Function at 0x1026d43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1048628]
push ebx
push esi
push 0x1005368
xor ebx, ebx
push 0x80000001
mov dword [ebp - 4], eax
mov dword [ebp - 0x6c], ebx
call fcn.01026abc
lea eax, [ebp - 0x6c]
push eax
mov esi, 0x20007
push esi
push ebx
push 0x10052f8
push 0x80000002
call fcn.0101c02d
test eax, eax
jne 0x1027258
push edi
lea eax, [ebp - 0x60]
push eax
push esi
push ebx
push 0x10052dc
push dword [ebp - 0x6c]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x64], 3
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x5c], 0xa4
mov byte [ebp - 0x5b], 0xb
mov byte [ebp - 0x5a], bl
mov byte [ebp - 0x59], bl
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 9
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], bl
mov byte [ebp - 0x53], bl
mov byte [ebp - 0x52], bl
mov byte [ebp - 0x51], bl
mov byte [ebp - 0x50], bl
mov byte [ebp - 0x4f], bl
mov byte [ebp - 0x4e], bl
mov byte [ebp - 0x4d], bl
mov byte [ebp - 0x4c], bl
mov byte [ebp - 0x4b], bl
mov byte [ebp - 0x4a], bl
mov byte [ebp - 0x49], bl
mov byte [ebp - 0x48], bl
mov byte [ebp - 0x47], bl
mov byte [ebp - 0x46], bl
mov byte [ebp - 0x45], bl
mov byte [ebp - 0x44], bl
mov byte [ebp - 0x43], bl
mov byte [ebp - 0x42], bl
mov byte [ebp - 0x41], bl
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], bl
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], bl
mov byte [ebp - 0x3b], bl
mov byte [ebp - 0x3a], bl
mov byte [ebp - 0x39], bl
mov byte [ebp - 0x38], bl
mov byte [ebp - 0x37], bl
mov byte [ebp - 0x36], bl
mov byte [ebp - 0x35], bl
call fcn.0101c02d
test eax, eax
push 0x20
pop edi
mov esi, 0x1004030
jne 0x1026f76
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push esi
push dword [ebp - 0x60]
mov byte [ebp - 0x34], 0x36
mov byte [ebp - 0x33], 8
mov byte [ebp - 0x32], 5
mov byte [ebp - 0x31], 0xd3
mov byte [ebp - 0x30], 0x57
mov byte [ebp - 0x2f], 0x96
mov byte [ebp - 0x2e], 0xeb
mov byte [ebp - 0x2d], 0xdc
mov byte [ebp - 0x2c], 0x18
mov byte [ebp - 0x2b], 0x83
mov byte [ebp - 0x2a], 0x6e
mov byte [ebp - 0x29], 0x88
mov byte [ebp - 0x28], 0xa4
mov byte [ebp - 0x27], 0xc8
mov byte [ebp - 0x26], 0x28
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x5b
mov byte [ebp - 0x23], 0xd4
mov byte [ebp - 0x22], 0x32
mov byte [ebp - 0x21], 0xa5
mov byte [ebp - 0x20], 0x6b
mov byte [ebp - 0x1f], 0x1e
mov byte [ebp - 0x1e], 0x79
mov byte [ebp - 0x1d], 0x19
mov byte [ebp - 0x1c], 0xe3
mov byte [ebp - 0x1b], 0xa1
mov byte [ebp - 0x1a], 0xe9
mov byte [ebp - 0x19], 0xdb
mov byte [ebp - 0x18], 0xff
mov byte [ebp - 0x17], 0x4a
mov byte [ebp - 0x16], 0x8d
mov byte [ebp - 0x15], 0xa
mov byte [ebp - 0x14], 0xb5
mov byte [ebp - 0x13], 0xfd
mov byte [ebp - 0x12], 0xcf
mov byte [ebp - 0x11], 0xb4
