 0x1001697c
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [eax + 0x10], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
add dword [ebp - 0x218], 0x18
jmp 0x10016989
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.1000efe0
mov ecx, dword [ebp - 0x330]
mov byte [ebp - 4], 0xc
cmp ecx, 0xf
jbe 0x100169c7
mov edx, dword [ebp - 0x344]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100169bd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016d96
push ecx
push edx
call fcn.10172723
add esp, 8
lea ecx, [ebp - 0xc0]
call fcn.10013f30
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x254]
mov byte [ebp - 4], 2
cmp ecx, 0xf
jbe 0x10016a16
mov edx, dword [ebp - 0x268]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016a0c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016d96
push ecx
push edx
call fcn.10172723
add esp, 8
inc edi
cmp edi, dword [ebp - 0x238]
jb 0x100165f7
jmp 0x10016ae5
cmp eax, 0x103
je 0x10016ae5
push 0xb0
lea eax, [ebp - 0xc0]
push 0
push eax
call fcn.10176a90
add esp, 0xc
lea ecx, [ebp - 0xc0]
push 1
call fcn.10012f90
lea eax, [ebp - 0x344]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0xc0]
call fcn.100186b0
mov ecx, eax
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 6
cmp eax, dword [ebp - 0x214]
je 0x10016abe
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [eax + 0x10], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
add dword [ebp - 0x218], 0x18
jmp 0x10016acb
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.1000efe0
lea ecx, [ebp - 0x344]
call fcn.10002190
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 2
call fcn.10013f30
push dword [ebp - 0x324]
call esi
push 0xb0
lea eax, [ebp - 0x31c]
push 0
push eax
call fcn.10176a90
add esp, 0xc
lea ecx, [ebp - 0x31c]
push 1
call fcn.10012f90
lea eax, [ebp - 0x30c]
mov byte [ebp - 4], 0xe
push str.Number_of_subkeys_processed:
push eax
call fcn.10011e90
add esp, 8
mov ecx, eax
push dword [ebp - 0x238]
call fcn.10013d80
push eax
call fcn.10012840
mov edi, dword [ebp - 0x218]
add esp, 4
mov esi, dword [ebp - 0x21c]
cmp esi, edi
je 0x10016b8e
nop
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x10016b5a
mov eax, dword [esi]
push dword [esi + 0x10]
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.100125f0
push eax
call fcn.10012840
add esi, 0x18
add esp, 0x10
cmp esi, edi
jne 0x10016b50
mov edi, dword [ebp - 0x218]
mov esi, dword [ebp - 0x21c]
cmp esi, edi
jne 0x10016ce0
mov eax, dword [ebp - 0x328]
xorps xmm0, xmm0
push 1
push 0x101b4530
mov ecx, eax
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.100052b0
lea ecx, [ebp - 0x31c]
call fcn.10013f30
mov ecx, dword [ebp - 0x220]
cmp ecx, 0xf
jbe 0x10016bfb
mov edx, dword [ebp - 0x234]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016bf1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016d96
push ecx
push edx
call fcn.10172723
add esp, 8
mov edx, dword [ebp - 0x244]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
test edx, edx
je 0x10016c50
mov ecx, dword [ebp - 0x23c]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x10016c46
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016d96
push ecx
push edx
call fcn.10172723
add esp, 8
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x10016cbd
lea ecx, [ebp - 0x21c]
push ecx
push dword [ebp - 0x218]
push eax
call fcn.1000b0e0
mov ecx, dword [ebp - 0x214]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x21c]
add esp, 0xc
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x10016cb3
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016d96
push ecx
push esi
call fcn.10172723
add esp, 8
mov edi, dword [ebp - 0x328]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10172731
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x328]
lea eax, [ebp - 0x21c]
push eax
push edi
call fcn.100144a0
add esp, 8
lea ecx, [ebp - 0x31c]
call fcn.10013f30
mov ecx, dword [ebp - 0x220]
cmp ecx, 0xf
jbe 0x10016d37
mov edx, dword [ebp - 0x234]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016d2d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016d96
push ecx
push edx
call fcn.10172723
add esp, 8
mov edx, dword [ebp - 0x244]
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xf
mov byte [ebp - 0x234], 0
test edx, edx
je 0x100164ca
mov ecx, dword [ebp - 0x23c]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x10016d82
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016d96
push ecx
push edx
call fcn.10172723
add esp, 8
jmp 0x100164ca
call fcn.10002d10
call fcn.1017a16f
int3