Function at 0x1c7e6d0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x1120
call fcn.01cb35d0
mov edi, dword [ebp + 8]
mov eax, dword [0x1d01324]
xor eax, ebp
mov dword [esp + 0x1118], eax
test edi, edi
je 0x1c7ebe5
cmp dword [ebp + 0xc], 0x20
jl 0x1c7ebe5
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x400
lea esi, [esp + 0x10]
push 0x400
push 0
push esi
call fcn.01cb76e0
add esp, 0xc
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push esi
push ecx
push 0x1cea351
push str.Software360SafeLiveup
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1c7e962
push esi
call fcn.01ccdb20
add esp, 4
cmp eax, 0x40
jne 0x1c7e962
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x1100], xmm0
movdqa xmmword [esp + 0x10f0], xmm0
movdqa xmmword [esp + 0x10e0], xmm0
movdqa xmmword [esp + 0x10d0], xmm0
movdqa xmmword [esp + 0x10c0], xmm0
movdqa xmmword [esp + 0x10b0], xmm0
movdqa xmmword [esp + 0x10a0], xmm0
movdqa xmmword [esp + 0x1090], xmm0
movdqa xmmword [esp + 0x1080], xmm0
movdqa xmmword [esp + 0x1070], xmm0
movdqa xmmword [esp + 0x1060], xmm0
movdqa xmmword [esp + 0x1050], xmm0
movdqa xmmword [esp + 0x1040], xmm0
movdqa xmmword [esp + 0x1030], xmm0
movdqa xmmword [esp + 0x1020], xmm0
movdqa xmmword [esp + 0x1010], xmm0
mov eax, 0x80
xor ecx, ecx
nop
movzx edx, byte [esp + ecx + 0x10]
test dl, dl
je 0x1c7e856
mov byte [esp + ecx + 0x1090], dl
movzx edx, byte [esp + ecx + 0x11]
test dl, dl
je 0x1c7e860
mov byte [esp + ecx + 0x1091], dl
movzx edx, byte [esp + ecx + 0x12]
test dl, dl
je 0x1c7e86a
mov byte [esp + ecx + 0x1092], dl
movzx edx, byte [esp + ecx + 0x13]
test dl, dl
je 0x1c7e874
mov byte [esp + ecx + 0x1093], dl
add eax, 0xfffffffc
add ecx, 4
cmp ecx, 0x20
jne 0x1c7e800
lea edx, [esp + ecx]
add edx, 0x1090
jmp 0x1c7e889
add ecx, esp
add ecx, 0x1090
jmp 0x1c7e881
add ecx, esp
add ecx, 0x1091
jmp 0x1c7e87c
add ecx, esp
add ecx, 0x1092
jmp 0x1c7e87c
add ecx, esp
add ecx, 0x1093
mov eax, 1
lea edx, [ecx - 1]
test eax, eax
cmovne edx, ecx
mov byte [edx], 0
mov ecx, 0x80
xor edx, edx
lea eax, [esp + 0x108f]
nop word [eax + eax]
movzx ebx, byte [esp + edx + 0x30]
test bl, bl
je 0x1c7e8f0
mov byte [esp + edx + 0x1010], bl
movzx ebx, byte [esp + edx + 0x31]
test bl, bl
je 0x1c7e8fa
mov byte [esp + edx + 0x1011], bl
movzx ebx, byte [esp + edx + 0x32]
test bl, bl
je 0x1c7e904
mov byte [esp + edx + 0x1012], bl
movzx ebx, byte [esp + edx + 0x33]
test bl, bl
je 0x1c7e90e
mov byte [esp + edx + 0x1013], bl
add ecx, 0xfffffffc
add edx, 4
cmp edx, 0x80
jne 0x1c7e8a0
jmp 0x1c7e922
lea eax, [esp + edx]
add eax, 0x1010
jmp 0x1c7e91b
lea eax, [esp + edx]
add eax, 0x1011
jmp 0x1c7e916
lea eax, [esp + edx]
add eax, 0x1012
jmp 0x1c7e916
lea eax, [esp + edx]
add eax, 0x1013
mov ecx, 1
test ecx, ecx
jne 0x1c7e922
add eax, 0xffffffff
mov byte [eax], 0
push 0x400
push 0
push esi
call fcn.01cb76e0
add esp, 0xc
lea ecx, [esp + 0x1090]
mov edx, esi
push 0x400
call fcn.01c7e510
add esp, 4
lea eax, [esp + 0x1010]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1c7ebfb
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10e0], xmm0
movdqa xmmword [esp + 0x10d0], xmm0
movdqa xmmword [esp + 0x10c0], xmm0
movdqa xmmword [esp + 0x10b0], xmm0
movdqa xmmword [esp + 0x10a0], xmm0
movdqa xmmword [esp + 0x1090], xmm0
mov dword [esp + 0x10f0], 0xffffffff
push 0x1000
