Function at 0x1001c040
Capabilities:
Encode data using xor
Enumerate processes
Query or enumerate registry value
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004de1e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x750
mov eax, dword [0x1005d014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov byte [ebp - 0x74d], 0
mov byte [ebp - 0x74e], 0
mov byte [ebp - 0x74f], 0
mov dword [ebp - 0x74c], esi
nop dword [eax]
nop dword [eax + eax]
push 0
push 2
mov dword [ebp - 0x748], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x748]
mov dword [ebp - 0x758], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x1001ca68
lea eax, [ebp - 0x748]
push eax
push dword [ebp - 0x758]
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x1001ca68
nop dword [eax]
cmp byte [0x1009093a], 0
jne 0x1001c19c
mov dword [ebp - 0x470], 0
lea edx, [ebp - 0x470]
mov dword [ebp - 0x46c], 1
xor esi, esi
mov dword [ebp - 0x468], 2
mov dword [ebp - 0x464], 3
mov dword [ebp - 0x460], 4
mov dword [ebp - 0x45c], 5
mov dword [ebp - 0x458], 6
mov dword [ebp - 0x454], 7
mov dword [ebp - 0x450], 8
mov dword [ebp - 0x44c], 9
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x10090930], al
cmp esi, 0xa
jne 0x1001c180
mov byte [0x1009093a], 1
lea eax, [ebp - 0x724]
push 0x10090930
push eax
call fcn.1003257b
add esp, 8
test eax, eax
jne 0x1001ca46
mov byte [ebp - 0x74e], 1
cmp byte [ebp - 0x74d], al
jne 0x1001c2ea
mov dword [ebp - 0x61c], 0xa0b2b9af
lea edx, [ebp - 0x34]
mov dword [ebp - 0x618], 0x3727161
xor esi, esi
mov byte [ebp - 0x614], al
mov dword [ebp - 0x610], 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x18], 7
nop dword [eax + eax]
mov eax, dword [edx]
lea ecx, [ebp - 0x61c]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, 8
jne 0x1001c230
push 0
lea eax, [ebp - 0x61c]
mov byte [ebp - 0x614], 1
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x1001c2ea
lea eax, [ebp - 0x760]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x760]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1001c2e4
push 0x410
lea eax, [ebp - 0x448]
push eax
push 0
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x448]
push 0x10091c78
push eax
call fcn.1003257b
add esp, 8
test eax, eax
jne 0x1001c2e4
push esi
mov byte [ebp - 0x74d], 1
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1001c2dd
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x740]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1001ca46
cmp dword [ebp - 0x74c], 0
jle 0x1001c322
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001ca46
cmp byte [0x10090928], 0
xorps xmm0, xmm0
mov byte [ebp - 0x34], 0
movups xmmword [ebp - 0x33], xmm0
mov dword [ebp - 0x1b], 0
movq qword [ebp - 0x23], xmm0
mov word [ebp - 0x17], 0
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x75c], 0x20
jne 0x1001c46e
mov dword [ebp - 0x4d8], 0
lea edx, [ebp - 0x4d8]
mov dword [ebp - 0x4d4], 1
xor esi, esi
mov dword [ebp - 0x4d0], 2
mov dword [ebp - 0x4cc], 3
mov dword [ebp - 0x4c8], 4
mov dword [ebp - 0x4c4], 5
mov dword [ebp - 0x4c0], 6
mov dword [ebp - 0x4bc], 7
mov dword [ebp - 0x4b8], 8
mov dword [ebp - 0x4b4], 9
mov dword [ebp - 0x4b0], 0xa
mov dword [ebp - 0x4ac], 0xb
mov dword [ebp - 0x4a8], 0xc
mov dword [ebp - 0x4a4], 0xd
mov dword [ebp - 0x4a0], 0xe
mov dword [ebp - 0x49c], 0xf
