Function at 0x100441e6
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov eax, 0x10066373
call fcn.10064328
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x18], cl
test cl, cl
je 0x1004428f
mov dword [ebp - 0x1c], 0x137d
cmp dword [ebp - 0x1c], 0x1492
jle 0x10044240
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10081bf8
xor eax, esi
cdq
push edx
push eax
call fcn.1000377e
inc edi
cmp edi, 0x2862
jl 0x1004421d
inc esi
cmp esi, 0x576d
jl 0x1004421b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10044255
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x10cf
jge 0x10044270
mov edx, str.kldmwjc_qsg_eyo_lcojcj_qnbhfqi_kbezjbz_jsqyx_mwgiqcurj_dglag_dghcx_xtsgu_jnmst
mov ecx, 0x10081bf8
call fcn.100059cc
jmp 0x100443f4
mov dword [ebp - 0x28], 0x62d3
cmp dword [ebp - 0x28], 0x64d5
jle 0x100442f7
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0x5d9a
mov esi, ebx
mov ebx, dword [ebp - 0x1c]
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10081bf8
or eax, edi
cdq
push edx
push eax
call fcn.1000377e
inc esi
cmp esi, 0x6685
jl 0x100442b5
dec ebx
dec dword [ebp - 0x20]
push 0
mov dword [ebp - 0x1c], ebx
pop ebx
jne 0x100442b0
mov esi, dword [ebp - 0x24]
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x17bb
jl 0x100442a6
inc edi
cmp edi, 0x6b2c
jl 0x100442a1
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x6058
jge 0x10044334
mov edx, str.mrkoch_znquxmv_qzp_kmzvbln_gnhcnwu_svxssmm_igzotlnu_wijfqdgjm_yqdw_yghpxhr
mov ecx, 0x10081bf8
call fcn.100059cc
jmp 0x10044334
mov ecx, dword [ebp + 0x24]
xor esi, esi
mov edi, dword [ebp + 0x1c]
inc esi
mov eax, dword [ecx]
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, esi
mov esi, dword [ebp + 0x2c]
sete cl
xor eax, eax
cmp ecx, edx
setge al
xor ecx, ecx
cmp eax, edx
setle cl
cmp dword [esi], ecx
jl 0x10044370
mov eax, dword [edi]
cmp dword [eax + 4], ebx
je 0x10044370
xor ecx, ecx
lea eax, [ecx + 1]
jmp 0x10044372
mov eax, ebx
xor edx, edx
cmp eax, 0xffffffff
mov eax, dword [esi]
mov esi, dword [ebp - 0x2c]
setle dl
imul edx, eax
xor ecx, ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [esi]
setg cl
mov dword [eax], ecx
xor eax, eax
inc eax
cmp eax, ecx
mov eax, dword [ebp + 0x2c]
sbb ecx, ecx
xor edx, edx
neg ecx
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp + 0x24]
setg dl
xor ecx, ecx
mov eax, dword [eax]
cmp eax, edx
mov edx, dword [ebp + 8]
setne cl
mov eax, dword [edx]
sub ecx, eax
jne 0x100443c8
mov eax, dword [edi]
cmp dword [eax], ebx
jne 0x100443c8
mov eax, dword [esi]
cmp dword [eax], ebx
je 0x100443cd
xor eax, eax
lea ebx, [eax + 1]
mov eax, dword [edx]
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp + 0xc]
sete cl
mov dword [eax], ecx
mov ecx, dword [eax]
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov dword [eax + 8], ecx
xor ecx, ecx
mov eax, dword [ebp + 0x2c]
inc ecx
mov eax, dword [eax]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret