Function at 0x10002ec0
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x804], ecx
mov dword [ebp - 0x808], 0
test ebx, ebx
jne 0x10002f01
mov eax, 0x57
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10004797
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx], 0
je 0x10002eeb
cmp dword [ebx + 4], 0
je 0x10002eeb
cmp byte [ebx + 8], 0
je 0x10002eeb
cmp byte [ebx + 0x28], 0
je 0x10002eeb
push esi
push edi
push 0x3ff
lea eax, [ebp - 0x483]
mov byte [ebp - 0x484], 0
push 0
push eax
call fcn.1000c7d0
push 0x138
lea eax, [ebp - 0x5bc]
mov dword [ebp - 0x5c0], 0
push 0
push eax
call fcn.1000c7d0
mov ecx, 0x4f
lea edi, [ebp - 0x6fc]
mov esi, ebx
lea edx, [ebp - 0x5c0]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x804]
add esp, 0x18
mov eax, dword [ecx]
push edx
call dword [eax + 0x14]
test eax, eax
jne 0x1000318a
mov esi, dword [ebp - 0x5c0]
test esi, esi
je 0x1000318a
mov edi, dword [ebp - 0x5bc]
test edi, edi
je 0x1000318a
push 0x100
push eax
mov dword [ebp - 0x800], eax
lea eax, [ebp - 0x7fc]
push eax
call fcn.1000c7d0
add esp, 0xc
cmp byte [0x1001d658], 1
je 0x10003078
cmp dword [ebp + 0xc], 0
je 0x10003078
cmp dword [ebx], esi
jne 0x1000301f
cmp dword [ebx + 4], edi
jne 0x1000301f
push 0x10019844
lea eax, [ebp - 0x7fc]
mov dword [ebp - 0x800], 0x11
push 0x100
push eax
call fcn.10004d30
mov dx, word [ebx + 0x52]
lea eax, [ebp - 0x7fc]
mov ecx, dword [ebx + 0x4c]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 0x28]
push eax
push dword [ebp - 0x800]
push dword [ebx + 4]
push dword [ebx]
call fcn.10002260
add esp, 0x24
jmp 0x10003065
push edi
push esi
lea eax, [ebp - 0x7fc]
mov dword [ebp - 0x800], 0xa
push str._up_u
push eax
call fcn.10003ff0
mov dx, word [ebx + 0x52]
lea eax, [ebp - 0x7fc]
mov ecx, dword [ebx + 0x4c]
push eax
lea eax, [ebx + 8]
push eax
lea eax, [ebx + 0x28]
push eax
push dword [ebp - 0x800]
push dword [ebx + 4]
push dword [ebx]
call fcn.10002260
add esp, 0x28
mov esi, dword [ebp - 0x5c0]
mov edi, dword [ebp - 0x5bc]
mov byte [0x1001d658], 1
mov dword [ebp - 0x6fc], esi
cmp dword [ebx + 4], edi
je 0x10003109
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x6b0], eax
movzx eax, word [ebp - 0x570]
mov word [ebp - 0x6ac], ax
movzx eax, word [ebp - 0x56e]
mov word [ebp - 0x6aa], ax
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x6d4]
push 0x20
push eax
call fcn.10004d30
mov eax, dword [ebp - 0x56c]
add esp, 0xc
mov ecx, dword [ebp - 0x6a4]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x568]
test eax, eax
cmovne ecx, eax
cmp word [ebp - 0x524], 0
mov dword [ebp - 0x6a4], ecx
je 0x10003146
lea eax, [ebp - 0x524]
push eax
jmp 0x1000314b
mov eax, dword [ebp - 0x6a8]
test eax, eax
cmove eax, dword [ebp - 0x56c]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a4]
test eax, eax
cmove eax, dword [ebp - 0x568]
cmp word [ebp - 0x524], 0
mov dword [ebp - 0x6a4], eax
je 0x10003146
lea eax, [ebp - 0x524]
push eax
jmp 0x1000314b
push str.udwnapi
lea eax, [ebp - 0x660]
push 0x20
push eax
call fcn.100051ae
add esp, 0xc
cmp word [ebp - 0x564], 0
je 0x1000317e
lea eax, [ebp - 0x564]
push eax
lea eax, [ebp - 0x6a0]
push 0x20
push eax
call fcn.100051ae
add esp, 0xc
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x6f8], eax
movzx eax, byte [0x1001d658]
mov ecx, 1
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x804], 8
cmovne eax, ecx
mov byte [0x1001d658], al
lea eax, [ebp - 0x804]
push eax
push 0x400
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x6fc]
push eax
call fcn.10004380
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x10003278
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
call fcn.1000c7d0
push str.SystemCurrentControlSetControl
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.100051ae
add esp, 0x18
lea eax, [ebp - 0x808]
push eax
push 0xf003f
push esi
lea eax, [ebp - 0x84]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10003278
push dword [ebp - 0x804]
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x484]
push eax
push 3
push esi
lea eax, [ebp - 0x84]
mov dword [ebp - 0x84], 0x640055
push eax
push dword [ebp - 0x808]
mov dword [ebp - 0x80], 0x4f0066
mov dword [ebp - 0x7c], 0x740070
mov dword [ebp - 0x78], 0x6f0069
mov dword [ebp - 0x74], 0x73006e
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 0x808]
test eax, eax
je 0x10003289
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004797
mov esp, ebp
pop ebp
ret 8