mov dword [ebp - 0x498], 0x10
mov dword [ebp - 0x494], 0x11
mov dword [ebp - 0x490], 0x12
mov dword [ebp - 0x48c], 0x13
mov dword [ebp - 0x488], 0x14
mov dword [ebp - 0x484], 0x15
mov dword [ebp - 0x480], 0x16
mov dword [ebp - 0x47c], 0x17
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x10090910], al
cmp esi, 0x18
jne 0x1001c452
mov byte [0x10090928], 1
lea eax, [ebp - 0x754]
push eax
push 0x20019
push 0
push 0x10090910
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001c570
mov dword [ebp - 0x5ec], 0xbaaaa9bd
lea edx, [ebp - 0x46c]
mov dword [ebp - 0x5e8], 0x5056514d
xor esi, esi
mov word [ebp - 0x5e4], 4
mov dword [ebp - 0x5e0], 9
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], 1
mov dword [ebp - 0x464], 2
mov dword [ebp - 0x460], 3
mov dword [ebp - 0x45c], 4
mov dword [ebp - 0x458], 5
mov dword [ebp - 0x454], 6
mov dword [ebp - 0x450], 7
mov dword [ebp - 0x44c], 8
nop dword [eax]
mov eax, dword [edx]
lea ecx, [ebp - 0x5ec]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, 9
jne 0x1001c520
lea eax, [ebp - 0x75c]
mov byte [ebp - 0x5e3], 1
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0
lea eax, [ebp - 0x5ec]
push eax
push dword [ebp - 0x754]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x754]
test eax, eax
je 0x1001ca2a
call edi
cmp byte [0x10090908], 0
jne 0x1001c691
mov dword [ebp - 0x4d8], 0
lea edx, [ebp - 0x4d8]
mov dword [ebp - 0x4d4], 1
xor esi, esi
mov dword [ebp - 0x4d0], 2
mov dword [ebp - 0x4cc], 3
mov dword [ebp - 0x4c8], 4
mov dword [ebp - 0x4c4], 5
mov dword [ebp - 0x4c0], 6
mov dword [ebp - 0x4bc], 7
mov dword [ebp - 0x4b8], 8
mov dword [ebp - 0x4b4], 9
mov dword [ebp - 0x4b0], 0xa
mov dword [ebp - 0x4ac], 0xb
mov dword [ebp - 0x4a8], 0xc
mov dword [ebp - 0x4a4], 0xd
mov dword [ebp - 0x4a0], 0xe
mov dword [ebp - 0x49c], 0xf
mov dword [ebp - 0x498], 0x10
mov dword [ebp - 0x494], 0x11
mov dword [ebp - 0x490], 0x12
mov dword [ebp - 0x48c], 0x13
mov dword [ebp - 0x488], 0x14
mov dword [ebp - 0x484], 0x15
mov dword [ebp - 0x480], 0x16
mov dword [ebp - 0x47c], 0x17
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x100908f0], al
cmp esi, 0x18
jne 0x1001c675
mov byte [0x10090908], 1
lea eax, [ebp - 0x754]
push eax
push 0x20019
push 0
push 0x100908f0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001c790
mov dword [ebp - 0x5fc], 0xbaaaa9bd
lea edx, [ebp - 0x46c]
mov dword [ebp - 0x5f8], 0x5056514d
xor esi, esi
mov word [ebp - 0x5f4], 4
mov dword [ebp - 0x5f0], 9
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], 1
mov dword [ebp - 0x464], 2
mov dword [ebp - 0x460], 3
mov dword [ebp - 0x45c], 4
mov dword [ebp - 0x458], 5
mov dword [ebp - 0x454], 6
mov dword [ebp - 0x450], 7
mov dword [ebp - 0x44c], 8
nop dword [eax]
mov eax, dword [edx]
lea ecx, [ebp - 0x5fc]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, 9
jne 0x1001c740
lea eax, [ebp - 0x75c]
mov byte [ebp - 0x5f3], 1
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0
lea eax, [ebp - 0x5fc]
push eax
push dword [ebp - 0x754]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x754]
test eax, eax
je 0x1001ca2a
call edi
cmp byte [0x10090870], 0
jne 0x1001c92c
mov dword [ebp - 0x508], 0
lea edx, [ebp - 0x508]
mov dword [ebp - 0x504], 1
xor esi, esi
mov dword [ebp - 0x500], 2
mov dword [ebp - 0x4fc], 3
mov dword [ebp - 0x4f8], 4
mov dword [ebp - 0x4f4], 5
mov dword [ebp - 0x4f0], 6
mov dword [ebp - 0x4ec], 7
mov dword [ebp - 0x4e8], 8
mov dword [ebp - 0x4e4], 9
mov dword [ebp - 0x4e0], 0xa
mov dword [ebp - 0x4dc], 0xb
mov dword [ebp - 0x4d8], 0xc
mov dword [ebp - 0x4d4], 0xd
mov dword [ebp - 0x4d0], 0xe
mov dword [ebp - 0x4cc], 0xf
mov dword [ebp - 0x4c8], 0x10
mov dword [ebp - 0x4c4], 0x11
mov dword [ebp - 0x4c0], 0x12
mov dword [ebp - 0x4bc], 0x13
mov dword [ebp - 0x4b8], 0x14
mov dword [ebp - 0x4b4], 0x15
mov dword [ebp - 0x4b0], 0x16
mov dword [ebp - 0x4ac], 0x17
mov dword [ebp - 0x4a8], 0x18
mov dword [ebp - 0x4a4], 0x19
mov dword [ebp - 0x4a0], 0x1a
mov dword [ebp - 0x49c], 0x1b
mov dword [ebp - 0x498], 0x1c
mov dword [ebp - 0x494], 0x1d
mov dword [ebp - 0x490], 0x1e
mov dword [ebp - 0x48c], 0x1f
mov dword [ebp - 0x488], 0x20
mov dword [ebp - 0x484], 0x21
mov dword [ebp - 0x480], 0x22
mov dword [ebp - 0x47c], 0x23
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x1009084c], al
cmp esi, 0x24
jne 0x1001c910
mov byte [0x10090870], 1
lea eax, [ebp - 0x754]
push eax
push 0x20019
push 0
push 0x1009084c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001ca46
mov dword [ebp - 0x60c], 0xbaaaa9bd
lea edx, [ebp - 0x46c]
mov dword [ebp - 0x608], 0x5056514d
xor esi, esi
mov word [ebp - 0x604], 4
mov dword [ebp - 0x600], 9
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], 1
mov dword [ebp - 0x464], 2
mov dword [ebp - 0x460], 3
mov dword [ebp - 0x45c], 4
mov dword [ebp - 0x458], 5
mov dword [ebp - 0x454], 6
mov dword [ebp - 0x450], 7
mov dword [ebp - 0x44c], 8
nop word [eax + eax]
mov eax, dword [edx]
lea ecx, [ebp - 0x60c]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, 9
jne 0x1001c9e0
lea eax, [ebp - 0x75c]
mov byte [ebp - 0x603], 1
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0
lea eax, [ebp - 0x60c]
push eax
push dword [ebp - 0x754]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x754]
test eax, eax
jne 0x1001ca44
call edi
mov esi, 1
push 0x7d0
mov dword [ebp - 0x74c], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001ca4c
call edi
mov esi, dword [ebp - 0x74c]
lea eax, [ebp - 0x748]
push eax
push dword [ebp - 0x758]
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x1001c100
push dword [ebp - 0x758]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x74e], 0
je 0x1001cf5c
cmp byte [ebp - 0x74f], 0
jne 0x1001cf5c
mov eax, dword [0x100995a0]
mov byte [ebp - 0x74f], 1
test al, 1
jne 0x1001cae9
or eax, 1
mov dword [0x100995a0], eax
xorps xmm0, xmm0
mov dword [0x100995a4], 0x10054080
push 0x1004dfe0
mov dword [0x100995b4], 0
movups xmmword [0x100995b8], xmm0
mov byte [0x100995a8], 0
mov dword [0x100995ac], 0
call fcn.1002c1e9
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x5dc], 0xaaa1adb3
lea edx, [ebp - 0x30]
mov dword [ebp - 0x5d8], 0x24550
xor esi, esi
mov dword [ebp - 0x5d4], 7
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x18], 6
nop dword [eax]
mov eax, dword [edx]
lea ecx, [ebp - 0x5dc]
add ecx, eax
lea edx, [edx + 4]
sub al, 4
inc esi
xor byte [ecx], al
cmp esi, 7
jne 0x1001cb40
push 1
lea eax, [ebp - 0x5dc]
mov byte [ebp - 0x5d5], 1
push eax
mov eax, dword [0x100995a4]
mov ecx, 0x100995a4
call dword [eax + 0xc]
cmp byte [0x10090aa3], 0
jne 0x1001cd4f
mov dword [ebp - 0x504], esi
lea edx, [ebp - 0x520]
mov dword [ebp - 0x520], 0
xor esi, esi
mov dword [ebp - 0x51c], 1
mov dword [ebp - 0x518], 2
mov dword [ebp - 0x514], 3
mov dword [ebp - 0x510], 4
mov dword [ebp - 0x50c], 5
mov dword [ebp - 0x508], 6
mov dword [ebp - 0x500], 8
mov dword [ebp - 0x4fc], 9
mov dword [ebp - 0x4f8], 0xa
mov dword [ebp - 0x4f4], 0xb
mov dword [ebp - 0x4f0], 0xc
mov dword [ebp - 0x4ec], 0xd
mov dword [ebp - 0x4e8], 0xe
mov dword [ebp - 0x4e4], 0xf
mov dword [ebp - 0x4e0], 0x10
mov dword [ebp - 0x4dc], 0x11
mov dword [ebp - 0x4d8], 0x12
mov dword [ebp - 0x4d4], 0x13
mov dword [ebp - 0x4d0], 0x14
mov dword [ebp - 0x4cc], 0x15
mov dword [ebp - 0x4c8], 0x16
mov dword [ebp - 0x4c4], 0x17
mov dword [ebp - 0x4c0], 0x18
mov dword [ebp - 0x4bc], 0x19
mov dword [ebp - 0x4b8], 0x1a
mov dword [ebp - 0x4b4], 0x1b
mov dword [ebp - 0x4b0], 0x1c
mov dword [ebp - 0x4ac], 0x1d
mov dword [ebp - 0x4a8], 0x1e
mov dword [ebp - 0x4a4], 0x1f
mov dword [ebp - 0x4a0], 0x20
mov dword [ebp - 0x49c], 0x21
mov dword [ebp - 0x498], 0x22
mov dword [ebp - 0x494], 0x23
mov dword [ebp - 0x490], 0x24
mov dword [ebp - 0x48c], 0x25
mov dword [ebp - 0x488], 0x26
mov dword [ebp - 0x484], 0x27
mov dword [ebp - 0x480], 0x28
mov dword [ebp - 0x47c], 0x29
mov dword [ebp - 0x478], 0x2a
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x10090a78], al
cmp esi, 0x2b
jne 0x1001cd33
mov byte [0x10090aa3], 1
push 0x10090a78
call fcn.10016530
test al, al
jne 0x1001cf56
cmp byte [0x10090a70], al
jne 0x1001cf4c
mov dword [ebp - 0x5d0], 0
lea edx, [ebp - 0x5d0]
mov dword [ebp - 0x5cc], 1
xor esi, esi
mov dword [ebp - 0x5c8], 2
mov dword [ebp - 0x5c4], 3
mov dword [ebp - 0x5c0], 4
mov dword [ebp - 0x5bc], 5
mov dword [ebp - 0x5b8], 6
mov dword [ebp - 0x5b4], 7
mov dword [ebp - 0x5b0], 8
mov dword [ebp - 0x5ac], 9
mov dword [ebp - 0x5a8], 0xa
mov dword [ebp - 0x5a4], 0xb
mov dword [ebp - 0x5a0], 0xc
mov dword [ebp - 0x59c], 0xd
mov dword [ebp - 0x598], 0xe
mov dword [ebp - 0x594], 0xf
mov dword [ebp - 0x590], 0x10
mov dword [ebp - 0x58c], 0x11
mov dword [ebp - 0x588], 0x12
mov dword [ebp - 0x584], 0x13
mov dword [ebp - 0x580], 0x14
mov dword [ebp - 0x57c], 0x15
mov dword [ebp - 0x578], 0x16
mov dword [ebp - 0x574], 0x17
mov dword [ebp - 0x570], 0x18
mov dword [ebp - 0x56c], 0x19
mov dword [ebp - 0x568], 0x1a
mov dword [ebp - 0x564], 0x1b
mov dword [ebp - 0x560], 0x1c
mov dword [ebp - 0x55c], 0x1d
mov dword [ebp - 0x558], 0x1e
mov dword [ebp - 0x554], 0x1f
mov dword [ebp - 0x550], 0x20
mov dword [ebp - 0x54c], 0x21
mov dword [ebp - 0x548], 0x22
mov dword [ebp - 0x544], 0x23
mov dword [ebp - 0x540], 0x24
mov dword [ebp - 0x53c], 0x25
mov dword [ebp - 0x538], 0x26
mov dword [ebp - 0x534], 0x27
mov dword [ebp - 0x530], 0x28
mov dword [ebp - 0x52c], 0x29
mov dword [ebp - 0x528], 0x2a
mov dword [ebp - 0x524], 0x2b
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
mov al, cl
inc esi
sub al, 4
xor byte [ecx + 0x10090a44], al
cmp esi, 0x2c
jne 0x1001cf30
mov byte [0x10090a70], 1
push 0x10090a44
call fcn.10016530
mov esi, dword [ebp - 0x74c]
test esi, esi
jle 0x1001cf7a
inc esi
mov dword [ebp - 0x74c], esi
cmp esi, 0xb4
jge 0x1001cf87
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001c0b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1002bc85
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret