Function at 0x10063380
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d4
mov edx, 0xd2
xor ecx, ecx
push ebx
push esi
push edi
mov al, byte [ecx + 0x100abdd4]
xor al, dl
mov byte [ebp + ecx - 0x40], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x13
jb 0x10063393
mov byte [ebp - 0x2d], 0
mov edx, 0x8e
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x100abdf8]
xor al, dl
mov byte [ebp + ecx - 0x92], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x2e
jb 0x100633c0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x10]
push eax
push 1
push 0
lea eax, [ebp - 0x92]
mov byte [ebp - 0x64], 0
push eax
push closesocket
mov word [ebp - 3], 0x7325
mov byte [ebp - 1], 0
mov dword [ebp - 0x14], 0x104
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10063439
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call edi
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 0xc
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x10063473
xor ecx, ecx
jmp 0x10063489
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063480
sub ecx, esi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.10062370
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x100634f1
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.1006fc00
add esp, 0xc
lea ecx, [ebp - 0x35]
push 0x81e57479
call fcn.10065170
mov esi, eax
xor edx, edx
mov eax, 0x6a
nop dword [eax]
mov cl, byte [edx + str.9_99._4._]
xor cl, al
mov byte [ebp + edx - 0x90], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x2c
jb 0x10063520
lea eax, [ebp - 0x10]
mov byte [ebp - 0x64], 0
push eax
push 1
push 0
lea eax, [ebp - 0x90]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
test eax, eax
jne 0x1006358d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call edi
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x100635ce
xor ecx, ecx
jmp 0x100635e0
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100635d7
sub ecx, esi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.10062370
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x10063648
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.1006fc00
add esp, 0xc
lea ecx, [ebp - 0x37]
mov esi, str.PriwyIDP
sub esi, 0x6f747e8f
push esi
call fcn.100651e0
mov edi, eax
xor edx, edx
mov eax, 0x25
nop dword [eax + eax]
mov cl, byte [edx + str.mgulkyiqjjfxqvytfkkZIR_n_L_a]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x10063680
push edi
lea edx, [ebp - 0xb0]
mov byte [ebp - 0x64], 0
mov ecx, closesocket
call fcn.100632f0
add esp, 4
test eax, eax
je 0x10063817
push esi
lea ecx, [ebp - 0x37]
call fcn.100651e0
mov edi, eax
xor edx, edx
mov eax, 0x25
nop dword [eax]
mov cl, byte [edx + str.mgulkyiqjjfxqvytfkkZIR_n_L_a]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x100636d0
lea eax, [ebp - 0x10]
mov byte [ebp - 0x64], 0
push eax
push 1
push 0
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
test eax, eax
jne 0x10063741
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x10063782
xor ecx, ecx
jmp 0x10063799
lea ecx, [ebp - 0x1b8]
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063790
sub ecx, edi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.10062370
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x10063801
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.1006fc00
add esp, 0xc
push esi
lea ecx, [ebp - 0x37]
call fcn.100651e0
mov edi, eax
xor edx, edx
mov eax, 0x9b
nop dword [eax]
mov cl, byte [edx + 0x100abf08]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x10063830
push edi
lea edx, [ebp - 0xb0]
mov byte [ebp - 0x64], 0
mov ecx, closesocket
call fcn.100632f0
add esp, 4
test eax, eax
je 0x100639c7
push esi
lea ecx, [ebp - 0x37]
call fcn.100651e0
mov edi, eax
xor edx, edx
mov eax, 0x9b
nop dword [eax]
mov cl, byte [edx + 0x100abf08]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x10063880
lea eax, [ebp - 0x10]
mov byte [ebp - 0x64], 0
push eax
push 1
push 0
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
test eax, eax
jne 0x100638f1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x10063932
xor ecx, ecx
jmp 0x10063949
lea ecx, [ebp - 0x1b8]
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063940
sub ecx, edi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.10062370
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x100639b1
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.1006fc00
add esp, 0xc
push esi
lea ecx, [ebp - 0x37]
call fcn.100651e0
mov edi, eax
xor edx, edx
mov eax, 0xca
nop dword [eax]
mov cl, byte [edx + 0x100abeb8]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x100639e0
push edi
lea edx, [ebp - 0xb0]
mov byte [ebp - 0x64], 0
mov ecx, closesocket
call fcn.100632f0
add esp, 4
test eax, eax
je 0x10063b77
push esi
lea ecx, [ebp - 0x37]
call fcn.100651e0
mov esi, eax
xor edx, edx
mov eax, 0xca
nop dword [eax]
mov cl, byte [edx + 0x100abeb8]
xor cl, al
mov byte [ebp + edx - 0xb0], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x4c
jb 0x10063a30
lea eax, [ebp - 0x10]
mov byte [ebp - 0x64], 0
push eax
push 1
push 0
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
test eax, eax
jne 0x10063aa1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x10063ae2
xor ecx, ecx
jmp 0x10063af9
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063af0
sub ecx, esi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.10062370
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x10063b61
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.1006fc00
add esp, 0xc
push 0x3ecd1714
lea ecx, [ebp - 0x37]
call fcn.10065270
mov esi, eax
xor edx, edx
mov eax, 0x3d
nop dword [eax]
mov cl, byte [edx + str.kQS_5__e]
xor cl, al
mov byte [ebp + edx - 0x5d], cl
inc edx
lea ecx, [eax + 1]
movzx eax, cl
cmp edx, 0x14
jb 0x10063b90
lea eax, [ebp - 0x10]
mov byte [ebp - 0x49], 0
push eax
push 1
push 0
lea eax, [ebp - 0x5d]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
test eax, eax
jne 0x10063bff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x10063c05
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x10063c46
xor ecx, ecx
jmp 0x10063c59
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063c50
sub ecx, esi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.10062370
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x10063cc1
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.1006fc00
add esp, 0xc
mov dword [ebp - 0x1f], 0x756c6176
mov word [ebp - 0x1b], 0x3165
mov edx, 5
mov byte [ebp - 0x19], 0
xor ecx, ecx
nop
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x5e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10063cf0
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x49], 0
push eax
lea edx, [ebp - 0x5e]
mov ecx, closesocket
call fcn.100632f0
add esp, 4
xor ecx, ecx
mov edx, 5
test eax, eax
je 0x10063e80
mov dword [ebp - 0x1f], 0x756c6176
mov word [ebp - 0x1b], 0x3265
mov byte [ebp - 0x19], cl
nop
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x5e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10063d40
mov byte [ebp - 0x49], 0
mov edx, 5
mov dword [ebp - 0x26], 0x756c6176
xor ecx, ecx
mov word [ebp - 0x22], 0x3165
mov byte [ebp - 0x20], 0
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x42], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10063d74
lea eax, [ebp - 0x10]
mov byte [ebp - 0x2d], 0
push eax
push 1
push 0
lea eax, [ebp - 0x5e]
mov dword [ebp - 0xc], 0x25207325
push eax
push closesocket
mov word [ebp - 8], 0x73
mov dword [ebp - 0x14], 0x104
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10063de0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x1f]
push eax
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call edi
lea eax, [ebp - 4]
mov dword [ebp - 0x2c], 0x104
push eax
push 1
push 0
lea eax, [ebp - 0x42]
push eax
push closesocket
call ebx
test eax, eax
jne 0x10063e1d
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x26]
push eax
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x10063e61
xor ecx, ecx
jmp 0x1006414c
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063e70
jmp 0x1006414a
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x5e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10063e80
lea eax, [ebp - 0x10]
mov byte [ebp - 0x49], 0
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x5e]
push eax
push closesocket
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10063ee7
mov eax, 0x100abf94
