Function at 0x1003d720
Capabilities:
Encode data using xor
Query or enumerate registry key

Disassembly:
mov eax, 0x1005c202
call fcn.1005a9e0
sub esp, 0x84
cmp byte [ebp + 0x30], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
je 0x1003d7ff
cmp byte [ebp + 0x10], 0
je 0x1003d7ce
sub esp, 0x18
mov ecx, esp
push dword [ebp + 8]
call fcn.100185ae
lea ecx, [ebp - 0x48]
call fcn.1003d1d6
add esp, 0x18
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x48], eax
je 0x1003d7c7
push dword [ebp + 0x30]
xor ecx, ecx
mov dword [ebp - 0x4c], 7
push eax
push dword [ebp - 0x48]
mov word [ebp - 0x60], cx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x50], ebx
call fcn.10019a2e
mov ecx, dword [ebp + 0x28]
lea edx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.1003d5e3
lea ecx, [ebp - 0x60]
push ebx
push 1
test eax, eax
jns 0x1003d7c2
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
call fcn.10018a82
lea ecx, [ebp - 0x48]
call fcn.10039619
jmp 0x1003da4d
call fcn.10018a82
mov eax, dword [ebp + 0x14]
mov byte [eax], bl
jmp 0x1003d7b5
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x34]
push ecx
lea ecx, [ebp - 0x78]
imul edx, dword [edi], 0x18
add edx, dword [esi]
call fcn.10039ece
pop ecx
imul ecx, dword [edi], 0x18
push eax
add ecx, dword [esi]
call fcn.1001c3f4
push 0
push 1
lea ecx, [ebp - 0x78]
call fcn.10018a82
jmp 0x1003da4d
test dl, dl
je 0x1003d99e
mov edx, dword [ebp + 0x20]
lea ecx, [ebp - 0x3c]
xor ebx, ebx
mov dword [ebp - 0x20], ebx
call fcn.1003cef5
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 2
call fcn.1003cef5
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x30]
sar eax, 2
sar ecx, 2
cmp eax, ecx
mov dword [ebp + 0x30], ebx
lea eax, [ebp + 0x30]
jbe 0x1003d903
push ecx
push eax
push ecx
lea eax, [ebp - 0x3c]
mov cl, 1
push eax
call fcn.1003d595
lea eax, [ebp - 0x1c]
mov edx, 0x3dbc
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push 1
lea ecx, [ebp + 0x30]
call fcn.1003dff2
mov dword [ebp - 0x18], 0x51c3
add esp, 0x20
cmp dword [ebp - 0x18], 0x54e9
jle 0x1003d8c4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10076818
xor eax, esi
cdq
push edx
push eax
call fcn.10001a30
inc edi
cmp edi, 0x1dd4
jl 0x1003d898
inc esi
cmp esi, 0x63d2
jl 0x1003d896
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov byte [ebp - 4], 4
cmp dword [ebp - 0x18], 0x4f50
jge 0x1003d8e0
mov edx, str.qydhxs_znjchger_xsy_wloplbj_ejxmgim_jfg_hxjdeec_qqhlm_rgyjglxj_tqaypjh
mov ecx, 0x10076818
call fcn.1000349f
mov dword [ebp - 4], 3
jmp 0x1003d95c
push 0x40a7
push ebx
push eax
push 0x693c
push 0xaf5
push 0x134f
lea eax, [ebp - 0x30]
xor dl, dl
push eax
push 0x5faa
push 0x5d9c
push 1
push 0x7626
push 0x512
mov ecx, 0x3975
call fcn.1003d720
add esp, 0x24
lea eax, [ebp - 0x3c]
mov edx, 0x2438
lea ecx, [ebp + 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.1003e2e6
add esp, 0x18
push 1
lea eax, [ebp + 0x30]
mov edx, 0x6352
push eax
lea eax, [ebp - 0x3c]
mov cl, 1
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1003d4f6
mov ecx, dword [ebp + 0x24]
add esp, 0x18
mov eax, dword [ebp - 0x20]
mov dword [ecx], eax
lea ecx, [ebp - 0x30]
call fcn.1003f3f2
lea ecx, [ebp - 0x3c]
call fcn.1003f3f2
jmp 0x1003da4d
mov dword [ebp - 0x24], 0x6403
cmp dword [ebp - 0x24], 0x6545
jle 0x1003da29
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp + 0x30], esi
mov dword [ebp - 0x20], 0x70a6
mov edi, dword [ebp + 0x30]
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x90]
cdq
push edx
push eax
call fcn.10003aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003d9e5
mov eax, dword [eax]
push eax
call fcn.100445e8
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x90]
call fcn.10001e5d
inc esi
cmp esi, 0x1ff1
jl 0x1003d9c7
mov edi, dword [ebp - 0x1c]
add dword [ebp + 0x30], edi
dec dword [ebp - 0x20]
jne 0x1003d9c2
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x5eed
jl 0x1003d9b8
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3f0f
jl 0x1003d9b5
cmp dword [ebp - 0x24], 0x62e9
jge 0x1003da3d
push str.pcxcbstwm_jiwbarpao_ghedpknle_nmfd_dyxgbwm_kkwph
call fcn.100445e8
pop ecx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0x2c]
sar ecx, 2
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret