Function at 0x10005a50
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2e40
call fcn.10077b80
mov eax, dword [0x100b5350]
xor eax, esp
mov dword [esp + 0x2e3c], eax
mov eax, dword [ebp + 0x14]
mov dword [0x100b8a28], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [0x100b8a30], eax
mov eax, dword [ebp + 0xc]
push 0x3ff
mov dword [0x100b8a2c], eax
lea eax, [esp + 0x1a45]
push 0
push eax
mov byte [esp + 0x1a4c], 0
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0x1a40]
call fcn.10002e20
push 0x3ff
lea eax, [esp + 0x2645]
push 0
push eax
mov byte [esp + 0x264c], 0
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0x2640]
call fcn.10002e20
push 0x3ff
lea eax, [esp + 0x645]
push 0
push eax
mov byte [esp + 0x64c], 0
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0x640]
call fcn.10002e20
push 0x3ff
lea eax, [esp + 0xe45]
push 0
push eax
mov byte [esp + 0xe4c], 0
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0xe40]
call fcn.10002e20
push 0x3ff
lea eax, [esp + 0x245]
push 0
push eax
mov byte [esp + 0x24c], 0
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0x240]
call fcn.10002e20
push 0x3ff
lea eax, [esp + 0xa45]
push 0
push eax
mov byte [esp + 0xa4c], 0
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0xa40]
call fcn.10002e20
push 0x3ff
lea eax, [esp + 0x2a45]
push 0
push eax
mov byte [esp + 0x2a4c], 0
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0x2a40]
call fcn.10002e20
push 0x3ff
lea eax, [esp + 0x1245]
push 0
push eax
mov byte [esp + 0x124c], 0
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0x1240]
call fcn.10002e20
mov byte [esp + 0x1640], 0
push 0x3ff
lea eax, [esp + 0x1645]
push 0
push eax
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0x1640]
call fcn.10002e20
push 0x3ff
lea eax, [esp + 0x1e45]
push 0
push eax
mov byte [esp + 0x1e4c], 0
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0x1e40]
call fcn.10002e20
push 0x3ff
lea eax, [esp + 0x2245]
push 0
push eax
mov byte [esp + 0x224c], 0
call fcn.10073290
add esp, 0xc
lea ecx, [esp + 0x2240]
call fcn.10002e20
push str.SoftwareITA
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov dword [esp + 0x37], 0x75747261
mov word [esp + 0x3b], 0x70
mov word [esp + 0x35], 0x7473
mov dword [esp + 0x30], 0x656d6f68
mov byte [esp + 0x34], 0x2b
lea ecx, [esp + 0x30]
lea eax, [esp + 0x1a40]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10005cc0
test dl, dl
je 0x10005cbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10005cc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10005ca0
xor eax, eax
jmp 0x10005cc5
sbb eax, eax
or eax, 1
test eax, eax
sete bh
mov byte [esp + 0x1f], bh
mov word [esp + 0x3d], 0x68
mov dword [esp + 0x38], 0x72616573
mov dword [esp + 0x34], 0x5f746c75
mov dword [esp + 0x30], 0x61666564
mov byte [esp + 0x3c], 0x63
lea ecx, [esp + 0x30]
lea eax, [esp + 0x2640]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10005d20
test dl, dl
je 0x10005d1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10005d20
add eax, 2
add ecx, 2
test dl, dl
jne 0x10005d00
xor eax, eax
jmp 0x10005d25
sbb eax, eax
or eax, 1
test eax, eax
sete bl
mov byte [esp + 0x1e], bl
test bh, bh
jne 0x10005d3a
test bl, bl
je 0x100066cd
call fcn.100145a0
lea ecx, [esp + 0x108]
call fcn.100147d0
lea ecx, [esp + 0xc0]
call fcn.10014910
lea ecx, [esp + 0x108]
call fcn.10008500
test eax, eax
je 0x10005dff
lea ecx, [esp + 0x108]
call fcn.100084f0
push eax
lea ecx, [esp + 0x10]
call fcn.10008c50
push eax
mov edx, str.FF_0_S_
lea ecx, [esp + 0x24]
call fcn.100091a0
add esp, 4
lea ecx, [esp + 0xc]
call fcn.10008cc0
lea ecx, [esp + 0x20]
call fcn.10001a10
push eax
lea ecx, [esp + 0x4c]
call fcn.10008270
mov edx, eax
lea ecx, [esp + 0x60]
call fcn.10002eb0
lea ecx, [esp + 0x48]
call fcn.10008390
lea ecx, [esp + 0x60]
call fcn.100084f0
push ecx
mov ecx, esp
push eax
call fcn.10008c50
push ecx
lea eax, [esp + 0x248]
mov ecx, esp
push eax
call fcn.10008c50
call fcn.10005910
add esp, 8
lea ecx, [esp + 0x60]
call fcn.10008390
lea ecx, [esp + 0x20]
call fcn.10008cc0
lea ecx, [esp + 0xc0]
call fcn.10008500
test eax, eax
je 0x10005ea7
lea ecx, [esp + 0xc0]
call fcn.100084f0
push eax
lea ecx, [esp + 0x10]
call fcn.10008c50
push eax
mov edx, str.FF_0_H_
lea ecx, [esp + 0x24]
call fcn.100091a0
add esp, 4
lea ecx, [esp + 0xc]
call fcn.10008cc0
lea ecx, [esp + 0x20]
call fcn.10001a10
push eax
lea ecx, [esp + 0x4c]
call fcn.10008270
mov edx, eax
lea ecx, [esp + 0x60]
call fcn.10002eb0
lea ecx, [esp + 0x48]
call fcn.10008390
lea ecx, [esp + 0x60]
call fcn.100084f0
push ecx
mov ecx, esp
push eax
call fcn.10008c50
push ecx
lea eax, [esp + 0x248]
mov ecx, esp
push eax
call fcn.10008c50
call fcn.10005910
add esp, 8
lea ecx, [esp + 0x60]
call fcn.10008390
lea ecx, [esp + 0x20]
call fcn.10008cc0
lea ecx, [esp + 0xa8]
call fcn.10008240
lea ecx, [esp + 0x78]
call fcn.10008240
lea ecx, [esp + 0x120]
mov byte [esp + 0x15], 0
call fcn.10008240
sub esp, 0x18
lea eax, [esp + 0x1658]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x1270]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0xa88]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x2a0]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0xeb8]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x6d0]
mov ecx, esp
push eax
call fcn.10008270
lea eax, [esp + 0x1b0]
push eax
lea eax, [esp + 0xa9]
push eax
lea eax, [esp + 0x140]
push eax
lea eax, [esp + 0xa8]
push eax
push ecx
lea eax, [esp + 0x1ee4]
mov ecx, esp
push eax
call fcn.10008c50
mov dl, bl
mov cl, bh
call fcn.10015860
xor ebx, ebx
cmp byte [esp + 0xb9], bl
setne bl
add esp, 0xa0
mov ecx, esp
push 0x100a7604
call fcn.10008c50
push ecx
lea eax, [esp + 0x248]
mov ecx, esp
push eax
call fcn.10008c50
mov ecx, ebx
call fcn.100043f0
add esp, 8
lea ecx, [esp + 0xd8]
push 0x100a73c5
mov byte [esp + 0x19], 0
call fcn.10008270
call fcn.10007790
cmp eax, 0xf
je 0x1000650b
lea edx, [esp + 0x17]
lea ecx, [esp + 0x16]
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
call fcn.10005460
lea ecx, [esp + 0x60]
call fcn.10008240
lea ecx, [esp + 0xf0]
call fcn.10008240
lea edx, [esp + 0xf0]
lea ecx, [esp + 0x60]
call fcn.10016720
lea ecx, [esp + 0x60]
call fcn.100084f0
push eax
lea ecx, [esp + 0x10]
call fcn.10008c50
push eax
mov edx, str.IE_0_S_
lea ecx, [esp + 0x24]
call fcn.100091a0
add esp, 4
lea ecx, [esp + 0xc]
call fcn.10008cc0
lea ecx, [esp + 0x20]
call fcn.10001a10
push eax
lea ecx, [esp + 0x4c]
call fcn.10008270
mov edx, eax
lea ecx, [esp + 0x90]
call fcn.10002eb0
lea ecx, [esp + 0x48]
call fcn.10008390
lea ecx, [esp + 0x90]
call fcn.100084f0
push ecx
mov ecx, esp
push eax
call fcn.10008c50
push ecx
lea eax, [esp + 0x248]
mov ecx, esp
push eax
call fcn.10008c50
call fcn.10005910
add esp, 8
lea ecx, [esp + 0xf0]
call fcn.100084f0
push eax
lea ecx, [esp + 0x1c]
call fcn.10008c50
push eax
mov edx, str.IE_0_H_
lea ecx, [esp + 0x10]
call fcn.100091a0
add esp, 4
lea ecx, [esp + 0x20]
push eax
call fcn.10008cd0
lea ecx, [esp + 0xc]
call fcn.10008cc0
lea ecx, [esp + 0x18]
call fcn.10008cc0
lea ecx, [esp + 0x20]
call fcn.10001a10
push eax
lea ecx, [esp + 0x34]
call fcn.10008270
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.10002eb0
push eax
lea ecx, [esp + 0x94]
call fcn.10008300
lea ecx, [esp + 0x48]
call fcn.10008390
lea ecx, [esp + 0x30]
call fcn.10008390
lea ecx, [esp + 0x90]
call fcn.100084f0
push ecx
mov ecx, esp
push eax
call fcn.10008c50
push ecx
lea eax, [esp + 0x248]
mov ecx, esp
push eax
call fcn.10008c50
call fcn.10005910
call fcn.10007100
sub esp, 0x10
mov ecx, esp
push 0x100a73c5
mov byte [esp + 0x32], 0
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x1670]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x1288]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0xaa0]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x2b8]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0xed0]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x6e8]
mov ecx, esp
push eax
call fcn.10008270
mov bl, byte [esp + 0xc6]
mov bh, byte [esp + 0xc7]
lea eax, [esp + 0x180]
push eax
sub esp, 0xc
lea eax, [esp + 0xcd]
push eax
push ecx
mov dl, bl
mov cl, bh
call fcn.10016a10
add esp, 0xc0
lea ecx, [esp + 0x30]
call fcn.100094c0
lea ecx, [esp + 0x30]
call fcn.10002990
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x34]
call fcn.10009510
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x34]
call fcn.10009530
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.10009590
test al, al
je 0x10006311
lea ecx, [esp + 0x18]
call fcn.100095b0
lea ecx, [esp + 0x48]
mov esi, eax
call fcn.10008240
mov ecx, esi
call fcn.100084f0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x1670]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x1288]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0xaa0]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x2b8]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0xed0]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x6e8]
mov ecx, esp
push eax
call fcn.10008270
lea eax, [esp + 0xf0]
push eax
sub esp, 0xc
lea eax, [esp + 0xcf]
push eax
push ecx
mov dl, bl
mov cl, bh
call fcn.10016a10
add esp, 0xc0
lea ecx, [esp + 0x48]
call fcn.10008390
lea ecx, [esp + 0x18]
call fcn.100095c0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.10009590
test al, al
jne 0x10006234
push str.NLUser
lea ecx, [esp + 0x28]
call fcn.10008c50
lea ecx, [esp + 0x28]
call fcn.100094c0
lea ecx, [esp + 0x28]
call fcn.100114a0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
call fcn.10009510
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x2c]
call fcn.10009530
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.10009590
test al, al
je 0x100064bb
jmp 0x10006370
push 0x103
lea eax, [esp + 0x13d]
push 0
push eax
mov byte [esp + 0x144], 0
call fcn.10073290
add esp, 8
lea ecx, [esp + 0x1c]
call fcn.100095b0
mov ecx, eax
call fcn.100084f0
lea edx, [esp + 0x13c]
mov ecx, eax
call fcn.10011630
add esp, 4
test eax, eax
je 0x1000649c
lea ecx, [esp + 0x24]
call fcn.10001a10
lea edx, [esp + 0x138]
mov ecx, eax
call fcn.10011790
test eax, eax
je 0x1000649c
lea ecx, [esp + 0x48]
call fcn.10008240
lea ecx, [esp + 0x24]
call fcn.10001a10
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x1670]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x1288]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0xaa0]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x2b8]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0xed0]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x6e8]
mov ecx, esp
push eax
call fcn.10008270
lea eax, [esp + 0xf0]
push eax
sub esp, 0xc
lea eax, [esp + 0xcf]
push eax
push ecx
mov dl, bl
mov cl, bh
call fcn.10016a10
add esp, 0xc0
lea ecx, [esp + 0x24]
call fcn.10001a10
mov ecx, eax
call fcn.100117b0
lea ecx, [esp + 0x48]
call fcn.10008390
lea ecx, [esp + 0x18]
call fcn.100095c0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.10009590
test al, al
jne 0x10006370
lea ecx, [esp + 0x16]
call fcn.10016980
lea ecx, [esp + 0x28]
call fcn.10009500
lea ecx, [esp + 0x24]
call fcn.10008cc0
lea ecx, [esp + 0x30]
call fcn.10009500
lea ecx, [esp + 0x90]
call fcn.10008390
lea ecx, [esp + 0x20]
call fcn.10008cc0
lea ecx, [esp + 0xf0]
call fcn.10008390
lea ecx, [esp + 0x60]
call fcn.10008390
jmp 0x1000651c
push 0x100a7620
lea ecx, [esp + 0xdc]
call fcn.100083c0
xor ebx, ebx
cmp byte [esp + 0x15], bl
push ecx
mov ecx, esp
push 0x100a7624
setne bl
call fcn.10008c50
push ecx
lea eax, [esp + 0x248]
mov ecx, esp
push eax
call fcn.10008c50
mov ecx, ebx
call fcn.100043f0
sub esp, 0x10
lea eax, [esp + 0x2258]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x1670]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x1288]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x2aa0]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0xab8]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x2d0]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0xee8]
mov ecx, esp
push eax
call fcn.10008270
sub esp, 0x18
lea eax, [esp + 0x700]
mov ecx, esp
push eax
call fcn.10008270
mov dl, byte [esp + 0xde]
mov cl, byte [esp + 0xdf]
lea eax, [esp + 0x138]
push eax
call fcn.100149d0
add esp, 0xc4
lea ecx, [esp + 0x78]
call fcn.10008500
mov esi, eax
test esi, esi
je 0x1000666e
lea ecx, [esp + 0xa8]
call fcn.10008500
test eax, eax
je 0x1000666e
push 1
lea eax, [esi - 1]
push eax
lea ecx, [esp + 0x80]
call fcn.10008400
lea eax, [esp + 0xa8]
push 0x100a7628
push eax
lea ecx, [esp + 0x68]
call fcn.1000df50
add esp, 4
mov edx, eax
lea ecx, [esp + 0x4c]
call fcn.1000df10
add esp, 4
lea ecx, [esp + 0x78]
push eax
call fcn.100083d0
lea ecx, [esp + 0x48]
call fcn.10008390
lea ecx, [esp + 0x60]
call fcn.10008390
sub esp, 0x18
lea eax, [esp + 0x90]
mov ecx, esp
push eax
call fcn.100081f0
call fcn.10003050
add esp, 0x18
lea ecx, [esp + 0xd8]
call fcn.10008390
lea ecx, [esp + 0x120]
call fcn.10008390
lea ecx, [esp + 0x78]
call fcn.10008390
lea ecx, [esp + 0xa8]
call fcn.10008390
lea ecx, [esp + 0xc0]
call fcn.10008390
lea ecx, [esp + 0x108]
call fcn.10008390
mov ecx, dword [esp + 0x2e44]
pop esi
pop ebx
xor ecx, esp
call fcn.100704e7
mov esp, ebp
pop ebp
ret