Function at 0x10005091
Capabilities:
Delete registry key
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020d67
mov eax, dword fs:[0]
push eax
mov eax, 0x1f14
call fcn.10018c90
mov eax, dword [0x1002a080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0xbfe
push eax
mov word [ebp - 0x1ee0], ax
lea eax, [ebp - 0x1ede]
push eax
call fcn.1000e030
add esp, 0xc
lea edi, [ebp - 0x1ee0]
call fcn.1000c897
test eax, eax
je 0x100056d2
push 0x10024f58
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov byte [ebp - 0x70], 0
xor eax, eax
lea edi, [ebp - 0x6f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ebx, [ebp - 0x70]
stosb byte es:[edi], al
call fcn.1000be07
xor eax, eax
mov dword [ebp - 0x1eec], eax
mov dword [ebp - 0x1ee8], eax
mov dword [ebp - 0x1ee4], eax
lea eax, [ebp - 0x1ee4]
push eax
lea ebx, [ebp - 0x1ee8]
lea edi, [ebp - 0x1eec]
call fcn.1000bc36
pop ecx
mov dword [ebp - 0x18], 0xe6f9d7b4
mov dword [ebp - 0x14], 0xb4f5ddf5
mov dword [ebp - 0x20], 0xf5e6f9d7
mov dword [ebp - 0x1c], 0xb1b4f5dd
xor eax, eax
xor byte [ebp + eax - 0x18], 0x90
inc eax
cmp eax, 8
jb 0x10005165
xor eax, eax
xor byte [ebp + eax - 0x20], 0x90
inc eax
cmp eax, 8
jb 0x10005172
lea eax, [ebp - 0x70]
push eax
call fcn.1000bc18
push eax
movzx eax, word [ebp - 0x1ee4]
push eax
push dword [ebp - 0x1ee8]
lea eax, [ebp - 0x2e0]
push dword [ebp - 0x1eec]
push str.sysver_u._u._hux64_umac_s
push eax
call fcn.1000dc9e
mov dword [ebp - 0x1f00], eax
lea eax, [ebp - 0x2e0]
add esp, 0x1c
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100051be
sub eax, ecx
lea esi, [ebp - 0x2e0]
push eax
mov ebx, esi
lea edi, [ebp - 0x18]
call fcn.1000bba2
pop ecx
lea eax, [ebp - 0x1ee0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp - 0x1f00]
mov ecx, esi
lea eax, [ebp + eax*2 - 0x1ee0]
push ecx
call fcn.1000bb25
pop ecx
pop ecx
xor esi, esi
lea eax, [ebp - 0x1ee4]
push eax
lea edx, [ebp - 0x1ef0]
lea ecx, [ebp - 0x1ee0]
mov dword [ebp - 0x1f00], esi
mov dword [ebp - 0x1ef0], esi
mov dword [ebp - 0x1ee4], esi
call fcn.100010b2
cmp eax, 0xc8
jne 0x100056b5
mov ebx, dword [ebp - 0x1ef0]
mov dword [ebp - 0x1f00], 1
cmp ebx, esi
je 0x100056ca
push dword [ebp - 0x1ee4]
mov esi, ebx
lea edi, [ebp - 0x20]
call fcn.1000bba2
cmp dword [ebp - 0x1ee4], 0
pop ecx
je 0x100056b5
push ebx
call fcn.1001ac2c
pop ecx
mov dword [ebp - 0x1f20], eax
test eax, eax
je 0x100056b5
push str.popads
push eax
xor ebx, ebx
xor edi, edi
call fcn.1001b40c
pop ecx
pop ecx
mov dword [ebp - 0x1efc], eax
cmp eax, ebx
je 0x100052ba
push 0x10024f88
push eax
call fcn.1001b40c
pop ecx
pop ecx
cmp eax, ebx
je 0x100052ba
push eax
call fcn.1001afaa
mov edi, eax
neg edi
sbb edi, edi
pop ecx
neg edi
mov dword [ebp - 0x5c], 0xcca3cc9f
mov dword [ebp - 0x58], 0xccb8ccaa
mov dword [ebp - 0x54], 0xccadccbb
mov dword [ebp - 0x50], 0xcca9ccbe
mov dword [ebp - 0x4c], 0xcc98cc90
mov dword [ebp - 0x48], 0xcca2cca9
mov dword [ebp - 0x44], 0xcca9ccaf
mov dword [ebp - 0x40], 0xccb8cca2
mov dword [ebp - 0x3c], 0xccaecc90
mov dword [ebp - 0x38], 0xccabccb9
mov dword [ebp - 0x34], 0xcca9cc9e
mov dword [ebp - 0x30], 0xcca3ccbc
mov dword [ebp - 0x2c], 0xccb8ccbe
mov dword [ebp - 0x28], 0xcc9dcc90
mov dword [ebp - 0x24], 0xcccccc9d
mov dword [ebp - 0x1f0c], ebx
mov dword [ebp - 0x1f08], ebx
mov dword [ebp - 0x1f04], ebx
mov dword [ebp - 4], ebx
xor eax, eax
xor byte [ebp + eax - 0x5c], 0xcc
inc eax
cmp eax, 0x3c
jb 0x1000533a
call fcn.1000bc18
neg eax
sbb eax, eax
lea ecx, [ebp - 0x5c]
push ecx
and eax, 0x100
or eax, 0x2001f
push SysReAllocString
lea ecx, [ebp - 0x1f0c]
call fcn.100025ff
test eax, eax
jne 0x1000569e
mov esi, str.Items
push esi
push dword [ebp - 0x1f0c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp edi, ebx
je 0x10005693
push str.items
push dword [ebp - 0x1efc]
call fcn.1001b40c
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0x1f1c], edi
cmp edi, ebx
je 0x10005693
push 5
push edi
call fcn.1001adfb
pop ecx
pop ecx
test eax, eax
je 0x10005693
push edi
call fcn.1001b244
pop ecx
mov dword [ebp - 0x1efc], eax
cmp eax, ebx
je 0x10005693
mov dword [ebp - 0x1f18], ebx
mov dword [ebp - 0x1f14], ebx
mov dword [ebp - 0x1f10], ebx
push esi
mov byte [ebp - 4], 1
push dword [ebp - 0x1f0c]
mov eax, 0x20006
lea ecx, [ebp - 0x1f18]
call fcn.100025ff
test eax, eax
jne 0x10005688
mov esi, 0x7ff
push esi
lea eax, [ebp - 0xadf]
push ebx
push eax
mov byte [ebp - 0xae0], bl
call fcn.1000e030
add esp, 0xc
push esi
lea eax, [ebp - 0x12df]
push ebx
push eax
mov byte [ebp - 0x12e0], bl
call fcn.1000e030
add esp, 0xc
mov dword [ebp - 0x1eec], ebx
mov dword [ebp - 0x1ef8], ebx
mov dword [ebp - 0x1ef4], ebx
mov dword [ebp - 0x1ee8], ebx
mov dword [ebp - 0x1ee4], ebx
cmp dword [ebp - 0x1efc], ebx
jbe 0x1000567d
push dword [ebp - 0x1ee4]
push dword [ebp - 0x1f1c]
call fcn.1001b265
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x10005665
push 4
pop esi
push esi
push edi
call fcn.1001adfb
pop ecx
pop ecx
test eax, eax
je 0x10005665
push 0x10024fa0
push edi
mov byte [ebp - 0xae0], bl
call fcn.1001b40c
pop ecx
pop ecx
cmp eax, ebx
je 0x10005665
push eax
call fcn.1001b20e
pop ecx
cmp eax, ebx
je 0x10005665
cmp byte [eax], bl
je 0x10005665
lea edx, [ebp - 0xae0]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x100054d4
push str.keeptime
push edi
call fcn.1001b40c
pop ecx
pop ecx
cmp eax, ebx
je 0x100054fc
push eax
call fcn.1001afaa
pop ecx
mov dword [ebp - 0x1eec], eax
cmp dword [ebp - 0x1eec], ebx
jne 0x1000550e
mov dword [ebp - 0x1eec], 0x12c
push str.width
push edi
call fcn.1001b40c
pop ecx
pop ecx
cmp eax, ebx
je 0x1000552c
push eax
call fcn.1001afaa
pop ecx
mov dword [ebp - 0x1ef8], eax
cmp dword [ebp - 0x1ef8], ebx
jne 0x1000553e
mov dword [ebp - 0x1ef8], 0x2e9
push str.height
push edi
call fcn.1001b40c
pop ecx
pop ecx
cmp eax, ebx
je 0x1000555c
push eax
call fcn.1001afaa
pop ecx
mov dword [ebp - 0x1ef4], eax
cmp dword [ebp - 0x1ef4], ebx
jne 0x1000556e
mov dword [ebp - 0x1ef4], 0x186
push str.loopspec
push edi
call fcn.1001b40c
pop ecx
pop ecx
cmp eax, ebx
je 0x1000558c
push eax
call fcn.1001afaa
pop ecx
mov dword [ebp - 0x1ee8], eax
cmp dword [ebp - 0x1ee8], ebx
jne 0x1000559e
mov dword [ebp - 0x1ee8], 0x15180
push str.dockat
push edi
call fcn.1001b40c
pop ecx
pop ecx
cmp eax, ebx
je 0x100055c4
push eax
call fcn.1001afaa
mov esi, eax
pop ecx
cmp esi, ebx
jl 0x100055c1
cmp esi, 4
jle 0x100055c4
push 4
pop esi
lea eax, [ebp - 0xae0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
push eax
lea eax, [ebp - 0xae0]
push eax
xor ecx, ecx
lea ebx, [ebp - 0x80]
call fcn.1000b95d
add esp, 0xc
test eax, eax
je 0x100055fd
mov eax, ebx
push 0x10
push eax
lea eax, [ebp - 0xe0]
call fcn.1000bb25
pop ecx
pop ecx
push esi
push dword [ebp - 0x1ef4]
lea eax, [ebp - 0xae0]
push dword [ebp - 0x1ef8]
push dword [ebp - 0x1eec]
push dword [ebp - 0x1ee8]
push eax
lea eax, [ebp - 0x12e0]
push str._s_u_u_u_u_u
push eax
call fcn.1000dc9e
mov esi, eax
push 0xd8
push esi
lea eax, [ebp - 0x12e0]
call fcn.1000c9ba
add esp, 0x28
push esi
lea eax, [ebp - 0x12e0]
push eax
push 3
push 0
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0x1f18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ebx, ebx
inc dword [ebp - 0x1ee4]
mov eax, dword [ebp - 0x1ee4]
cmp eax, dword [ebp - 0x1efc]
jb 0x10005469
lea esi, [ebp - 0x1f18]
call fcn.10002e24
lea esi, [ebp - 0x1f18]
call fcn.10002e24
lea esi, [ebp - 0x1f0c]
call fcn.10002e24
push dword [ebp - 0x1f20]
call fcn.1001ad94
pop ecx
lea esi, [ebp - 0x1f0c]
call fcn.10002e24
cmp dword [ebp - 0x1ef0], 0
je 0x100056ca
push dword [ebp - 0x1ef0]
call fcn.1000d0f1
pop ecx
mov eax, dword [ebp - 0x1f00]
jmp 0x100056d4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000cdb3
leave
ret