Function at 0x10001be0
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001fb28
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x1002b130]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0xe34], 8
lea eax, [esi + 0xe20]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov byte [ebp - 0x45], 0
jb 0x10001c28
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x50]
call fcn.10001490
lea edx, [esi + 0x20]
mov dword [ebp - 4], 0
test edx, edx
jne 0x10001c43
xor eax, eax
jmp 0x10001c60
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0x4c], ecx
jmp 0x10001c50
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001c50
sub eax, dword [ebp - 0x4c]
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x50]
call fcn.10001eb0
push ebx
push dword [ebp - 0x50]
mov ecx, esi
push VariantInit
call fcn.10002950
mov ecx, eax
mov dword [ebp - 0x54], ecx
test ecx, ecx
je 0x10001dc2
push ebx
lea eax, [esi + 0x620]
push eax
push ecx
mov ecx, esi
call fcn.10002950
mov dword [ebp - 0x58], eax
test eax, eax
je 0x10001db9
cmp dword [edi + 0x14], 8
jb 0x10001caa
mov edi, dword [edi]
push ebx
push edi
push eax
mov ecx, esi
call fcn.10002950
mov edi, eax
test edi, edi
je 0x10001dae
push ebx
lea eax, [esi + 0x820]
mov ecx, esi
push eax
push edi
call fcn.10002950
mov ebx, eax
test ebx, ebx
je 0x10001da3
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
push 4
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x4c]
push eax
push 4
push 0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x6c0042
push eax
push ebx
mov dword [ebp - 0x40], 0x63006f
mov dword [ebp - 0x3c], 0x65006b
mov dword [ebp - 0x38], 0x64
mov dword [ebp - 0x34], 0x6f0043
mov dword [ebp - 0x30], 0x6e0075
mov dword [ebp - 0x2c], 0x74
mov dword [ebp - 0x28], 0x6c0046
mov dword [ebp - 0x24], 0x670061
mov dword [ebp - 0x20], 0x73
mov dword [ebp - 0x1c], 0x790054
mov dword [ebp - 0x18], 0x650070
mov dword [ebp - 0x4c], 1
call esi
push 4
lea eax, [ebp - 0x4c]
push eax
push 4
push 0
lea eax, [ebp - 0x34]
push eax
push ebx
call esi
push 4
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 0
push eax
push 4
push 0
lea eax, [ebp - 0x28]
push eax
push ebx
call esi
push 4
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 3
push eax
push 4
push 0
lea eax, [ebp - 0x1c]
push eax
push ebx
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call esi
push edi
mov byte [ebp - 0x45], 1
call esi
jmp 0x10001db4
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call esi
jmp 0x10001db4
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x58]
call esi
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x50]
or ecx, 0xffffffff
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10001de6
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0x45]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000ef8b
mov esp, ebp
pop ebp
ret 8