lea ecx, [ebp - 0x33]
sub eax, 0x1ad6c44e
push eax
call fcn.10065300
push 0x20
lea ecx, [ebp - 0x2c0]
push ecx
push 1
push 0
push eax
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call edi
mov edx, 5
xor ecx, ecx
nop
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x5e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10063ef0
lea eax, [ebp - 0x10]
mov byte [ebp - 0x49], 0
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x5e]
push eax
push closesocket
call ebx
test eax, eax
jne 0x10063ffa
mov edx, 0x80
xor ecx, ecx
mov al, byte [ecx + 0x100abf9c]
xor al, dl
mov byte [ebp + ecx - 0x38], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xb
jb 0x10063f31
mov byte [ebp - 0x2d], 0
mov edx, 0x3d
xor ecx, ecx
mov al, byte [ecx + str.kQS_5__e]
xor al, dl
mov byte [ebp + ecx - 0x5d], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x14
jb 0x10063f54
lea eax, [ebp - 0x14]
mov byte [ebp - 0x49], 0
push eax
push 1
push 0
lea eax, [ebp - 0x5d]
mov word [ebp - 3], 0x7325
push eax
push closesocket
mov byte [ebp - 1], 0
mov dword [ebp - 0x2c], 0x104
call ebx
test eax, eax
jne 0x10063fbb
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x14]
call edi
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1002c420
add esp, 0xc
lea ecx, [ebp - 0x33]
push 0x2a1655af
call fcn.10065360
push 0x20
lea ecx, [ebp - 0x84]
push ecx
push 1
push 0
push eax
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x26], 0x756c6176
mov edx, 5
mov word [ebp - 0x22], 0x3265
xor ecx, ecx
mov byte [ebp - 0x20], 0
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x5e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10064012
mov byte [ebp - 0x49], 0
mov edx, 5
mov dword [ebp - 0x33], 0x756c6176
xor ecx, ecx
mov word [ebp - 0x2f], 0x3165
mov byte [ebp - 0x2d], 0
nop word [eax + eax]
mov al, byte [ecx + str.Fiieg__oauNWqfcwi]
xor al, dl
mov byte [ebp + ecx - 0x79], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10064050
lea eax, [ebp - 0x14]
mov byte [ebp - 0x64], 0
push eax
push 1
push 0
lea eax, [ebp - 0x5e]
mov dword [ebp - 0x1e], 0x25207325
push eax
push closesocket
mov word [ebp - 0x1a], 0x73
mov dword [ebp - 0x2c], 0x104
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100640bc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x26]
push eax
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x14]
call edi
lea eax, [ebp - 4]
mov dword [ebp - 0x18], 0x104
push eax
push 1
push 0
lea eax, [ebp - 0x79]
push eax
push closesocket
call ebx
test eax, eax
jne 0x100640f9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x33]
push eax
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call edi
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x1e]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002c420
sub esp, 8
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x1b8], 0
jne 0x1006413a
xor ecx, ecx
jmp 0x1006414c
lea ecx, [ebp - 0x1b8]
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10064143
sub ecx, esi
push ecx
lea eax, [ebp - 0x1b8]
mov ecx, edx
push eax
call fcn.1002fac0
lea eax, [ebp - 0x7c]
push eax
call fcn.10062370
sub esp, 0x18
mov word [ebp - 3], 0x7325
mov ecx, esp
mov byte [ebp - 1], 0
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 0x2c0]
movq qword [ecx + 0x10], xmm0
push eax
call fcn.1002c420
xor eax, eax
add esp, 0x20
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x68]
cmp eax, 0x10
jb 0x100641b4
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.1002f990
push 0x104
lea eax, [ebp - 0x1b8]
push 0
push eax
call fcn.1006fc00
add esp, 0xc
xor edx, edx
nop dword [eax]
mov al, byte [ebp + edx - 0x2c0]
cmp al, 0x61
jl 0x100641e8
cmp al, 0x7a
jg 0x100641e8
sub al, 0x20
mov byte [ebp + edx - 0x2c0], al
lea ecx, [ebp - 0x2c0]
inc edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100641f2
sub ecx, esi
cmp edx, ecx
jbe 0x100641d0
mov byte [ebp - 1], al
xorps xmm0, xmm0
lea eax, [ebp - 0x2c0]
mov dword [0x101cd457], 0
push eax
lea eax, [ebp - 3]
mov word [ebp - 3], 0x7325
push eax
push 0x101cd437
movups xmmword [0x101cd437], xmm0
movups xmmword [0x101cd447], xmm0
call fcn.1002c420
add esp, 0xc
lea eax, [ebp - 0x2c0]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret