Function at 0x1000259c
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
push ebx
push esi
push edi
push str.strstr
push str.MSVCRT.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
nop
nop
push 0x1f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0xc7]
mov byte [ebp - 0xc8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x80
lea eax, [ebp - 0xc8]
push ebx
push eax
call sub.MSVCRT.dll_memset
nop
nop
nop
nop
lea eax, [ebp - 0x40]
mov byte [ebp - 0x40], 0x53
push eax
lea eax, [ebp - 0x1cc]
push eax
mov byte [ebp - 0x3f], 0x4f
mov byte [ebp - 0x3e], 0x46
mov byte [ebp - 0x3d], 0x54
mov byte [ebp - 0x3c], 0x57
mov byte [ebp - 0x3b], 0x41
mov byte [ebp - 0x3a], 0x52
mov byte [ebp - 0x39], 0x45
mov byte [ebp - 0x38], 0x5c
mov byte [ebp - 0x37], 0x4d
mov byte [ebp - 0x36], 0x69
mov byte [ebp - 0x35], 0x63
mov byte [ebp - 0x34], 0x72
mov byte [ebp - 0x33], 0x6f
mov byte [ebp - 0x32], 0x73
mov byte [ebp - 0x31], 0x6f
mov byte [ebp - 0x30], 0x66
mov byte [ebp - 0x2f], 0x74
mov byte [ebp - 0x2e], 0x5c
mov byte [ebp - 0x2d], 0x57
mov byte [ebp - 0x2c], 0x69
mov byte [ebp - 0x2b], 0x6e
mov byte [ebp - 0x2a], 0x64
mov byte [ebp - 0x29], 0x6f
mov byte [ebp - 0x28], 0x77
mov byte [ebp - 0x27], 0x73
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x4e
mov byte [ebp - 0x24], 0x54
mov byte [ebp - 0x23], 0x5c
mov byte [ebp - 0x22], 0x43
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0x74
mov byte [ebp - 0x1b], 0x56
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x6e
mov byte [ebp - 0x14], bl
call sub.MSVCRT.dll_strcpy
add esp, 0x14
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x1cc]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.MSVCRT.dll_putchar]
test eax, eax
jne 0x10002755
mov dword [ebp - 0x44], 0xc8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x30
call edi
pop ecx
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
push dword [ebp - 4]
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x6f
mov byte [ebp - 0xd], 0x64
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x4e
mov byte [ebp - 8], 0x61
mov byte [ebp - 7], 0x6d
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc8]
push str.2000
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x1000279a
lea eax, [ebp - 0xc8]
push str.2003
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x1000279a
lea eax, [ebp - 0xc8]
push str.2008
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x1000279a
push 0x30
call edi
pop ecx
xor eax, eax
jmp 0x1000279d
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret