Function at 0x100033e0
Capabilities:
Create process on windows
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
mov eax, dword [0x10032014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x128]
push 0x104
push 0
push eax
mov dword [ebp - 0x328], 0x104
call fcn.10014920
push 0x2e
push edi
call fcn.10014260
add esp, 0x14
test eax, eax
je 0x100036c4
lea ecx, [ebp - 0x324]
push ecx
push 0xf003f
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100036c4
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x128]
push eax
push 0
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
lea eax, [ebp - 0x320]
push 0
push eax
call fcn.10014920
movaps xmm0, xmmword [0x1002e910]
push 0x16
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0xd8d7d6d3
mov word [ebp - 8], 0xd3d6
call fcn.100126ff
mov ebx, eax
lea ecx, [ebp - 0x1b]
mov esi, ebx
add esp, 0x10
mov eax, 1
sub esi, ecx
lea edx, [ebp - 0x1c]
mov cl, 0xcc
add edx, eax
sub cl, al
inc eax
xor cl, byte [edx]
mov byte [esi + edx], cl
cmp eax, 0x15
jbe 0x100034b6
lea eax, [ebp - 0x128]
mov byte [ebx + 0x15], 0
push eax
lea eax, [ebp - 0x320]
push ebx
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
push 1
mov dword [ebx + 0x10], 0
push ebx
mov byte [ebx + 0x14], 0
call fcn.1001272f
add esp, 0x14
lea eax, [ebp - 0x324]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x320]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100036c4
push 0x104
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.10014920
add esp, 0xc
mov dword [ebp - 0x328], 0x104
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x128]
push eax
push 0
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x128]
push 0x1002e3e8
push eax
call fcn.10013ca0
add esp, 8
test eax, eax
jne 0x100035be
lea eax, [ebp - 0x128]
push 0x1002e3ec
push eax
call fcn.10013ca0
add esp, 8
test eax, eax
jne 0x100035be
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x128]
push 0x1002e3f0
push eax
call esi
push edi
lea eax, [ebp - 0x128]
push eax
call esi
jmp 0x100035c6
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xorps xmm0, xmm0
movlpd qword [ebp - 0x36c], xmm0
movlpd qword [ebp - 0x364], xmm0
movlpd qword [ebp - 0x35c], xmm0
movlpd qword [ebp - 0x354], xmm0
movlpd qword [ebp - 0x34c], xmm0
movlpd qword [ebp - 0x344], xmm0
movlpd qword [ebp - 0x33c], xmm0
movlpd qword [ebp - 0x334], xmm0
movaps xmm0, xmmword [0x1002e8d0]
push 0x10
movups xmmword [ebp - 0x18], xmm0
call fcn.100126ff
mov esi, eax
lea ecx, [ebp - 0x17]
mov edi, esi
add esp, 4
mov eax, 1
sub edi, ecx
nop dword [eax]
lea edx, [ebp - 0x18]
mov cl, 0xcc
add edx, eax
sub cl, al
inc eax
xor cl, byte [edx]
mov byte [edi + edx], cl
cmp eax, 0xf
jbe 0x10003630
cmp dword [ebp + 0xc], 0
mov byte [esi + 0xf], 0
mov eax, dword [ebp - 0x368]
cmovne eax, esi
mov dword [ebp - 0x370], 0x44
mov dword [ebp - 0x368], eax
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp - 0x370]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x128]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi + 8], 0
push 1
mov word [esi + 0xc], 0
push esi
mov byte [esi + 0xe], 0
call fcn.1001272f
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100126e5
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100126e5
mov esp, ebp
pop ebp
ret 8