Function at 0x100637d0
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d4
mov edx, 0xd2
xor ecx, ecx
push ebx
push esi
push edi
mov al, byte [ecx + 0x100ace30]
xor al, dl
mov byte [ebp + ecx - 0x40], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x13
jb 0x100637e3
mov byte [ebp - 0x2d], 0
mov edx, 0x8e
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x100ace00]
xor al, dl
mov byte [ebp + ecx - 0x92], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x2e
jb 0x10063810
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10]
push eax
push 1
push 0
lea eax, [ebp - 0x92]
mov byte [ebp - 0x64], 0
push eax
push closesocket
mov word [ebp - 3], 0x7325
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], 0x104
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10063889
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call edi
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 0xc
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x100638c3
xor ecx, ecx
jmp 0x100638d9
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100638d0
sub ecx, esi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.100627f0
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x10063941
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.10070060
add esp, 0xc
lea ecx, [ebp - 0x35]
push 0x81e58501
call fcn.100655c0
mov esi, eax
xor edx, edx
mov eax, 0x6a
nop dword [eax]
mov cl, byte [edx + str.9_99._4._]
xor cl, al
mov byte [ebp + edx - 0x90], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x2c
jb 0x10063970
lea eax, [ebp - 0x10]
mov byte [ebp - 0x64], 0
push eax
push 1
push 0
lea eax, [ebp - 0x90]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
test eax, eax
jne 0x100639dd
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call edi
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x10063a1e
xor ecx, ecx
jmp 0x10063a30
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063a27
sub ecx, esi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.100627f0
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x10063a98
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.10070060
add esp, 0xc
lea ecx, [ebp - 0x37]
mov esi, str.PriwyIDP
sub esi, 0x6f747e8f
push esi
call fcn.10065630
mov edi, eax
xor edx, edx
mov eax, 0x25
nop dword [eax + eax]
mov cl, byte [edx + str.mgulkyiqjjfxqvytfkkZIR_n_L_a]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x10063ad0
push edi
lea edx, [ebp - 0xb0]
mov byte [ebp - 0x64], 0
mov ecx, closesocket
call fcn.10063740
add esp, 4
test eax, eax
je 0x10063c67
push esi
lea ecx, [ebp - 0x37]
call fcn.10065630
mov edi, eax
xor edx, edx
mov eax, 0x25
nop dword [eax]
mov cl, byte [edx + str.mgulkyiqjjfxqvytfkkZIR_n_L_a]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x10063b20
lea eax, [ebp - 0x10]
mov byte [ebp - 0x64], 0
push eax
push 1
push 0
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
test eax, eax
jne 0x10063b91
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x10063bd2
xor ecx, ecx
jmp 0x10063be9
lea ecx, [ebp - 0x1b8]
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063be0
sub ecx, edi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.100627f0
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x10063c51
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.10070060
add esp, 0xc
push esi
lea ecx, [ebp - 0x37]
call fcn.10065630
mov edi, eax
xor edx, edx
mov eax, 0x9b
nop dword [eax]
mov cl, byte [edx + 0x100ace90]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x10063c80
push edi
lea edx, [ebp - 0xb0]
mov byte [ebp - 0x64], 0
mov ecx, closesocket
call fcn.10063740
add esp, 4
test eax, eax
je 0x10063e17
push esi
lea ecx, [ebp - 0x37]
call fcn.10065630
mov edi, eax
xor edx, edx
mov eax, 0x9b
nop dword [eax]
mov cl, byte [edx + 0x100ace90]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x10063cd0
lea eax, [ebp - 0x10]
mov byte [ebp - 0x64], 0
push eax
push 1
push 0
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
test eax, eax
jne 0x10063d41
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x10063d82
xor ecx, ecx
jmp 0x10063d99
lea ecx, [ebp - 0x1b8]
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063d90
sub ecx, edi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.100627f0
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x10063e01
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.10070060
add esp, 0xc
push esi
lea ecx, [ebp - 0x37]
call fcn.10065630
mov edi, eax
xor edx, edx
mov eax, 0xca
nop dword [eax]
mov cl, byte [edx + 0x100acf40]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x10063e30
push edi
lea edx, [ebp - 0xb0]
mov byte [ebp - 0x64], 0
mov ecx, closesocket
call fcn.10063740
add esp, 4
test eax, eax
je 0x10063fc7
push esi
lea ecx, [ebp - 0x37]
call fcn.10065630
mov esi, eax
xor edx, edx
mov eax, 0xca
nop dword [eax]
mov cl, byte [edx + 0x100acf40]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x10063e80
lea eax, [ebp - 0x10]
mov byte [ebp - 0x64], 0
push eax
push 1
push 0
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
test eax, eax
jne 0x10063ef1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x10063f32
xor ecx, ecx
jmp 0x10063f49
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063f40
sub ecx, esi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.100627f0
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x10063fb1
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.10070060
add esp, 0xc
push 0x3ecd26d4
lea ecx, [ebp - 0x37]
call fcn.100656c0
mov esi, eax
xor edx, edx
mov eax, 0x3d
nop dword [eax]
mov cl, byte [edx + str.kQS_5__e]
xor cl, al
mov byte [ebp + edx - 0x5d], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x14
jb 0x10063fe0
lea eax, [ebp - 0x10]
mov byte [ebp - 0x49], 0
push eax
push 1
push 0
lea eax, [ebp - 0x5d]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
test eax, eax
jne 0x1006404f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x10064055