mov byte [ebp - 0x10], 0xa0
mov byte [ebp - 0xf], 0x25
mov byte [ebp - 0xe], 0x84
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 7
mov byte [ebp - 0xb], 0x5c
mov byte [ebp - 0xa], 0x77
mov byte [ebp - 9], 7
mov byte [ebp - 8], 0x5e
mov byte [ebp - 7], 0x43
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0xfa
mov dword [ebp - 0x68], edi
call fcn.0101c24b
test eax, eax
jne 0x1026f6d
cmp dword [ebp - 0x64], 3
jne 0x1026f6d
cmp byte [ebp - 0x54], 0x87
jne 0x1026f6d
cmp byte [ebp - 0x53], 0x11
jne 0x1026f6d
cmp byte [ebp - 0x52], bl
jne 0x1026f6d
cmp byte [ebp - 0x51], bl
jne 0x1026f6d
cmp byte [ebp - 0x50], bl
jne 0x1026f6d
cmp byte [ebp - 0x4f], bl
jne 0x1026f6d
cmp byte [ebp - 0x4e], 8
jne 0x1026f6d
cmp byte [ebp - 0x4d], bl
jne 0x1026f6d
push 8
lea eax, [ebp - 0x5c]
push eax
push 3
push ebx
push esi
push dword [ebp - 0x60]
call fcn.0101c11a
push 0x30
lea eax, [ebp - 0x34]
push eax
push 3
push ebx
push 0x10052d8
push dword [ebp - 0x60]
call fcn.0101c11a
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x60]
push eax
push 0x20007
push ebx
push 0x10052bc
push dword [ebp - 0x6c]
call fcn.0101c02d
test eax, eax
jne 0x1027092
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push esi
push dword [ebp - 0x60]
mov byte [ebp - 0x24], 0x39
mov byte [ebp - 0x23], 0x18
mov byte [ebp - 0x22], 0x43
mov byte [ebp - 0x21], 0x6a
mov byte [ebp - 0x20], 0x40
mov byte [ebp - 0x1f], 0x94
mov byte [ebp - 0x1e], 0xda
mov byte [ebp - 0x1d], 0xa9
mov byte [ebp - 0x1c], 0xf5
mov byte [ebp - 0x1b], 0xd3
mov byte [ebp - 0x1a], 0xd
mov byte [ebp - 0x19], 0x6b
mov byte [ebp - 0x18], 0xc2
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x66
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0xff
mov byte [ebp - 0x12], 0x3c
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xf], 0xcd
mov byte [ebp - 0xe], 0x26
mov byte [ebp - 0xd], 0x15
mov byte [ebp - 0xc], 0xc1
mov byte [ebp - 0xb], 0x24
mov byte [ebp - 0xa], 0xa1
mov byte [ebp - 9], 0xa1
mov byte [ebp - 8], 0x75
mov byte [ebp - 7], 0x2f
mov byte [ebp - 6], 0x4c
mov byte [ebp - 5], 0x1b
mov dword [ebp - 0x68], edi
call fcn.0101c24b
test eax, eax
jne 0x1027089
cmp dword [ebp - 0x64], 3
jne 0x1027089
cmp byte [ebp - 0x54], 0x87
jne 0x1027089
cmp byte [ebp - 0x53], 0x11
jne 0x1027089
cmp byte [ebp - 0x52], bl
jne 0x1027089
cmp byte [ebp - 0x51], bl
jne 0x1027089
cmp byte [ebp - 0x50], bl
jne 0x1027089
cmp byte [ebp - 0x4f], bl
jne 0x1027089
cmp byte [ebp - 0x4e], 8
jne 0x1027089
cmp byte [ebp - 0x4d], bl
jne 0x1027089
push 8
lea eax, [ebp - 0x5c]
push eax
push 3
push ebx
push esi
push dword [ebp - 0x60]
call fcn.0101c11a
push edi
lea eax, [ebp - 0x24]
push eax
push 3
push ebx
push 0x10052d8
push dword [ebp - 0x60]
call fcn.0101c11a
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x60]
push eax
push 0x20007
push ebx
push 0x1001d8c
push dword [ebp - 0x6c]
call fcn.0101c02d
test eax, eax
jne 0x1027170
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push esi
push dword [ebp - 0x60]
mov byte [ebp - 0x14], 0xc1
mov byte [ebp - 0x13], 0x3a
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 0x11], 0xe7
mov byte [ebp - 0x10], 0xa7
mov byte [ebp - 0xf], 0x23
mov byte [ebp - 0xe], 0x1d
mov byte [ebp - 0xd], 0xeb
mov byte [ebp - 0xc], 0x4b
mov byte [ebp - 0xb], 6
mov byte [ebp - 0xa], 0xfd
mov byte [ebp - 9], 0x8f
mov byte [ebp - 8], 0x9a
mov byte [ebp - 7], 0x4c
mov byte [ebp - 6], 0xa9
mov byte [ebp - 5], 0xde
mov dword [ebp - 0x68], edi
call fcn.0101c24b
test eax, eax
jne 0x1027167
cmp dword [ebp - 0x64], 3
jne 0x1027167
cmp byte [ebp - 0x54], 0x87
jne 0x1027167
cmp byte [ebp - 0x53], 0x11
jne 0x1027167
cmp byte [ebp - 0x52], bl
jne 0x1027167
cmp byte [ebp - 0x51], bl
jne 0x1027167
cmp byte [ebp - 0x50], bl
jne 0x1027167
cmp byte [ebp - 0x4f], bl
jne 0x1027167
cmp byte [ebp - 0x4e], 8
jne 0x1027167
cmp byte [ebp - 0x4d], bl
jne 0x1027167
push 8
lea eax, [ebp - 0x5c]
push eax
push 3
push ebx
push esi
push dword [ebp - 0x60]
call fcn.0101c11a
push 0x10
lea eax, [ebp - 0x14]
push eax
push 3
push ebx
push 0x10052d8
push dword [ebp - 0x60]
call fcn.0101c11a
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x60]
push eax
push 0x20007
push ebx
push 0x10052a0
push dword [ebp - 0x6c]
call fcn.0101c02d
test eax, eax
jne 0x102724e
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push esi
push dword [ebp - 0x60]
mov byte [ebp - 0x14], 0x7d
mov byte [ebp - 0x13], 0x7c
mov byte [ebp - 0x12], 0x9a
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xf], 0xa8
mov byte [ebp - 0xe], 0xd1
mov byte [ebp - 0xd], 0xf
mov byte [ebp - 0xc], 0xfc
mov byte [ebp - 0xb], 0x47
mov byte [ebp - 0xa], pe_nt_image_headers32
mov byte [ebp - 9], 0x8f
mov byte [ebp - 8], 0xf8
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x85
mov byte [ebp - 5], 0xfc
mov dword [ebp - 0x68], edi
call fcn.0101c24b
test eax, eax
jne 0x1027245
cmp dword [ebp - 0x64], 3
jne 0x1027245
cmp byte [ebp - 0x54], 0x87
jne 0x1027245
cmp byte [ebp - 0x53], 0x11
jne 0x1027245
cmp byte [ebp - 0x52], bl
jne 0x1027245
cmp byte [ebp - 0x51], bl
jne 0x1027245
cmp byte [ebp - 0x50], bl
jne 0x1027245
cmp byte [ebp - 0x4f], bl
jne 0x1027245
cmp byte [ebp - 0x4e], 8
jne 0x1027245
cmp byte [ebp - 0x4d], bl
jne 0x1027245
push 8
lea eax, [ebp - 0x5c]
push eax
push 3
push ebx
push esi
push dword [ebp - 0x60]
call fcn.0101c11a
push 0x10
lea eax, [ebp - 0x14]
push eax
push 3
push ebx
push 0x10052d8
push dword [ebp - 0x60]
call fcn.0101c11a
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01018732
leave
ret