Function at 0x10003190
Capabilities:
Create process on windows
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
mov eax, dword [0x10032014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x128]
push esi
push edi
push 0x104
push 0
push eax
mov dword [ebp - 0x328], 0x104
call fcn.100146a0
push 0x2e
push ebx
call fcn.10013fe0
add esp, 0x14
test eax, eax
je 0x10003448
lea ecx, [ebp - 0x324]
push ecx
push 0xf003f
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003448
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x128]
push eax
push 0
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
lea eax, [ebp - 0x320]
push 0
push eax
call fcn.100146a0
movaps xmm0, xmmword [0x1002e840]
push 0x16
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0xd8d7d6d3
mov word [ebp - 8], 0xd3d6
call fcn.1001243f
mov esi, eax
lea edi, [ebp - 0x1b]
add esp, 0x10
mov eax, 1
sub edi, esi
lea edx, [esi + eax]
mov cl, 0xcc
sub cl, al
inc eax
xor cl, byte [edi + edx - 1]
mov byte [edx - 1], cl
cmp eax, 0x15
jbe 0x10003264
lea eax, [ebp - 0x128]
mov byte [esi + 0x15], 0
push eax
lea eax, [ebp - 0x320]
push esi
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
push 1
mov dword [esi + 0x10], 0
push esi
mov byte [esi + 0x14], 0
call fcn.1001246f
add esp, 0x14
lea eax, [ebp - 0x324]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x320]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003448
push 0x104
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.100146a0
add esp, 0xc
mov dword [ebp - 0x328], 0x104
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x128]
push eax
push 0
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x128]
push 0x1002e2d0
push eax
call fcn.10013aa0
add esp, 8
test eax, eax
jne 0x1000336c
lea eax, [ebp - 0x128]
push 0x1002e2d4
push eax
call fcn.10013aa0
add esp, 8
test eax, eax
jne 0x1000336c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x128]
push 0x1002e2d8
push eax
call esi
push ebx
lea eax, [ebp - 0x128]
push eax
call esi
jmp 0x10003374
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xorps xmm0, xmm0
lea ecx, [ebp - 0x18]
movlpd qword [ebp - 0x36c], xmm0
movlpd qword [ebp - 0x364], xmm0
movlpd qword [ebp - 0x35c], xmm0
movlpd qword [ebp - 0x354], xmm0
movlpd qword [ebp - 0x34c], xmm0
movlpd qword [ebp - 0x344], xmm0
movlpd qword [ebp - 0x33c], xmm0
movlpd qword [ebp - 0x334], xmm0
movaps xmm0, xmmword [0x1002e800]
movups xmmword [ebp - 0x18], xmm0
call fcn.1000bcb0
mov ecx, dword [ebp - 0x368]
mov esi, eax
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp - 0x370]
mov dword [ebp - 0x370], 0x44
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x128]
cmovne ecx, esi
push eax
push 0
mov dword [ebp - 0x368], ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
push 1
mov word [esi + 0xc], 0
push esi
mov byte [esi + 0xe], 0
call fcn.1001246f
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012425
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012425
mov esp, ebp
pop ebp
ret 8