Function at 0x1006ae20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x250
mov eax, dword [0x102ca474]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebp
mov ebp, dword [esp + 0x258]
mov dword [esp + 0x1c], ebp
push esi
mov esi, dword [esp + 0x260]
push edi
mov edi, dword [esp + 0x268]
mov dword [esp + 0x20], edi
test ebp, ebp
je 0x1006b27b
mov eax, dword [ecx]
test eax, eax
je 0x1006b27b
push ebx
push str.RegQueryValueExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov dword [esp + 0x2c], ebx
test ebx, ebx
je 0x1006b27a
push 0x208
lea eax, [esp + 0x58]
push 0
push eax
call fcn.101ffde0
add esp, 0xc
mov dword [esp + 0x30], 0x208
lea eax, [esp + 0x30]
mov ecx, esi
push eax
lea eax, [esp + 0x58]
push eax
push 0
push 0
call fcn.10008714
push eax
push ebp
call ebx
lea eax, [esp + 0x54]
push eax
lea ebp, [edi + 0x38]
call fcn.10005f42
add esp, 4
mov ecx, ebp
mov ebx, eax
call fcn.10005e30
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x14], eax
cmp ebx, eax
ja 0x1006af12
mov esi, edi
cmp eax, 8
jb 0x1006aee5
mov esi, dword [edi]
push ebx
lea eax, [esp + 0x58]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10005f10
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
add esp, 0x14
jmp 0x1006b054
mov ecx, ebp
call fcn.1000608d
cmp ebx, eax
ja 0x1006b295
mov ecx, ebp
call fcn.1000608d
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [esp + 0x1c], ecx
cmp ecx, esi
ja 0x1006af68
mov ecx, ebp
call fcn.10005e30
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1006af68
lea eax, [ecx + edx]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.10005ed6
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x1006af7a
or ecx, 0xffffffff
jmp 0x1006af82
cmp ecx, 0x1000
jb 0x1006afad
lea eax, [ecx + 0x23]
cmp eax, ecx
mov ecx, 0xffffffff
cmovbe eax, ecx
push eax
call fcn.101e74f1
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1006b29a
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1006afbe
test ecx, ecx
je 0x1006afbc
push ecx
call fcn.101e74f1
add esp, 4
jmp 0x1006afbe
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x54]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.10005f29
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
mov ecx, dword [esp + 0x28]
add esp, 0x14
cmp ecx, 8
jb 0x1006b033
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1006b021
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006b29a
mov eax, edx
push ecx
push eax
call fcn.101e74c0
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x1006b054
lea eax, [esp + 0x10]
push eax
call fcn.10005f6e
push edi
mov esi, eax
call fcn.10005f6e
push eax
push 4
call fcn.10005b84
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x208
push eax
lea eax, [esp + 0x58]
push eax
push 0
push 0
push str.Profile
push dword [esp + 0x3c]
call dword [esp + 0x44]
mov ebp, dword [esp + 0x24]
lea eax, [esp + 0x54]
push eax
add ebp, 0x50
call fcn.10005f42
add esp, 4
mov ecx, ebp
mov ebx, eax
call fcn.10005e30
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x18], eax
cmp ebx, eax
ja 0x1006b0d7
mov esi, edi
cmp eax, 8
jb 0x1006b0aa
mov esi, dword [edi]
push ebx
lea eax, [esp + 0x58]
mov dword [edi + 0x10], ebx
push eax
push esi
call fcn.10005f10
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
add esp, 0x14
jmp 0x1006b219
mov ecx, ebp
call fcn.1000608d
cmp ebx, eax
ja 0x1006b29f
mov ecx, ebp
call fcn.1000608d
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [esp + 0x20], ecx
cmp ecx, esi
ja 0x1006b12d
mov ecx, ebp
call fcn.10005e30
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1006b12d
lea eax, [ecx + edx]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.10005ed6
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x1006b13f
or ecx, 0xffffffff
jmp 0x1006b147
cmp ecx, 0x1000
jb 0x1006b172
lea eax, [ecx + 0x23]
cmp eax, ecx
mov ecx, 0xffffffff
cmovbe eax, ecx
push eax
call fcn.101e74f1
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1006b29a
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1006b183
test ecx, ecx
je 0x1006b181
push ecx
call fcn.101e74f1
add esp, 4
jmp 0x1006b183
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x54]
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.10005f29
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
mov ecx, dword [esp + 0x2c]
add esp, 0x14
cmp ecx, 8
jb 0x1006b1f8
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x1006b1e6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006b29a
mov eax, edx
push ecx
push eax
call fcn.101e74c0
mov eax, dword [esp + 0x18]
add esp, 8
mov dword [edi], eax
jmp 0x1006b219
lea eax, [esp + 0x10]
push eax
call fcn.10005f6e
push edi
mov esi, eax
call fcn.10005f6e
push eax
push 4
call fcn.10005b84
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
xor eax, eax
mov dword [esp + 0x34], 0x65004b
mov word [esp + 0x50], ax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], 0x620079
push 0
push 0
push eax
push dword [esp + 0x3c]
mov dword [esp + 0x54], 0x61006f
mov dword [esp + 0x58], 0x640072
mov dword [esp + 0x5c], 0x61004c
mov dword [esp + 0x60], 0x6f0079
mov dword [esp + 0x64], 0x740075
mov dword [esp + 0x48], 4
call dword [esp + 0x44]
pop ebx
mov ecx, dword [esp + 0x258]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.101e7040
add esp, 0x250
ret 0xc
call fcn.1000604b
call fcn.102086be
call fcn.1000604b
int3