push 0
push esi
call fcn.01cb76e0
add esp, 0xc
push 0x1000
push esi
call fcn.01c7e460
add esp, 8
lea edi, [esp + 0x1090]
push 0x64
push edi
call fcn.01c7cfb0
add esp, 8
test al, al
jne 0x1c7ea0c
push 0x64
push edi
call fcn.01c7d310
add esp, 8
test al, al
jne 0x1c7ea0c
push 0x64
push edi
call fcn.01c7d790
add esp, 8
test al, al
jne 0x1c7ea0c
push 0x64
push edi
call fcn.01c7d9a0
add esp, 8
test al, al
je 0x1c7eaeb
push edi
call fcn.01ccdb20
add esp, 4
test eax, eax
je 0x1c7ea37
nop dword [eax]
cmp byte [esp + eax + 0x108f], 0x20
jne 0x1c7ea37
mov byte [esp + eax + 0x108f], 0
add eax, 0xffffffff
jne 0x1c7ea20
mov ecx, 0xfffff000
mov eax, 0xffd
nop word cs:[eax + eax]
nop dword [eax + eax]
cmp byte [esp + ecx + 0x1010], 0
je 0x1c7ea82
cmp byte [esp + ecx + 0x1011], 0
je 0x1c7ea88
cmp byte [esp + ecx + 0x1012], 0
je 0x1c7ea8d
cmp byte [esp + ecx + 0x1013], 0
je 0x1c7ea90
add eax, 0xfffffffc
add ecx, 4
jne 0x1c7ea50
jmp 0x1c7eaeb
neg ecx
mov eax, ecx
jmp 0x1c7ea90
add eax, 2
jmp 0x1c7ea90
add eax, 1
mov ecx, 0x1000
sub ecx, eax
mov edi, esi
add esi, ecx
add esi, 0xfffff000
xor edx, edx
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, byte [esp + edx + 0x1090]
test bl, bl
je 0x1c7ead0
mov byte [esi + edx + 0x1000], bl
add edx, 1
cmp eax, edx
jne 0x1c7eab0
mov esi, edi
add ecx, edi
jmp 0x1c7ead8
mov esi, edi
add ecx, edi
cmp eax, edx
jne 0x1c7eadf
add ecx, edx
add ecx, 0xffffffff
jmp 0x1c7eae1
add ecx, edx
lea edi, [esp + 0x1090]
mov byte [ecx], 0
push 0x64
push edi
call fcn.01c7dc50
add esp, 8
test al, al
jne 0x1c7eb0d
push 0x64
push edi
call fcn.01c7e100
add esp, 8
test al, al
je 0x1c7ebb0
mov ecx, 0xfffff000
mov eax, 0xffd
nop word [eax + eax]
cmp byte [esp + ecx + 0x1010], 0
je 0x1c7eb52
cmp byte [esp + ecx + 0x1011], 0
je 0x1c7eb58
cmp byte [esp + ecx + 0x1012], 0
je 0x1c7eb5d
cmp byte [esp + ecx + 0x1013], 0
je 0x1c7eb60
add eax, 0xfffffffc
add ecx, 4
jne 0x1c7eb20
jmp 0x1c7ebb0
neg ecx
mov eax, ecx
jmp 0x1c7eb60
add eax, 2
jmp 0x1c7eb60
add eax, 1
mov ecx, 0x1000
sub ecx, eax
mov edi, esi
add esi, ecx
add esi, 0xfffff000
xor edx, edx
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, byte [esp + edx + 0x1090]
test bl, bl
je 0x1c7eb9e
mov byte [esi + edx + 0x1000], bl
add edx, 1
cmp eax, edx
jne 0x1c7eb80
add ecx, edi
jmp 0x1c7eba4
add ecx, edi
cmp eax, edx
jne 0x1c7ebab
add ecx, edx
add ecx, 0xffffffff
jmp 0x1c7ebad
add ecx, edx
mov byte [ecx], 0
cmp byte [esp + 0x10], 0
jne 0x1c7ebd3
mov dword [esp + 0x10], 0x3264694d
mov dword [esp + 0x14], 0x6c696146
mov word [esp + 0x18], 0x6465
mov byte [esp + 0x1a], 0
lea ecx, [esp + 0x10]
mov edx, dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.01c7e510
add esp, 4
mov ecx, dword [esp + 0x1118]
xor ecx, ebp
call fcn.01cb3141
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jle 0x1c7ec3d
lea ecx, [ebx - 1]
xor eax, eax
mov esi, ecx
sub esi, 0x7ffffffd
mov edx, 0x7ffffffd
cmovb edx, ecx
cmovb esi, eax
add edx, 1
nop dword [eax]
movzx ecx, byte [esp + eax + 0x1090]
test cl, cl
je 0x1c7ec4b
mov byte [edi + eax], cl
add ebx, 0xffffffff
add eax, 1
cmp edx, eax
jne 0x1c7ec20
add eax, edi
jmp 0x1c7ec4f
je 0x1c7e962
mov byte [edi], 0
jmp 0x1c7e962
add eax, edi
mov esi, ebx
lea ecx, [eax - 1]
test esi, esi
cmovne ecx, eax
mov byte [ecx], 0
lea esi, [esp + 0x10]
jne 0x1c7ebe5
jmp 0x1c7e962