Function at 0x10004f30
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x1003e030]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x111
lea eax, [ebp - 0x340]
mov edi, ecx
push 0
push eax
mov dword [ebp - 0x350], edi
call fcn.10019d00
push 0x208
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x364], 0
push 0
push eax
mov dword [ebp - 0x35c], 0
call fcn.10019d00
add esp, 0x18
cmp dword [0x10041d90], 0
jne 0x10004fa6
mov eax, 0x15
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100184e9
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x10004fbc
lea eax, [edi + 0x57]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100184e9
mov esp, ebp
pop ebp
ret
cmp dword [0x100421b8], 1
push esi
mov esi, 0x10041d94
jne 0x1000511b
cmp dword [0x100421a8], 2
jne 0x10005140
lea eax, [ebp - 0x34c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareAhnLabACA
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34c], esi
mov dword [ebp - 0x348], esi
mov dword [ebp - 0x344], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100050ff
mov eax, dword [ebp - 0x34c]
test eax, eax
je 0x1000515d
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x348]
mov dword [ebp - 0x344], 4
push ecx
push esi
push esi
push str.DebugLog
push eax
call edi
test eax, eax
jne 0x100050f9
cmp dword [ebp - 0x348], 1
jne 0x100050f9
lea eax, [ebp - 0x344]
mov dword [ebp - 0x344], 0x103
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
push esi
push str.DebugLogPath
push dword [ebp - 0x34c]
call edi
test eax, eax
jne 0x100050b6
push 0x5c
push 0x10041d94
call fcn.1001a8d0
add esp, 8
test eax, eax
je 0x100050f9
cmp byte [eax + 1], 0
je 0x100050f9
push eax
lea ecx, [ebp - 0x22c]
call fcn.100048b0
test eax, eax
js 0x100050f9
jmp 0x100050f4
lea ecx, [ebp - 0x22c]
mov esi, 0x10041d94
mov eax, ecx
mov edx, 0x104
sub esi, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x100050e9
mov al, byte [esi + ecx]
test al, al
je 0x100050e9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x100050d0
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
mov esi, 1
mov edi, dword [ebp - 0x350]
mov eax, dword [ebp - 0x34c]
test eax, eax
je 0x10005110
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 1
jne 0x1000515d
lea esi, [ebp - 0x22c]
mov eax, dword [0x100421dc]
cmp eax, 1
je 0x1000518a
cmp eax, 2
jne 0x1000516f
cmp dword [0x100421f8], 1
jne 0x1000518a
push 0x100421e0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x1000518a
push 0x104
lea edx, [ebp - 0x22c]
mov ecx, 0x10041d94
call fcn.10007160
add esp, 4
cmp eax, 1
jmp 0x10005113
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100184e9
mov esp, ebp
pop ebp
ret
cmp dword [0x100421dc], 3
jne 0x1000518a
mov eax, dword [0x100421fc]
test eax, eax
je 0x1000518a
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x10041d90], 0
jne 0x1000519d
mov edi, 0x15
jmp 0x10005532
cmp dword [0x100421a8], 2
lea edx, [ebp - 0x35c]
mov ecx, esi
jne 0x100051b5
call fcn.10005cd0
jmp 0x100051ba
call fcn.10005a20
mov dword [ebp - 0x34c], eax
cmp eax, 0xffffffff
jne 0x100051dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x10005532
lea edi, [eax + 0x6e]
jmp 0x10005532
mov ecx, 0x800
mov eax, edi
cmp word [eax], 0
je 0x100051f2
add eax, 2
sub ecx, 1
jne 0x100051e4
mov eax, 0x800
mov edi, ecx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x100054c1
test edi, edi
je 0x100054c1
cmp edi, 0x800
mov dword [ebp - 0x344], 0
mov eax, 0x7ff
cmovae edi, eax
mov eax, dword [0x100421d4]
cmp eax, 9
je 0x1000523d
cmp eax, 0xc
je 0x1000523d
cmp eax, 8
jne 0x10005247
mov dword [ebp - 0x344], 0x3f
push 0
push 0
push 0xfc
lea eax, [ebp - 0x340]
push eax
push edi
push dword [ebp - 0x350]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jne 0x10005397
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x348], eax
cmp eax, 0x7a
je 0x100052a0
mov esi, dword [ebp - 0x34c]
mov edi, eax
test edi, edi
jne 0x100054d4
mov edi, 0x54f
jmp 0x100054d4
push 0
push 0
push 0
push 0
push edi
push dword [ebp - 0x350]
mov dword [ebp - 0x348], 0x57
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jne 0x100052d9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x100054ce
mov ecx, dword [ebp - 0x344]
mov eax, esi
cdq
idiv ecx
mov dword [ebp - 0x358], esi
test edx, edx
je 0x100052f4
mov eax, ecx
sub eax, edx
add esi, eax
add esi, 0x10
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x360], esi
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.1001ebae
add esp, 4
mov dword [ebp - 0x354], eax
test eax, eax
je 0x100054c8
lea ecx, [esi + 1]
push ecx
push 0
push eax
call fcn.10019d00
add esp, 0xc
mov dword [ebp - 0x364], 1
push 0
push 0
push esi
push dword [ebp - 0x354]
push edi
push dword [ebp - 0x350]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 0x358], eax
je 0x100053cd
mov edi, dword [ebp - 0x348]
mov esi, dword [ebp - 0x34c]
mov eax, dword [ebp - 0x354]
test eax, eax
je 0x100054d4
cmp dword [ebp - 0x364], 1
jne 0x100054d4
push eax
call fcn.1001c433
add esp, 4
jmp 0x100054d4
mov ecx, dword [ebp - 0x344]
lea eax, [ebp - 0x340]
mov dword [ebp - 0x354], eax
mov eax, esi
cdq
idiv ecx
test edx, edx
je 0x100053c4
mov eax, ecx
sub eax, edx
add esi, eax
cmp esi, 0x100
jg 0x100054b7
add esi, 0x10
mov dword [ebp - 0x360], esi
movups xmm0, xmmword [0x10042200]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x358], 4
mov dword [ebp - 0x350], eax
movups xmmword [ebp - 0x24], xmm0
movups xmm0, xmmword [0x10042210]
movups xmmword [ebp - 0x14], xmm0
mov esi, dword [eax]
mov edx, 0x2898bd67
mov edi, dword [eax + 4]
mov dword [ebp - 0x348], 0x1f
nop word [eax + eax]
mov ecx, esi
mov eax, esi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, edx
shr eax, 0xd
add ecx, esi
and eax, 3
mov eax, dword [eax*4 + 0x10039220]
add eax, edx
add edx, 0x61c98647
xor ecx, eax
sub edi, ecx
mov ecx, edi
mov eax, edi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, edx
and eax, 3
add ecx, edi
mov eax, dword [eax*4 + 0x10039220]
add eax, edx
xor ecx, eax
sub esi, ecx
sub dword [ebp - 0x348], 1
jne 0x10005410
mov eax, dword [ebp - 0x350]
mov dword [eax], esi
mov dword [eax + 4], edi
add eax, 8
sub dword [ebp - 0x358], 1
mov dword [ebp - 0x350], eax
jne 0x100053f6
push dword [ebp - 0x344]
mov esi, dword [ebp - 0x34c]
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x354]
push ecx
push eax
push dword [0x100421d4]
mov ecx, esi
push dword [ebp - 0x360]
call fcn.100055a0
add esp, 0x14
mov edi, eax
jmp 0x1000536e
mov edi, 0x57
jmp 0x10005368
mov edi, 0x57
jmp 0x100054ce
mov edi, dword [ebp - 0x348]
mov esi, dword [ebp - 0x34c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x35c], 1
jne 0x10005532
cmp dword [0x100421a8], 2
push ecx
mov ecx, 0x10041d94
jne 0x10005512
movq xmm0, qword [0x10039028]
lea edx, [ebp - 0x10]
mov al, byte [0x10039030]
movq qword [ebp - 0x10], xmm0
mov byte [ebp - 8], al
call fcn.10006be0
jmp 0x1000552f
movups xmm0, xmmword [str.everyone]
mov ax, word [0x10039044]
lea edx, [ebp - 0x18]
mov word [ebp - 8], ax
movups xmmword [ebp - 0x18], xmm0
call fcn.10006660
add esp, 4
mov eax, dword [0x100421dc]
cmp eax, 1
je 0x10005580
cmp eax, 2
jne 0x10005567
cmp dword [0x100421f8], 1
jne 0x10005580
push 0x100421e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100184e9
mov esp, ebp
pop ebp
ret
cmp dword [0x100421dc], 3
jne 0x10005580
mov eax, dword [0x100421fc]
test eax, eax
je 0x10005580
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
mov eax, edi
pop esi
xor ecx, ebp
pop edi
call fcn.100184e9
mov esp, ebp
pop ebp
ret