Function at 0xd16920
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
jmp 0xd16a90
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0xd336ed
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x30]
push ebx
sub esp, 0x168
mov eax, dword [eax + 0xc]
push esi
push edi
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x40], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x3c], ecx
cmp ecx, esi
je 0xd16b37
mov edi, dword [ecx + 0x18]
test edi, edi
je 0xd16b37
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x38], ecx
dec edi
mov esi, 0x71a62f65
mov cl, byte [edx]
inc edx
test cl, cl
je 0xd16b2d
nop dword [eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0xd16b10
cmp esi, 0xcfac360f
je 0xd16b3b
mov ecx, dword [ebp - 0x38]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0xd16af5
mov eax, dword [eax]
jmp 0xd16ad0
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
push 0x8001
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov dword [ebp - 0x18], 0x4c96340b
mov dword [ebp - 0x14], 0xb510a249
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x18], 0x6b920b42
mov dword [ebp - 0x14], 0x9eac9634
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x18], 0x386d8beb
mov dword [ebp - 0x14], 0x93079df3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x18], 0x7a3a84e0
mov dword [ebp - 0x14], 0x99f07ff6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x18], 0x4ce23465
mov dword [ebp - 0x14], 0xb57ca22d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x18], 0x6bbc0b2e
mov dword [ebp - 0x14], 0x9ec09650
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x18], 0x386d8b87
mov dword [ebp - 0x14], 0x93079df3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x18], 0x7a3a84e0
mov dword [ebp - 0x14], 0x99f07ff6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
movaps xmm1, xmmword [ebp - 0x60]
xorps xmm1, xmmword [ebp - 0x80]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], ecx
movaps xmmword [ebp - 0x60], xmm1
movaps xmm1, xmmword [ebp - 0x50]
xorps xmm1, xmmword [ebp - 0x70]
movaps xmmword [ebp - 0x50], xmm1
mov dword [ebp - 0x18], 0x905029
mov dword [ebp - 0x14], 0xf118c342
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x18], 0x6bbc6742
mov dword [ebp - 0x14], 0x9ec09650
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x18], 0x4ce23465
mov dword [ebp - 0x14], 0xb57ca22d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], 0x6bbc0b2e
mov dword [ebp - 0x14], 0x9ec09650
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
movaps xmm1, xmmword [ebp - 0x70]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
push 0xd17860
lea eax, [ebp - 0x70]
mov dword [ebp - 0x24], ecx
xorps xmm1, xmmword [ebp - 0x30]
push eax
lea eax, [ebp - 0x60]
movaps xmmword [ebp - 0x70], xmm1
push eax
mov dword [ebp - 0x3c], 0
call fcn.00d15ab0
test eax, eax
je 0xd16ce5
push 0xd02f58
call fcn.00d109a0
add esp, 4
push 0
call fcn.00d15af0
test eax, eax
je 0xd16cfd
push 0xd02f58
call fcn.00d109a0
add esp, 4
mov eax, dword [ebp - 0x3c]
mov dword [0xd0de54], eax
mov dword [ebp - 0x18], 0x4cd83421
mov dword [ebp - 0x14], 0xb554a27d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0x18], 0x6b870b6a
mov dword [ebp - 0x14], 0x9e89961f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], ecx
mov dword [ebp - 0x18], 0x38248bc4
mov dword [ebp - 0x14], 0x93409dc8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0x18], 0x7a0184a1
mov dword [ebp - 0x14], 0x99cb7fcd
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0x18], 0x5444d61e
mov dword [ebp - 0x14], 0x9b5e5680
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0x18], 0xf7b06563
mov dword [ebp - 0x14], 0x9f5d3373
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0x18], 0x336185a8
mov dword [ebp - 0x14], 0x886bbf34
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x18], 0x746b96f5
mov dword [ebp - 0x14], 0xc4220969
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0x18], 0x735f6d7e
mov dword [ebp - 0x14], 0xb58e66ec
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0x18], 0x86b93497
mov dword [ebp - 0x14], 0xa317327
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0x18], 0x3292c1ec
mov dword [ebp - 0x14], 0xcbaff610
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0x18], 0x139d49c9
mov dword [ebp - 0x14], 0xea8c2995
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x18], 0x97ab475e
mov dword [ebp - 0x14], 0xe5aa84e8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x18], 0x89acf32a
mov dword [ebp - 0x14], 0xd2168c34
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x18], 0x4ce23465
mov dword [ebp - 0x14], 0xb57ca22d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x6bbc0b2e
mov dword [ebp - 0x14], 0x9ec09650
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x16c], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x386d8b87
mov dword [ebp - 0x14], 0x93079df3
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x164], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x7a3a84e0
mov dword [ebp - 0x14], 0x99f07ff6
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x15c], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x5400d649
mov dword [ebp - 0x14], 0x9b7656a9
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x154], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0xf78b6522
mov dword [ebp - 0x14], 0x9f14333c
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14c], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x332885eb
mov dword [ebp - 0x14], 0x882cbf0f
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x144], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x745096b4
mov dword [ebp - 0x14], 0xc4190952
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x13c], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x73066d2d
mov dword [ebp - 0x14], 0xb5a666c5
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x134], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x868234d6
mov dword [ebp - 0x14], 0xa787368
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x12c], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x32dbc1af
mov dword [ebp - 0x14], 0xcbe8f62b
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x124], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x13a64988
mov dword [ebp - 0x14], 0xeab729ae
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x11c], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x97fc4711
mov dword [ebp - 0x14], 0xe5aa84c1
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x114], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x18], 0x89acf32a
mov dword [ebp - 0x14], 0xd2168c34
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10c], ecx
mov ecx, dword [ebp - 0x14]
movaps xmm1, xmmword [ebp - 0x100]
xorps xmm1, xmmword [ebp - 0x170]
movaps xmmword [ebp - 0x100], xmm1
movaps xmm1, xmmword [ebp - 0xf0]
xorps xmm1, xmmword [ebp - 0x160]
movaps xmmword [ebp - 0xf0], xmm1
movaps xmm1, xmmword [ebp - 0xe0]
xorps xmm1, xmmword [ebp - 0x150]
movaps xmmword [ebp - 0xe0], xmm1
movaps xmm1, xmmword [ebp - 0xd0]
xorps xmm1, xmmword [ebp - 0x140]
movaps xmmword [ebp - 0xd0], xmm1
movaps xmm1, xmmword [ebp - 0xc0]
xorps xmm1, xmmword [ebp - 0x130]
movaps xmmword [ebp - 0xc0], xmm1
movaps xmm1, xmmword [ebp - 0xb0]
xorps xmm1, xmmword [ebp - 0x120]
mov dword [ebp - 0x108], eax
mov eax, dword fs:[0x30]
movaps xmmword [ebp - 0xb0], xmm1
movaps xmm1, xmmword [ebp - 0xa0]
mov dword [ebp - 0x40], 0
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x104], ecx
xorps xmm1, xmmword [ebp - 0x110]
movaps xmmword [ebp - 0xa0], xmm1
mov eax, dword [eax + 0xc]
nop dword [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x24], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x3c], ecx
cmp ecx, esi
je 0xd17197
mov edi, dword [ecx + 0x18]
test edi, edi
je 0xd17197
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x38], ecx
dec edi
mov esi, 0x5926e18c
mov cl, byte [edx]
inc edx
test cl, cl
je 0xd1718d
nop dword [eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0xd17170
cmp esi, 0xedf83654
je 0xd1719b
mov ecx, dword [ebp - 0x38]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0xd17155
mov eax, dword [eax]
jmp 0xd17130
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x24]
push 0
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
lea ecx, [ebp - 0x40]
push ecx
push 1
lea ecx, [ebp - 0x100]
add eax, edx
push ecx
call eax
test eax, eax
je 0xd17399
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x3c], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x38], ecx
cmp ecx, esi
je 0xd17247
mov edi, dword [ecx + 0x18]
test edi, edi
je 0xd17247
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x24], ecx
dec edi
mov esi, 0xc374dd3
mov cl, byte [edx]
inc edx
test cl, cl
je 0xd1723d
nop dword [eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0xd17220
cmp esi, 0x673965df
je 0xd1724b
mov ecx, dword [ebp - 0x24]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0xd17205
mov eax, dword [eax]
jmp 0xd171e0
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov ecx, dword fs:[0x30]
mov dword [ebp - 0x14], eax
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
mov esi, dword [ecx + 0x18]
mov dword [ebp - 0x3c], esi
mov edx, dword [esi + 0x3c]
mov eax, dword [edx + esi + 0x78]
add eax, esi
mov dword [ebp - 0x38], eax
cmp eax, esi
je 0xd172df
mov edi, dword [eax + 0x18]
test edi, edi
je 0xd172df
mov eax, dword [eax + 0x20]
lea eax, [eax + edi*4]
add eax, esi
nop dword [eax + eax]
mov edx, dword [eax - 4]
sub eax, 4
add edx, esi
mov dword [ebp - 0x24], eax
dec edi
mov esi, 0xb374c40
mov al, byte [edx]
inc edx
test al, al
je 0xd172d5
movsx eax, al
lea edx, [edx + 1]
xor eax, esi
imul esi, eax, 0x1000193
mov al, byte [edx - 1]
test al, al
jne 0xd172b8
cmp esi, 0x6d5b62b4
je 0xd172e3
mov eax, dword [ebp - 0x24]
mov esi, dword [ecx + 0x18]
test edi, edi
jne 0xd172a0
mov ecx, dword [ecx]
jmp 0xd17276
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
push 4
push dword [ebp - 0x14]
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x38], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x24], ecx
cmp ecx, edx
je 0xd17377
mov edi, dword [ecx + 0x18]
test edi, edi
je 0xd17377
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, edx
sub ecx, 4
dec edi
mov dword [ebp - 0x14], ecx
mov esi, 0x8f3a5aa3
mov ecx, dword [ecx]
add ecx, edx
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0xd1736d
nop
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0xd17350
cmp esi, 0x767ef508
je 0xd1737b
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax + 0x18]
test edi, edi
jne 0xd17337
mov eax, dword [eax]
jmp 0xd17312
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x38]
push dword [ebp - 0x40]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
mov dword [ebp - 0x18], 0x38915111
mov dword [ebp - 0x14], 0xea1bcc44
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x18], 0x3c87e4f
mov dword [ebp - 0x14], 0xe4a9e43f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x18], 0x5704ffe6
mov dword [ebp - 0x14], 0x93079d9d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x18], 0x7a3a84e0
mov dword [ebp - 0x14], 0x99f07ff6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x18], 0x4ce23465
mov dword [ebp - 0x14], 0xb57ca22d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x18], 0x6bbc0b2e
mov dword [ebp - 0x14], 0x9ec09650
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x18], 0x386d8b87
mov dword [ebp - 0x14], 0x93079df3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x18], 0x7a3a84e0
mov dword [ebp - 0x14], 0x99f07ff6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
movaps xmm1, xmmword [ebp - 0x60]
xorps xmm1, xmmword [ebp - 0x80]
movaps xmmword [ebp - 0x60], xmm1
movaps xmm1, xmmword [ebp - 0x50]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], ecx
xorps xmm1, xmmword [ebp - 0x70]
movaps xmmword [ebp - 0x50], xmm1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x60]
push eax
push 0xd03a0c
lea eax, [ebp - 0xd8]
push 0x41
push eax
call fcn.00d10640
add esp, 0x14
lea eax, [ebp - 0xd8]
push eax
push 1
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0xd174e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 0
push 0
push 0xf001f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp esi, 0xb7
je 0xd174ed
mov byte [edi], 0
jmp 0xd174ed
mov edi, 0xd0de58
call fcn.00d10f00
mov byte [ebp - 0x31], al
test al, al
jne 0xd1782b
mov dword [ebp - 0x28], 0x38845b36
mov dword [ebp - 0x24], 0xd00ec35a
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x28], 0x7dd5d72
mov dword [ebp - 0x24], 0xcd9cf326
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x28], 0x550ceef3
mov dword [ebp - 0x24], 0xe764dcaf
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x28], 0x2a5ff289
mov dword [ebp - 0x24], 0xfc931084
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x28], 0x5400a53a
mov dword [ebp - 0x24], 0x9b7656a9
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x28], 0xf78b6522
mov dword [ebp - 0x24], 0x9f14333c
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x28], 0x4ce23465
mov dword [ebp - 0x24], 0xb57ca22d
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0x28], 0x6bbc0b2e
mov dword [ebp - 0x24], 0x9ec09650
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0x28], 0x386d8b87
mov dword [ebp - 0x24], 0x93079df3
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], ecx
mov dword [ebp - 0x28], 0x7a3a84e0
mov dword [ebp - 0x24], 0x99f07ff6
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x28], 0x5400d649
mov dword [ebp - 0x24], 0x9b7656a9
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x28], 0xf78b6522
mov dword [ebp - 0x24], 0x9f14333c
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
movaps xmm1, xmmword [ebp - 0x90]
xorps xmm1, xmmword [ebp - 0xc0]
movaps xmmword [ebp - 0x90], xmm1
movaps xmm1, xmmword [ebp - 0x80]
xorps xmm1, xmmword [ebp - 0xb0]
movaps xmmword [ebp - 0x80], xmm1
movaps xmm1, xmmword [ebp - 0x70]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], ecx
xorps xmm1, xmmword [ebp - 0xa0]
movaps xmmword [ebp - 0x70], xmm1
push 0
push 1
lea eax, [ebp - 0x90]
push eax
push 0x80000001
lea ecx, [ebp - 0x28]
call fcn.00d10ea0
cmp dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
jne 0xd17817
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x18], 0x4c813424
mov dword [ebp - 0x14], 0xb515a259
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x18], 0x6bd90b58
mov dword [ebp - 0x14], 0x9eb39605
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x18], 0x381f8be2
mov dword [ebp - 0x14], 0x93079df3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x18], 0x7a3a84e0
mov dword [ebp - 0x14], 0x99f07ff6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x18], 0x4ce23465
mov dword [ebp - 0x14], 0xb57ca22d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x18], 0x6bbc0b2e
mov dword [ebp - 0x14], 0x9ec09650
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x18], 0x386d8b87
mov dword [ebp - 0x14], 0x93079df3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x18], 0x7a3a84e0
mov dword [ebp - 0x14], 0x99f07ff6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
movaps xmm1, xmmword [ebp - 0x80]
xorps xmm1, xmmword [ebp - 0x60]
mov esi, dword [ebp - 0x28]
movaps xmmword [ebp - 0x60], xmm1
movaps xmm1, xmmword [ebp - 0x50]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], ecx
xorps xmm1, xmmword [ebp - 0x70]
movaps xmmword [ebp - 0x50], xmm1
test esi, esi
jne 0xd177c4
push 0xd03810
call fcn.00d109a0
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 0x38]
push eax
push 0
push 0
lea eax, [ebp - 0x60]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd177f3
push 0xd03820
call fcn.00d109a0
add esp, 4
mov esi, dword [ebp - 0x38]
mov ecx, 0xd022b4
nop dword [eax + eax]
cmp dword [ecx], esi
sete dl
mov byte [ebp - 0x31], dl
je 0xd1781a
add ecx, 4
cmp ecx, 0xd022e4
jne 0xd17800
jmp 0xd1781a
mov dl, byte [ebp - 0x31]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0xd17840
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x31]
mov byte [edi], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 0xc]
mov byte [edi], dl
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret