Function at 0x10025890
Capabilities:
Encode data using xor
Get file size
Initialize iwebbrowser2
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b380
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
mov eax, dword [0x1005d500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push esi
push esi
push esi
push esi
push str.pigf
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push 0x10054834
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
push 0x80
push 0x10054838
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
push 0x1005483c
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x10]
push eax
push 0x10054870
push 0x17
push esi
push 0x10054860
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jge 0x1002593d
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, esi
je 0x10025928
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x94]
call eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa4]
push esi
push eax
call edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x118]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xf0]
push 0xffffffffffffffff
push eax
call edx
mov ebx, dword [ebp + 0x10]
cmp edi, esi
jne 0x1002598c
cmp ebx, esi
je 0x100259e8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x110]
push esi
push eax
call edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc4]
push esi
push eax
call edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xac]
push esi
push eax
call edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xbc]
push esi
push eax
call edx
cmp edi, esi
jne 0x100259d0
cmp ebx, esi
je 0x100259e8
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x68]
push edi
push eax
call edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x70]
push ebx
push eax
call edx
mov ebx, dword [ebp + 0xc]
cmp ebx, esi
je 0x10025a07
call fcn.10026520
mov ebx, eax
mov dword [ebp + 0xc], ebx
cmp ebx, esi
jne 0x10025a0c
push 0x8007000e
call fcn.10012200
xor ebx, ebx
mov dword [ebp + 0xc], ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x10]
xor eax, eax
push ecx
mov word [ebp - 0x58], ax
call fcn.100263b0
lea eax, [ebp - 0x48]
xor edx, edx
mov byte [ebp - 4], 2
push eax
mov word [ebp - 0x48], dx
call fcn.100263b0
lea edx, [ebp - 0x38]
xor ecx, ecx
mov byte [ebp - 4], 3
push edx
mov word [ebp - 0x38], cx
call fcn.100263b0
mov eax, 3
mov word [ebp - 0x28], ax
mov dword [ebp - 0x20], 0xe
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 5
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x2c]
push ebx
push esi
call ecx
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edx, [ebp - 0x28]
push edx
call esi
lea eax, [ebp - 0x38]
push eax
call esi
lea ecx, [ebp - 0x48]
push ecx
call esi
lea edx, [ebp - 0x58]
push edx
mov byte [ebp - 4], 1
call esi
cmp edi, 0x7d0
jne 0x10025aed
cmp dword [ebp + 0x10], edi
jne 0x10025aed
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa4]
push 0
push eax
call edx
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x80]
push eax
call edx
push ebx
test eax, eax
jns 0x10025b83
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
jmp 0x1002591e
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x3c]
mov ecx, dword [ebp + 0x14]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
sub ecx, eax
cmp ecx, dword [esi + 0x2c]
jl 0x10025b4a
mov eax, dword [esi + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
imul eax, eax, 0x3e8
push eax
call esi
call fcn.10026590
call fcn.10036f93
cdq
xor eax, edx
sub eax, edx
cdq
mov ecx, 0x78
idiv ecx
cmp edx, 0x1e
jl 0x10025b28
imul edx, edx, 0x3e8
push edx
call esi
jmp 0x10025b74
call fcn.10026590
nop
call fcn.10036f93
cdq
xor eax, edx
sub eax, edx
cdq
mov ecx, 0x78
idiv ecx
cmp edx, 0x1e
jl 0x10025b50
imul edx, edx, 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x80]
call eax
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10025b9f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10