Function at 0x10020370
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7d8]
sub esp, 0x84c
mov eax, dword [0x10098688]
xor eax, ebp
mov dword [ebp + 0x7d4], eax
mov eax, dword [ebp + 0x7ec]
mov dword [0x10099b20], eax
mov ecx, dword [ebp + 0x7e8]
mov dword [0x10099b24], ecx
mov edx, dword [ebp + 0x7e4]
mov dword [0x10099b28], edx
lea ecx, [ebp - 0x50]
call fcn.10004f40
push 0x400
lea ecx, [ebp - 0x50]
call fcn.10004ea0
push eax
call fcn.1001be80
add esp, 4
push 0xffffffffffffffff
lea ecx, [ebp - 0x50]
call fcn.10004100
call fcn.100168b0
test eax, eax
je 0x100203e5
mov byte [ebp - 0x47], 1
jmp 0x100203e9
mov byte [ebp - 0x47], 0
mov al, byte [ebp - 0x47]
mov byte [ebp - 0x46], al
mov cl, byte [ebp - 0x46]
mov byte [ebp - 0x45], cl
mov byte [ebp - 0x48], 0
lea ecx, [ebp - 0x5c]
call fcn.10004f40
mov dword [ebp - 0x54], 0
jmp 0x10020413
mov edx, dword [ebp - 0x54]
add edx, 1
mov dword [ebp - 0x54], edx
cmp dword [ebp - 0x54], 5
jge 0x1002046e
lea ecx, [ebp - 0x58]
call fcn.10004f40
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x49]
push eax
movzx ecx, byte [ebp - 0x46]
push ecx
call fcn.10017990
add esp, 0x14
movzx edx, al
test edx, edx
je 0x10020459
mov al, byte [ebp - 0x49]
mov byte [ebp - 0x45], al
mov byte [ebp - 0x48], 1
lea ecx, [ebp - 0x58]
call fcn.10004ee0
jmp 0x1002046e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x58]
call fcn.10004ee0
jmp 0x1002040a
mov ecx, 1
imul ecx, ecx, 0xa
mov byte [ebp + ecx + 0x7bc], 0x53
mov edx, 1
shl edx, 2
mov byte [ebp + edx + 0x7bc], 0x77
mov eax, 1
shl eax, 3
mov byte [ebp + eax + 0x7bc], 0x5c
mov ecx, 1
imul ecx, ecx, 0xc
mov dword [ebp - 0x70], ecx
cmp dword [ebp - 0x70], 0xd
jae 0x100204b1
jmp 0x100204b6
call fcn.1005a87f
mov edx, dword [ebp - 0x70]
mov byte [ebp + edx + 0x7bc], 0
mov eax, 1
imul eax, eax, 7
mov byte [ebp + eax + 0x7bc], 0x65
mov ecx, 1
imul ecx, ecx, 0xb
mov byte [ebp + ecx + 0x7bc], 0x4f
mov edx, 1
imul edx, edx, 3
mov byte [ebp + edx + 0x7bc], 0x74
mov eax, 1
imul eax, eax, 0
mov byte [ebp + eax + 0x7bc], 0x53
mov ecx, 1
imul ecx, ecx, 6
mov byte [ebp + ecx + 0x7bc], 0x72
mov edx, 1
shl edx, 0
mov byte [ebp + edx + 0x7bc], 0x6f
mov eax, 1
imul eax, eax, 9
mov byte [ebp + eax + 0x7bc], 0x53
mov ecx, 1
imul ecx, ecx, 5
mov byte [ebp + ecx + 0x7bc], 0x61
mov edx, 1
shl edx, 1
mov byte [ebp + edx + 0x7bc], 0x66
movzx eax, byte [ebp - 0x48]
test eax, eax
je 0x10020561
mov dword [ebp - 0x68], 0x1007d738
jmp 0x10020568
mov dword [ebp - 0x68], 0x1009255c
mov ecx, dword [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x60]
call fcn.10004cb0
mov edx, 1
imul edx, edx, 3
mov byte [ebp + edx + 0x7cc], 0x69
mov eax, 1
imul eax, eax, 7
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 8
jae 0x10020597
jmp 0x1002059c
call fcn.1005a87f
mov ecx, dword [ebp - 0x6c]
mov byte [ebp + ecx + 0x7cc], 0
mov edx, 1
shl edx, 1
mov byte [ebp + edx + 0x7cc], 0x72
mov eax, 1
shl eax, 0
mov byte [ebp + eax + 0x7cc], 0x68
mov ecx, 1
imul ecx, ecx, 5
mov byte [ebp + ecx + 0x7cc], 0x73
mov edx, 1
imul edx, edx, 0
mov byte [ebp + edx + 0x7cc], 0x63
mov eax, 1
shl eax, 2
mov byte [ebp + eax + 0x7cc], 0x6e
mov ecx, 1
imul ecx, ecx, 6
mov byte [ebp + ecx + 0x7cc], 0x74
lea ecx, [ebp - 0x60]
call fcn.10004b90
push eax
lea ecx, [ebp - 0x60]
call fcn.100040e0
push eax
push 1
lea edx, [ebp + 0x7cc]
push edx
lea eax, [ebp + 0x7bc]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov byte [ebp + 0x3bc], 0
push 0x3ff
push 0
lea ecx, [ebp + 0x3bd]
push ecx
call fcn.1005ec70
add esp, 0xc
movzx edx, byte [ebp - 0x45]
test edx, edx
je 0x10020661
mov dword [ebp - 0x64], 0x1007d878
jmp 0x10020668
mov dword [ebp - 0x64], 0x1007d87c
mov eax, dword [ebp - 0x64]
push eax
push 0x10092524
push 0x400
lea ecx, [ebp + 0x3bc]
push ecx
call fcn.1005bf44
add esp, 0x10
lea edx, [ebp + 0x3bc]
push edx
call fcn.1001c0c0
add esp, 4
mov byte [ebp - 0x44], 0
push 0x3ff
push 0
lea eax, [ebp - 0x43]
push eax
call fcn.1005ec70
add esp, 0xc
mov ecx, dword [ebp - 0x5c]
push ecx
push 0x10092524
push 0x400
lea edx, [ebp - 0x44]
push edx
call fcn.1005bf44
add esp, 0x10
lea eax, [ebp - 0x44]
push eax
call fcn.1001c0c0
add esp, 4
lea ecx, [ebp - 0x60]
call fcn.10004ee0
lea ecx, [ebp - 0x5c]
call fcn.10004ee0
lea ecx, [ebp - 0x50]
call fcn.10004ee0
mov ecx, dword [ebp + 0x7d4]
xor ecx, ebp
call fcn.1005c9a6
add ebp, 0x7d8
mov esp, ebp
pop ebp
ret