Function at 0x10016880
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a657f
mov eax, dword fs:[0]
push eax
sub esp, 0x2c0
mov eax, dword [0x10216040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x278], edi
mov dword [ebp - 0x220], edi
xor eax, eax
mov dword [ebp - 0x2cc], edi
mov dword [ebp - 0x2c8], eax
xorps xmm0, xmm0
movq qword [ebp - 0x21c], xmm0
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x2a8]
xor ecx, ecx
movq qword [ebp - 0x24c], xmm0
lea esi, [ebp - 0x27a]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x2a8], 0x54464f53
mov dword [ebp - 0x2a4], 0x45524157
mov dword [ebp - 0x2a0], 0x63694d5c
mov dword [ebp - 0x29c], 0x6f736f72
mov dword [ebp - 0x298], 0x535c7466
mov dword [ebp - 0x294], 0x72756365
mov dword [ebp - 0x290], 0x20797469
mov dword [ebp - 0x28c], 0x746e6543
mov dword [ebp - 0x288], 0x505c7265
mov dword [ebp - 0x284], 0x69766f72
mov dword [ebp - 0x280], 0x5c726564
mov word [ebp - 0x27c], 0x7641
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x2ac], ecx
mov dword [ebp - 0x244], ecx
sub esi, edx
je 0x100169f3
cmp esi, 0x7fffffff
ja 0x10017124
push esi
lea ecx, [ebp - 0x24c]
call fcn.10002a90
push esi
lea eax, [ebp - 0x2a8]
push eax
mov eax, dword [ebp - 0x24c]
push eax
mov dword [ebp - 0x270], eax
call fcn.1017c530
mov eax, dword [ebp - 0x270]
add esp, 0xc
mov ecx, dword [ebp - 0x244]
add eax, esi
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x2ac], ecx
mov esi, dword [ebp - 0x270]
xorps xmm0, xmm0
mov byte [ebp - 4], 1
mov dword [ebp - 0x228], 0
movups xmmword [ebp - 0x238], xmm0
cmp esi, eax
jne 0x10016a2c
mov ecx, 0xf
mov byte [ebp - 0x238], 0
mov dword [ebp - 0x224], ecx
jmp 0x10016b36
sub eax, esi
mov dword [ebp - 0x224], 0xf
mov dword [ebp - 0x268], eax
cmp eax, 0x7fffffff
ja 0x10017129
mov edi, 0xf
cmp eax, edi
jbe 0x10016af1
mov edi, eax
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x10016a9e
mov eax, SysReAllocStringLen
mov edi, SysReAllocString
add eax, 0x23
push eax
call fcn.1002aa88
add esp, 4
test eax, eax
je 0x10017133
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x224], edi
jmp 0x10016af7
mov ecx, 0x16
cmp edi, ecx
cmovb edi, ecx
lea ecx, [edi + 1]
test ecx, ecx
jne 0x10016abd
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x224], edi
jmp 0x10016af7
cmp ecx, 0x1000
jb 0x10016ad2
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x1001712e
jmp 0x10016a70
push ecx
call fcn.1002aa88
mov ecx, eax
mov dword [ebp - 0x224], edi
mov eax, dword [ebp - 0x268]
add esp, 4
mov dword [ebp - 0x238], ecx
jmp 0x10016af7
mov ecx, dword [ebp - 0x238]
push eax
mov eax, dword [ebp - 0x270]
lea esi, [ebp - 0x238]
cmp edi, 0xf
push eax
cmova esi, ecx
push esi
call fcn.1017c530
mov eax, dword [ebp - 0x268]
add esp, 0xc
mov edi, dword [ebp - 0x278]
mov dword [ebp - 0x228], eax
mov byte [esi + eax], 0
mov ecx, dword [ebp - 0x224]
mov esi, dword [ebp - 0x270]
cmp ecx, 0xf
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x26c]
push ecx
push 0x20019
lea eax, [ebp - 0x238]
cmova eax, dword [ebp - 0x238]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10016c18
xorps xmm0, xmm0
mov ecx, edi
push 1
movups xmmword [edi], xmm0
push 0x101f1698
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.1000d570
mov ecx, dword [ebp - 0x224]
cmp ecx, 0xf
jbe 0x10016bc8
mov edx, dword [ebp - 0x238]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016bbe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017133
push ecx
push edx
call fcn.10178716
add esp, 8
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], 0
test esi, esi
je 0x100170fc
mov ecx, dword [ebp - 0x2ac]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x10016c11
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017133
push ecx
push esi
jmp 0x100170f4
xor esi, esi
mov dword [ebp - 0x23c], 0x100
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10016f2b
nop dword [eax + eax]
push 0x101f169c
lea edx, [ebp - 0x238]
lea ecx, [ebp - 0x294]
call fcn.10018fe0
add esp, 4
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 3
push ecx
mov ecx, eax
call fcn.1000ccb0
or dword [ebp - 0x274], 2
xorps xmm0, xmm0
movups xmmword [ebp - 0x264], xmm0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x264], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x254], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x280]
cmp ecx, 0xf
jbe 0x10016d06
mov edx, dword [ebp - 0x294]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016cfc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017133
push ecx
push edx
call fcn.10178716
add esp, 8
cmp dword [ebp - 0x250], 0xf
lea ecx, [ebp - 0x268]
push ecx
push 0x20019
lea eax, [ebp - 0x264]
mov dword [ebp - 0x284], 0
cmova eax, dword [ebp - 0x264]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x280], 0xf
mov byte [ebp - 0x294], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10016eb7
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0x100
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.displayName
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10016dd7
cmp dword [ebp - 0x220], 1
jne 0x10016dd7
xorps xmm0, xmm0
mov dword [ebp - 0x2b4], eax
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x2b0], eax
movups xmmword [ebp - 0x2c4], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10016db5
sub ecx, edx
lea eax, [ebp - 0x210]
push ecx
push eax
lea ecx, [ebp - 0x2c4]
call fcn.1000d570
mov byte [ebp - 4], 6
jmp 0x10016e20
xorps xmm0, xmm0
mov dword [ebp - 0x2b4], 0
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x2b0], 0
movups xmmword [ebp - 0x2c4], xmm0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10016e00
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x2c4]
call fcn.1000d570
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x214]
je 0x10016e5a
movups xmm0, xmmword [ebp - 0x2c4]
mov ecx, 0xf
mov byte [ebp - 0x2c4], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x2b4]
movq qword [eax + 0x10], xmm0
add dword [ebp - 0x218], 0x18
jmp 0x10016e73
lea ecx, [ebp - 0x2c4]
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.10015670
mov ecx, dword [ebp - 0x2b0]
mov byte [ebp - 4], 5
cmp ecx, 0xf
jbe 0x10016eab
mov edx, dword [ebp - 0x2c4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016ea1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017133
push ecx
push edx
call fcn.10178716
add esp, 8
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
inc esi
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x23c], 0x100
cmp ecx, 0xf
jbe 0x10016f00
mov edx, dword [ebp - 0x264]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016ef6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017133
push ecx
push edx
call fcn.10178716
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10016c50
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 8
xorps xmm0, xmm0
mov eax, dword [ebp - 0x274]
mov esi, dword [ebp - 0x21c]
or eax, 4
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x218]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x240], eax
cmp esi, eax
je 0x10017071
nop
push 0x101f16cc
mov edx, esi
lea ecx, [ebp - 0x294]
call fcn.10018fe0
add esp, 4
mov dword [ebp - 4], 9
mov ecx, eax
cmp dword [eax + 0x14], 0xf
jbe 0x10016fb6
mov ecx, dword [eax]
mov edi, dword [eax + 0x10]
mov eax, dword [ebp - 0x278]
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
sub eax, edx
cmp edi, eax
ja 0x10017001
mov esi, dword [ebp - 0x278]
lea eax, [edx + edi]
cmp dword [esi + 0x14], 0xf
mov dword [esi + 0x10], eax
mov eax, esi
jbe 0x10016fe1
mov eax, dword [esi]
push edi
lea esi, [eax + edx]
push ecx
push esi
call fcn.1017c530
mov byte [esi + edi], 0
add esp, 0xc
mov esi, dword [ebp - 0x274]
mov edi, dword [ebp - 0x278]
jmp 0x1001701e
push edi
push ecx
mov byte [ebp - 0x220], 0
push dword [ebp - 0x220]
push edi
mov edi, dword [ebp - 0x278]
mov ecx, edi
call fcn.1000cd20
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x280]
cmp ecx, 0xf
jbe 0x1001705c
mov edx, dword [ebp - 0x294]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10017052
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017133
push ecx
push edx
call fcn.10178716
add esp, 8
add esi, 0x18
mov dword [ebp - 0x274], esi
cmp esi, dword [ebp - 0x240]
jne 0x10016f90
mov ecx, dword [ebp - 0x224]
cmp ecx, 0xf
jbe 0x100170ab
mov edx, dword [ebp - 0x238]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100170a1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017133
push ecx
push edx
call fcn.10178716
add esp, 8
mov ecx, dword [ebp - 0x270]
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0xf
mov byte [ebp - 0x238], 0
test ecx, ecx
je 0x100170fc
mov edx, dword [ebp - 0x2ac]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x100170f2
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017133
push edx
push ecx
call fcn.10178716
add esp, 8
lea ecx, [ebp - 0x21c]
call fcn.1000a9d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101786e5
mov esp, ebp
pop ebp
ret
call fcn.10002a80
call fcn.10002c80
call fcn.10002d90
call fcn.1018001f
int3