Function at 0x487c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x140
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x4d]
mov esi, dword [esp + 0x150]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 7
mov dword [esp + 0x19], eax
lea edi, [esp + 0x2d]
mov dword [esp + 0x1d], eax
mov byte [esp + 0x4c], 0x45
mov dword [esp + 0x21], eax
mov byte [esp + 0x4d], 0x6e
mov word [esp + 0x25], ax
mov byte [esp + 0x4e], 0x75
mov byte [esp + 0x27], al
mov byte [esp + 0x2c], al
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x4f], 0x6d
repne scasb al, byte es:[edi]
not ecx
mov edx, ecx
lea edi, [esp + 0x51]
shr ecx, 2
mov byte [esp + 0x50], 0x5c
lea eax, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
push 0x20019
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x54]
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
mov byte [esp + 0x2c], 0
mov byte [esp + 0x23], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x487d32
pop edi
pop esi
mov eax, 0x80900005
pop ebx
add esp, 0x140
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x15c]
lea edx, [esp + 0x13]
push 1
push edx
push 3
push ebp
push eax
mov ecx, ebx
mov byte [ebp], 0x44
mov byte [ebp + 1], 0x65
mov byte [ebp + 2], 0x76
mov byte [ebp + 3], 0x69
mov byte [ebp + 4], 0x63
mov byte [ebp + 5], 0x65
mov byte [ebp + 6], 0x54
mov byte [ebp + 7], 0x79
mov byte [ebp + 8], 0x70
mov byte [ebp + 9], 0x65
mov byte [ebp + 0xa], 0
call fcn.00488100
test eax, eax
jg 0x487d8b
jge 0x487d9b
mov dword [esp + 0x14], eax
jmp 0x4880dc
mov al, byte [esp + 0x13]
test al, al
je 0x487da8
cmp al, 5
je 0x487e28
mov dword [esp + 0x14], 0x80004005
jmp 0x4880dc
mov edi, str.SCSILUN
or ecx, 0xffffffff
xor eax, eax
push 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x20]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 1
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, ebx
call fcn.00488100
test eax, eax
jle 0x4880dc
mov edi, str.SCSITargetID
or ecx, 0xffffffff
xor eax, eax
push 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x20]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 1
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, ebx
call fcn.00488100
test eax, eax
jle 0x4880dc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x30]
push 0x1e
push edx
push 1
push ebp
push eax
mov ecx, ebx
mov byte [ebp], 0x43
mov byte [ebp + 1], 0x75
mov byte [ebp + 2], 0x72
mov byte [ebp + 3], 0x72
mov byte [ebp + 4], 0x65
mov byte [ebp + 5], 0x6e
mov byte [ebp + 6], 0x74
mov byte [ebp + 7], 0x44
mov byte [ebp + 8], 0x72
mov byte [ebp + 9], 0x69
mov byte [ebp + 0xa], 0x76
mov byte [ebp + 0xb], 0x65
mov byte [ebp + 0xc], 0x4c
mov byte [ebp + 0xd], 0x65
mov byte [ebp + 0xe], 0x74
mov byte [ebp + 0xf], 0x74
mov byte [ebp + 0x10], 0x65
mov byte [ebp + 0x11], 0x72
mov byte [ebp + 0x12], 0x41
mov byte [ebp + 0x13], 0x73
mov byte [ebp + 0x14], 0x73
mov byte [ebp + 0x15], 0x69
mov byte [ebp + 0x16], 0x67
mov byte [ebp + 0x17], 0x6e
mov byte [ebp + 0x18], 0x6d
mov byte [ebp + 0x19], 0x65
mov byte [ebp + 0x1a], 0x6e
mov byte [ebp + 0x1b], 0x74
mov byte [ebp + 0x1c], 0
call fcn.00488100
test eax, eax
jg 0x487ec5
jge 0x487d9b
mov dword [esp + 0x14], eax
jmp 0x4880dc
mov ecx, dword [esp + 0x30]
and ecx, 0xff
push ecx
call dword [sym.imp.MSVCR71.dll_toupper]
mov edx, dword [esp + 0x15c]
sub eax, 0x41
add esp, 4
mov ecx, ebx
lea esi, [eax + eax*2]
mov eax, dword [esp + 0x18]
shl esi, 4
add esi, edx
push 9
mov dword [esp + 0x30], esi
mov byte [ebp], 0x4d
lea edx, [esi + 0xc]
mov byte [ebp + 1], 0x61
push edx
push 1
push ebp
push eax
mov byte [ebp + 2], 0x6e
mov byte [ebp + 3], 0x75
mov byte [ebp + 4], 0x66
mov byte [ebp + 5], 0x61
mov byte [ebp + 6], 0x63
mov byte [ebp + 7], 0x74
mov byte [ebp + 8], 0x75
mov byte [ebp + 9], 0x72
mov byte [ebp + 0xa], 0x65
mov byte [ebp + 0xb], 0x72
mov byte [ebp + 0xc], 0
call fcn.00488100
mov edx, dword [esp + 0x18]
lea ecx, [esi + 0x15]
push 0x11
push ecx
push 1
mov al, 0x64
push ebp
push edx
mov ecx, ebx
mov byte [ebp], 0x50
mov byte [ebp + 1], 0x72
mov byte [ebp + 2], 0x6f
mov byte [ebp + 3], al
mov byte [ebp + 4], 0x75
mov byte [ebp + 5], 0x63
mov byte [ebp + 6], 0x74
mov byte [ebp + 7], 0x49
mov byte [ebp + 8], al
mov byte [ebp + 9], 0
call fcn.00488100
mov ecx, dword [esp + 0x18]
lea eax, [esi + 0x26]
push 5
push eax
push 1
push ebp
push ecx
mov ecx, ebx
mov byte [ebp], 0x52
mov byte [ebp + 1], 0x65
mov byte [ebp + 2], 0x76
mov byte [ebp + 3], 0x69
mov byte [ebp + 4], 0x73
mov byte [ebp + 5], 0x69
mov byte [ebp + 6], 0x6f
mov byte [ebp + 7], 0x6e
mov byte [ebp + 8], 0x4c
mov byte [ebp + 9], 0x65
mov byte [ebp + 0xa], 0x76
mov byte [ebp + 0xb], 0x65
mov byte [ebp + 0xc], 0x6c
mov byte [ebp + 0xd], 0
call fcn.00488100
mov byte [ebp], 0x53
mov byte [ebp + 1], 0x43
mov byte [ebp + 2], 0x53
mov byte [ebp + 3], 0x49
mov byte [ebp + 4], 0x4c
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push 0x10
push edx
push 1
push ebp
push eax
mov ecx, ebx
mov byte [ebp + 5], 0x55
mov byte [ebp + 6], 0x4e
mov byte [ebp + 7], 0
call fcn.00488100
test eax, eax
jg 0x48800b
jge 0x487d9b
mov dword [esp + 0x14], eax
jmp 0x4880dc
mov cl, byte [esp + 0x1c]
lea edx, [esp + 0x1c]
sub cl, 0x30
push 0x10
mov byte [esi + 3], cl
mov eax, dword [esp + 0x1c]
push edx
push 1
push ebp
push eax
mov ecx, ebx
mov byte [ebp], 0x53
mov byte [ebp + 1], 0x43
mov byte [ebp + 2], 0x53
mov byte [ebp + 3], 0x49
mov byte [ebp + 4], 0x54
mov byte [ebp + 5], 0x61
mov byte [ebp + 6], 0x72
mov byte [ebp + 7], 0x67
mov byte [ebp + 8], 0x65
mov byte [ebp + 9], 0x74
mov byte [ebp + 0xa], 0x49
mov byte [ebp + 0xb], 0x44
mov byte [ebp + 0xc], 0
call fcn.00488100
test eax, eax
jle 0x487eb6
mov cl, byte [esp + 0x1c]
lea edi, [esp + 0x30]
sub cl, 0x30
xor eax, eax
mov byte [esi + 2], cl
mov dl, byte [esp + 0x13]
or ecx, 0xffffffff
mov byte [esi + 4], dl
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, 1
mov ebp, ecx
cmp ebp, ebx
jle 0x4880d4
xor eax, eax
mov al, byte [esp + ebx + 0x30]
push eax
call dword [sym.imp.MSVCR71.dll_toupper]
sub al, 0x41
mov esi, dword [esp + 0x15c]
mov byte [esp + 0x18], al
add esp, 4
mov ecx, dword [esp + 0x14]
and ecx, 0xff
lea edx, [ecx + ecx*2]
mov ecx, 0xc
shl edx, 4
add edx, esi
mov esi, dword [esp + 0x2c]
mov edi, edx
inc ebx
rep movsd dword es:[edi], dword [esi]
cmp ebx, ebp
mov byte [edx], al
jl 0x488091
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x140
ret 0xc