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x10064096
xor ecx, ecx
jmp 0x100640a9
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100640a0
sub ecx, esi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.100627f0
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x10064111
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.10070060
add esp, 0xc
mov dword [ebp - 0x1f], 0x756c6176
mov word [ebp - 0x1b], 0x3165
mov edx, 5
mov byte [ebp - 0x19], 0
xor ecx, ecx
nop
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x5e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10064140
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x49], 0
push eax
lea edx, [ebp - 0x5e]
mov ecx, closesocket
call fcn.10063740
add esp, 4
xor ecx, ecx
mov edx, 5
test eax, eax
je 0x100642d0
mov dword [ebp - 0x1f], 0x756c6176
mov word [ebp - 0x1b], 0x3265
mov byte [ebp - 0x19], cl
nop
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x5e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10064190
mov byte [ebp - 0x49], 0
mov edx, 5
mov dword [ebp - 0x26], 0x756c6176
xor ecx, ecx
mov word [ebp - 0x22], 0x3165
mov byte [ebp - 0x20], 0
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x42], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x100641c4
lea eax, [ebp - 0x10]
mov byte [ebp - 0x2d], 0
push eax
push 1
push 0
lea eax, [ebp - 0x5e]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10064230
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x1f]
push eax
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call edi
lea eax, [ebp - 4]
mov dword [ebp - 0x2c], 0x104
push eax
push 1
push 0
lea eax, [ebp - 0x42]
push eax
push closesocket
call ebx
test eax, eax
jne 0x1006426d
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x26]
push eax
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x100642b1
xor ecx, ecx
jmp 0x1006459c
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100642c0
jmp 0x1006459a
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x5e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x100642d0
lea eax, [ebp - 0x10]
mov byte [ebp - 0x49], 0
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x5e]
push eax
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10064337
mov eax, 0x100acf90
lea ecx, [ebp - 0x33]
sub eax, 0x1ad6c44e
push eax
call fcn.10065750
push 0x20
lea ecx, [ebp - 0x2c0]
push ecx
push 1
push 0
push eax
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call edi
mov edx, 5
xor ecx, ecx
nop
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x5e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10064340
lea eax, [ebp - 0x10]
mov byte [ebp - 0x49], 0
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x5e]
push eax
push closesocket
call ebx
test eax, eax
jne 0x1006444a
mov edx, 0x80
xor ecx, ecx
mov al, byte [ecx + 0x100acfd0]
xor al, dl
mov byte [ebp + ecx - 0x38], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xb
jb 0x10064381
mov byte [ebp - 0x2d], 0
mov edx, 0x3d
xor ecx, ecx
mov al, byte [ecx + str.kQS_5__e]
xor al, dl
mov byte [ebp + ecx - 0x5d], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x14
jb 0x100643a4
lea eax, [ebp - 0x14]
mov byte [ebp - 0x49], 0
push eax
push 1
push 0
lea eax, [ebp - 0x5d]
mov word [ebp - 3], 0x7325
push eax
push closesocket
mov byte [ebp - 1], 0
mov dword [ebp - 0x2c], 0x104
call ebx
test eax, eax
jne 0x1006440b
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x14]
call edi
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1002c420
add esp, 0xc
lea ecx, [ebp - 0x33]
push 0x2a1665b7
call fcn.100657b0
push 0x20
lea ecx, [ebp - 0x84]
push ecx
push 1
push 0
push eax
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x26], 0x756c6176
mov edx, 5
mov word [ebp - 0x22], 0x3265
xor ecx, ecx
mov byte [ebp - 0x20], 0
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x5e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10064462
mov byte [ebp - 0x49], 0
mov edx, 5
mov dword [ebp - 0x33], 0x756c6176
xor ecx, ecx
mov word [ebp - 0x2f], 0x3165
mov byte [ebp - 0x2d], 0
nop word [eax + eax]
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x79], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x100644a0
lea eax, [ebp - 0x14]
mov byte [ebp - 0x64], 0
push eax
push 1
push 0
lea eax, [ebp - 0x5e]
mov dword [ebp - 0x1e], 0x25207325
push eax
push closesocket
mov word [ebp - 0x1a], 0x73
mov dword [ebp - 0x2c], 0x104
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1006450c
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x26]
push eax
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x14]
call edi
lea eax, [ebp - 4]
mov dword [ebp - 0x18], 0x104
push eax
push 1
push 0
lea eax, [ebp - 0x79]
push eax
push closesocket
call ebx
test eax, eax
jne 0x10064549
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x33]
push eax
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x1e]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x1006458a
xor ecx, ecx
jmp 0x1006459c
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10064593
sub ecx, esi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.100627f0
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x10064604
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.10070060
add esp, 0xc
xor edx, edx
nop dword [eax]
mov al, byte [ebp + edx - 0x2c0]
cmp al, 0x61
jl 0x10064638
cmp al, 0x7a
jg 0x10064638
sub al, 0x20
mov byte [ebp + edx - 0x2c0], al
lea ecx, [ebp - 0x2c0]
inc edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10064642
sub ecx, esi
cmp edx, ecx
jbe 0x10064620
mov byte [ebp - 1], al
xorps xmm0, xmm0
lea eax, [ebp - 0x2c0]
mov dword [0x101ce457], 0
push eax
lea eax, [ebp - 3]
mov word [ebp - 3], 0x7325
push eax
push 0x101ce437
movups xmmword [0x101ce437], xmm0
movups xmmword [0x101ce447], xmm0
call fcn.1002c420
add esp, 0xc
lea eax, [ebp - 0x2c0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret