Function at 0x10041903
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x100418ae
jmp 0x100418a9
call fcn.100418b0
jae 0x100418a9
add esp, 4
jmp 0x100418b5
dec dword [esp]
jno 0x100418ba
jns 0x100418a5
jp 0x100418be
add esp, 4
popf
jmp 0x100418c5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100418de
jne 0x100418de
call 0x1fc44c32
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
clc
jae 0x100418f4
inc edx
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x10041901
jmp 0x100418fc
call 0x10041903
jae 0x100418fc
add esp, 4
jmp 0x10041908
dec dword [esp]
jno 0x1004190d
jns 0x100418f8
jp 0x10041911
add esp, 4
popf
jmp 0x10041918
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
xor eax, 0x10
xor edx, eax
add eax, edx
sub edx, 0x10
push eax
pop edx
xor edx, 0x30
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x10
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
jl 0x10041964
jmp 0x10041966
je 0x10041961
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10041980
jne 0x1004197f
call 0x93080a07
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1004198e
jne 0x1004198e
call 0x63bc5f58
mov byte [ebp - 0x48], 0x53
mov byte [ebp - 0x47], 0x4f
mov byte [ebp - 0x46], 0x46
mov byte [ebp - 0x45], 0x54
mov byte [ebp - 0x44], 0x57
mov byte [ebp - 0x43], 0x41
mov byte [ebp - 0x42], 0x52
mov byte [ebp - 0x41], 0x45
mov byte [ebp - 0x40], 0x5c
mov byte [ebp - 0x3f], 0x4d
mov byte [ebp - 0x3e], 0x69
mov byte [ebp - 0x3d], 0x63
mov byte [ebp - 0x3c], 0x72
mov byte [ebp - 0x3b], 0x6f
mov byte [ebp - 0x3a], 0x73
mov byte [ebp - 0x39], 0x6f
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x74
mov byte [ebp - 0x36], 0x5c
mov byte [ebp - 0x35], 0x57
mov byte [ebp - 0x34], 0x69
mov byte [ebp - 0x33], 0x6e
mov byte [ebp - 0x32], 0x64
mov byte [ebp - 0x31], 0x6f
mov byte [ebp - 0x30], 0x77
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x4e
mov byte [ebp - 0x2c], 0x54
mov byte [ebp - 0x2b], 0x5c
mov byte [ebp - 0x2a], 0x43
mov byte [ebp - 0x29], 0x75
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x65
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], 0x74
mov byte [ebp - 0x23], 0x56
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x73
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x6e
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x63
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x49
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0
xor eax, eax
test eax, eax
je 0x10041a73
jne 0x10041a72
call 0x93080afa
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
invalid
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10041a81
jmp 0x10041a83
je 0x10041a7e
clc
jae 0x10041a88
mov esi, 0x13f083c6
xor eax, 0x13
xor edx, eax
add eax, edx
sub edx, 0x13
push eax
pop edx
xor edx, 0x39
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x13
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
pushf
push 0xa
jae 0x10041ac8
jmp 0x10041ac3
call 0x10041aca
jae 0x10041ac3
add esp, 4
jmp 0x10041acf
dec dword [esp]
jno 0x10041ad4
jns 0x10041abf
jp 0x10041ad8
add esp, 4
popf
jmp 0x10041adf
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10041af8
jne 0x10041af8
call 0x1fc44e4c
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
clc
jae 0x10041b0e
mov es, word [esi + 0x730a6a9c]
pop es
pushf
push 0xa
jae 0x10041b1b
jmp 0x10041b16
call 0x10041b1d
jae 0x10041b16
add esp, 4
jmp 0x10041b22
dec dword [esp]
jno 0x10041b27
jns 0x10041b12
jp 0x10041b2b
add esp, 4
popf
jmp 0x10041b32
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
xor eax, 0x14
xor edx, eax
add eax, edx
sub edx, 0x14
push eax
pop edx
xor edx, 0x3c
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x14
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
jl 0x10041b7e
jmp 0x10041b80
je 0x10041b7b
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10041b9a
jne 0x10041b99
call 0x93080c21
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10041ba8
jne 0x10041ba8
call 0xeb4a939
invalid
lea ecx, [ebp - 0x150]
push ecx
push 0x20119
push 0
lea edx, [ebp - 0x48]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10041c30
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0x148]
push ecx
push 0
push 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x150]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10041c23
mov ecx, dword [ebp - 0x150]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebp + 8]
call fcn.100036a0
mov eax, dword [ebp - 0x154]
or eax, 1
mov dword [ebp - 0x154], eax
mov eax, dword [ebp + 8]
jmp 0x10041dac
mov ecx, dword [ebp - 0x150]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test eax, eax
je 0x10041c39
jne 0x10041c38
call 0x93080cc0
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
movsd dword es:[edi], dword [esi]
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10041c47
jmp 0x10041c49
je 0x10041c44
clc
jae 0x10041c4e
xor esp, dword [ebp + 0x331cf083]
rol byte [ebx], 1
ret 0xea83
xor eax, 0x1c
xor edx, eax
add eax, edx
sub edx, 0x1c
push eax
pop edx
xor edx, 0x54
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x1c
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
pushf
push 0xa
jae 0x10041c8e
jmp 0x10041c89
call 0x10041c90
jae 0x10041c89
add esp, 4
jmp 0x10041c95
dec dword [esp]
jno 0x10041c9a
jns 0x10041c85
jp 0x10041c9e
add esp, 4
popf
jmp 0x10041ca5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10041cbe
jne 0x10041cbe
call 0x1fc45012
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
clc
jae 0x10041cd4
or byte [ebx], cl
pushf
push 0xa
jae 0x10041ce1
jmp 0x10041cdc
call 0x10041ce3
jae 0x10041cdc
add esp, 4
jmp 0x10041ce8
dec dword [esp]
jno 0x10041ced
jns 0x10041cd8
jp 0x10041cf1
add esp, 4
popf
jmp 0x10041cf8
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
xor eax, 0x1d
xor edx, eax
add eax, edx
sub edx, 0x1d
push eax
pop edx
xor edx, 0x57
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x1d
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
jl 0x10041d44
jmp 0x10041d46
je 0x10041d41
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10041d60
jne 0x10041d5f
call 0x93080de7
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10041d6e
jne 0x10041d6e
call 0x65f86338
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0xa], 0x6b
mov byte [ebp - 9], 0x6e
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x77
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], 0
lea edx, [ebp - 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.100036a0
mov eax, dword [ebp - 0x154]
or eax, 1
mov dword [ebp - 0x154], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret