Function at 0x10004d22
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1001d054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
and dword [ebp - 0x94], 0
and dword [ebp - 0x90], 0
push edi
push 0x5c
pop ecx
push 0x69
pop edi
push 0x72
pop esi
push 0x73
pop edx
push 0x6e
mov dword [ebp - 0xa0], eax
pop eax
mov word [ebp - 0x74], si
mov word [ebp - 0x52], si
mov word [ebp - 0x50], si
mov word [ebp - 0x44], si
xor esi, esi
mov word [ebp - 0x8c], 0x53
mov word [ebp - 0x8a], 0x4f
mov word [ebp - 0x88], 0x46
mov word [ebp - 0x86], 0x54
mov word [ebp - 0x84], 0x57
mov word [ebp - 0x82], 0x41
mov word [ebp - 0x80], 0x52
mov word [ebp - 0x7e], 0x45
mov word [ebp - 0x7c], cx
mov word [ebp - 0x7a], 0x4d
mov word [ebp - 0x78], di
mov word [ebp - 0x76], 0x63
mov word [ebp - 0x72], 0x6f
mov word [ebp - 0x70], dx
mov word [ebp - 0x6e], 0x6f
mov word [ebp - 0x6c], 0x66
mov word [ebp - 0x6a], 0x74
mov word [ebp - 0x68], cx
mov word [ebp - 0x66], 0x57
mov word [ebp - 0x64], di
mov word [ebp - 0x62], ax
mov word [ebp - 0x60], 0x64
mov word [ebp - 0x5e], 0x6f
mov word [ebp - 0x5c], 0x77
mov word [ebp - 0x5a], dx
mov word [ebp - 0x58], cx
mov word [ebp - 0x56], 0x43
mov word [ebp - 0x54], 0x75
mov word [ebp - 0x4e], 0x65
mov word [ebp - 0x4c], ax
mov word [ebp - 0x4a], 0x74
mov word [ebp - 0x48], 0x56
mov word [ebp - 0x46], 0x65
mov word [ebp - 0x42], dx
mov word [ebp - 0x40], di
mov word [ebp - 0x3e], 0x6f
mov word [ebp - 0x3c], ax
mov word [ebp - 0x3a], cx
mov word [ebp - 0x38], 0x55
mov word [ebp - 0x36], ax
mov word [ebp - 0x34], di
mov word [ebp - 0x32], ax
mov word [ebp - 0x30], dx
mov word [ebp - 0x2e], 0x74
mov word [ebp - 0x2c], 0x61
mov word [ebp - 0x2a], 0x6c
mov word [ebp - 0x28], 0x6c
mov word [ebp - 0x26], cx
mov word [ebp - 0x24], 0x33
mov word [ebp - 0x22], 0x36
mov word [ebp - 0x20], 0x30
mov word [ebp - 0x1e], 0x5b89
mov word [ebp - 0x1c], 0x5168
mov word [ebp - 0x1a], 0x536b
mov word [ebp - 0x18], 0x58eb
mov word [ebp - 0x16], si
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], al
mov byte [ebp - 0x12], dl
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 6], al
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x8c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x4c
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x69
mov byte [ebp - 7], 0x6f
mov byte [ebp - 5], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10004f8a
mov eax, 0x824
push eax
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x9c], eax
call fcn.10011f8a
mov edi, eax
cmp edi, esi
pop ecx
je 0x10004f7e
push dword [ebp - 0x9c]
push esi
push edi
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9c]
push eax
push edi
lea eax, [ebp - 0x98]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10004f77
inc esi
cmp dword [ebp - 0x98], esi
jne 0x10004f77
mov ecx, dword [ebp - 0xa0]
push edi
call dword [0x100151e8]
mov dword [ebp - 0x94], esi
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x94]
pop edi
xor ecx, ebp
pop esi
call fcn.10011f9a
leave
ret 4