Function at 0x1001e24e
Capabilities:
Delete registry key
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x10057753
call fcn.10056a88
sub esp, 0xa4
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], ecx
je 0x1001e4a9
mov dword [ebp - 0x18], 0x7dc7
cmp dword [ebp - 0x18], 0x7e01
jle 0x1001e2c5
push 0x1261
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
xor ebx, ebx
mov esi, ebx
mov edi, ebx
mov ebx, 0x5c1d
mov eax, edi
mov ecx, 0x100711f8
cdq
push edx
push eax
call fcn.10003fa2
add edi, esi
dec ebx
jne 0x1001e2a3
inc esi
cmp esi, 0x5de9
jl 0x1001e29c
mov edi, dword [ebp - 0x28]
jmp 0x1001e2c7
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x7cbc
jge 0x1001e2e2
mov edx, str.uedooosb_ppr_zpct_bmowkmqcm_vsnbchyz_uigufhkdc_rbqjqrd_ydpva_seg_ywsdt_djtgozc_breb_osqeuj
mov ecx, 0x100711f8
call fcn.1000634f
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1001e3d7
mov dword [ebp - 0x44], 0xf
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x58], bl
push ecx
push ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 2
push eax
push 0x1931
push ecx
mov dl, 1
lea ecx, [ebp + 0xc]
call fcn.1001e0bf
mov eax, dword [0x10444f00]
add esp, 0x14
test al, 1
jne 0x1001e34b
or eax, 1
mov dword [0x10444f00], eax
push 0x76b8
mov byte [ebp - 4], 3
call fcn.10012256
mov byte [0x1044629c], al
mov byte [ebp - 4], 2
mov eax, dword [0x10444f00]
pop ecx
test al, 2
jne 0x1001e36f
or eax, 2
mov dword [0x10444f00], eax
push 0xc73f
mov byte [ebp - 4], 4
call fcn.10012256
pop ecx
mov byte [0x10444f04], al
mov byte [ebp - 4], 2
push ecx
lea eax, [ebp - 0x58]
mov edx, 0x1044629c
push eax
push 1
lea eax, [ebp + 0xc]
push eax
push 0x10444f04
call fcn.1001e11c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x58]
add esp, 0x14
cmp ecx, eax
je 0x1001e39f
push 0xffffffffffffffff
push ebx
push eax
call fcn.1001b3d2
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.1001b50d
jmp 0x1001e85b
mov dword [ebp - 0x14], 0x1d47
cmp dword [ebp - 0x14], 0x1fbb
jle 0x1001e438
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, esi
mov esi, 0x124b
mov eax, edi
lea ecx, [ebp - 0x98]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001e40d
mov eax, dword [eax]
push eax
call fcn.1003e75c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x98]
call fcn.1000460a
dec edi
dec esi
jne 0x1001e3f3
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x5318
jl 0x1001e3ec
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x14], 0x1a31
jge 0x1001e44c
push str.ykz_jynvtjgcz_yluon_xabssrrk_gefnfoxig
call fcn.1003e75c
pop ecx
mov eax, dword [edi]
mov ecx, 0xedca8fec
mov ebx, dword [ebp + 0x28]
cmp ecx, eax
sbb ecx, ecx
xor edx, edx
inc ecx
mov eax, dword [ebx]
cmp ecx, eax
mov eax, dword [edi]
sete dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [edi]
setle cl
imul eax, ecx
test eax, eax
jne 0x1001e478
mov eax, dword [ebx]
mov eax, dword [edi]
xor ecx, ecx
mov esi, dword [ebp + 0x24]
add eax, 9
mov dword [esi], eax
mov eax, dword [edi]
cmp eax, 0xffffffff
mov eax, dword [ebx]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebx]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esi]
sete cl
add eax, ecx
mov dword [ebx], eax
jmp 0x1001e85b
cmp byte [ebp + 0x14], 0
je 0x1001e560
mov dword [ebp - 0x18], 0x7810
cmp dword [ebp - 0x18], 0x7ac9
jle 0x1001e536
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x80]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001e4ed
mov eax, dword [eax]
push eax
call fcn.1003e75c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.1000460a
inc edi
cmp edi, 0x787f
jl 0x1001e4d1
inc esi
cmp esi, 0x10f2
jl 0x1001e4cf
push 0x998
push ebx
push 0x13ce
push 0xfa5
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x1c]
push dword [eax]
call fcn.1000ed5c
cmp dword [ebp - 0x18], 0x774b
jge 0x1001e85b
push str.ytdhuaezx_glho_uycye_nxtqd_omkx_nsmci_wyuwgbdno_lteg_ycjgbh
call fcn.1003e75c
pop ecx
jmp 0x1001e85b
mov dword [ebp - 0x1c], 0x6a3a
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x6dd7
jle 0x1001e5e8
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov dword [ebp - 0x34], 0x207c
mov dword [ebp - 0x14], eax
mov esi, eax
mov dword [ebp - 0x18], 0x50eb
mov eax, esi
lea ecx, [ebp - 0xb0]
or eax, edi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001e5a8
mov eax, dword [eax]
push eax
call fcn.1003e75c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xb0]
call fcn.1000460a
dec esi
dec dword [ebp - 0x18]
jne 0x1001e58c
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add eax, esi
dec dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
jne 0x1001e583
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x6372
jl 0x1001e577
inc edi
cmp edi, 0x3e1c
jl 0x1001e574
mov dword [ebp - 0x20], 0x3a4a
mov dword [ebp - 0x20], 0x6aabecba
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0x644accb2
push 3
mov dword [ebp - 0x20], 0x56e7
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x1001e621
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], 0xadae8c9f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001e613
mov dword [ebp - 0x14], ebx
jmp 0x1001e639
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c], 0xf3b8c105
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001e62b
mov dword [ebp - 0x14], ebx
jmp 0x1001e652
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001e644
dec dword [ebp - 0x30]
cmp dword [ebp - 0x1c], 0x680c
jge 0x1001e66f
push str.mktrsy_xmvaa_vaewhokf_muzwtt_lwhcadx_waxwh_vbvtgcjkd
call fcn.1003e75c
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [0x10444f00]
test al, 4
jne 0x1001e696
or dword [0x10446294], 0xffffffff
or eax, 4
push ecx
push 0x1571
mov dword [0x10444f00], eax
call fcn.1001e86c
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x1c], 0x515466b
mov dword [ebp - 0x20], 0xab6dad81
mov dword [ebp - 0x18], ebx
jmp 0x1001e6be
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2c], 0x3099cfe0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1001e6b0
push ecx
push ecx
mov byte [ebp + 0x1b], bl
lea ecx, [ebp + 0x1b]
call fcn.1001ca23
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x14], 5
pop ecx
pop ecx
ja 0x1001e6df
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
sub edx, eax
mov eax, dword [ebp - 0x2c]
cmp eax, edx
setge cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0xcbcb1a7a
mov dword [ebp - 0x18], ebx
jmp 0x1001e729
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x40], 0xb110c93b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001e71b
mov dword [ebp - 0x38], ebx
jmp 0x1001e793
mov dword [ebp - 0x1c], 0x247a
mov dword [ebp - 0x18], ebx
jmp 0x1001e74d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x24], 0x3fbb4ebb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001e73f
cmp dword [ebp - 0x24], ebx
je 0x1001e78b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffa
jne 0x1001e776
mov edx, ecx
cmp dword [ebp - 0x24], ebx
jne 0x1001e778
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, ecx
cmp dword [ebp - 0x1c], edx
jne 0x1001e78d
mov eax, ebx
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x1c
je 0x1001e733
cmp byte [0x10444e1b], 0
jne 0x1001e7c0
mov edx, 0x6c86
xor cl, cl
call fcn.1001c956
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1001e86c
call fcn.1001c6b5
mov eax, dword [0x10444f10]
cmp eax, 0x270
jne 0x1001e80c
mov edx, 0x10444f18
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, dword [edx - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x630]
xor eax, ecx
mov dword [edx + 0x9bc], eax
add edx, 4
cmp edx, 0x104458d8
jl 0x1001e7d1
jmp 0x1001e818
cmp eax, 0x4e0
jb 0x1001e81d
call fcn.1001e8a7
mov eax, dword [0x10444f10]
mov edx, dword [eax*4 + 0x10444f14]
inc eax
mov dword [0x10444f10], eax
mov eax, edx
shr eax, 0xb
and eax, dword [0x10446294]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, dword [ebp + 0x20]
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret