Function at 0x10005900
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c3f2b
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x10244540]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x184], edx
mov edi, ecx
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x118], edi
mov ah, 0x17
mov al, ah
mov byte [ebp - 0x170], ah
xor al, 0x53
mov dword [ebp - 0x17c], 0
mov byte [ebp - 0x148], al
mov dl, ah
mov al, ah
mov dword [ebp - 0x178], 0
xor al, 0x4f
mov dword [ebp - 0x174], 0
mov byte [ebp - 0x147], al
xor dl, 0x5c
mov al, ah
mov byte [ebp - 0x140], dl
xor al, 0x46
mov byte [ebp - 0x137], dl
mov byte [ebp - 0x146], al
mov cl, ah
mov al, ah
mov dword [ebp - 0x180], 0x101f3fb8
xor al, 0x54
mov byte [ebp - 0x136], 0
mov byte [ebp - 0x145], al
xor cl, 0x69
mov al, ah
mov byte [ebp - 0x13c], cl
xor al, 0x57
mov byte [ebp - 0x13a], cl
mov byte [ebp - 0x144], al
xorps xmm0, xmm0
mov al, ah
xor edx, edx
xor al, 0x41
mov byte [ebp - 0x143], al
mov al, ah
xor al, 0x52
mov byte [ebp - 0x142], al
mov al, ah
xor al, 0x45
mov byte [ebp - 0x141], al
mov al, ah
xor al, 0x50
mov byte [ebp - 0x13f], al
mov al, ah
xor al, 0x6f
mov byte [ebp - 0x13e], al
mov al, ah
xor al, 0x6c
mov byte [ebp - 0x13d], al
mov al, ah
xor al, 0x63
mov byte [ebp - 0x13b], al
mov al, ah
xor al, 0x65
xor ah, 0x73
movups xmmword [ebp - 0x16c], xmm0
mov byte [ebp - 0x139], al
xor esi, esi
movups xmmword [ebp - 0x15c], xmm0
mov byte [ebp - 0x138], ah
nop word [eax + eax]
mov eax, esi
add esi, 0x5bd1e995
xor eax, 0xb895047e
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
sar eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
sar eax, 0xf
xor eax, ecx
mov dword [ebp + edx*4 - 0x16c], eax
inc edx
cmp edx, 8
jb 0x10005a40
push 0x12
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x180]
call fcn.100046f0
mov dword [ebp - 0x14c], eax
xor edx, edx
mov dword [ebp - 4], 0
xor esi, esi
nop word [eax + eax]
mov eax, esi
add esi, 0x5bd1e995
xor eax, 0xb895047e
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
sar eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
sar eax, 0xf
xor eax, ecx
mov dword [ebp + edx*4 - 0x16c], eax
inc edx
cmp edx, 8
jb 0x10005ab0
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x178]
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x178], esi
mov dword [ebp - 0x174], eax
cmp esi, ecx
ja 0x10005b9e
push esi
call fcn.101a087d
mov ecx, eax
add esp, 4
mov dword [ebp - 0x17c], ecx
test ecx, ecx
je 0x10005b9e
mov eax, dword [ebp - 0x14c]
add esi, 0xfffffff8
push esi
add eax, 8
push eax
push ecx
call fcn.10190960
mov ecx, dword [ebp - 0x17c]
lea eax, [ebp - 0x16c]
push eax
push 0
mov edx, esi
call fcn.10004600
mov edx, dword [ebp - 0x17c]
add esp, 0x14
test edx, edx
je 0x10005b9e
movsx eax, byte [ebp - 0x170]
mov ecx, 0x10
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
movups xmm0, xmmword [edx]
xorps xmm1, xmm0
movups xmmword [edx], xmm1
lea eax, [edx + ecx]
mov dl, byte [ebp - 0x170]
xor byte [eax], dl
inc ecx
mov edx, dword [ebp - 0x17c]
cmp ecx, 0x12
jb 0x10005b81
mov byte [edx + 0x12], 0
jmp 0x10005ba0
xor edx, edx
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005ba5
sub ecx, esi
mov eax, bind
mov esi, dword [ebp - 0x184]
sub eax, dword [esi + 0x10]
cmp eax, ecx
jb 0x10005f18
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x10005bce
mov eax, dword [esi]
push dword [esi + 0x10]
push eax
push ecx
push edx
push esi
push dword [ebp - 0x118]
lea ecx, [ebp - 0x130]
call fcn.100198c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x134]
cmp dword [ebp - 0x11c], 0xf
lea eax, [ebp - 0x130]
push ecx
cmova eax, dword [ebp - 0x130]
push 0x20019
push 0
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x118], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10005ec5
mov dword [ebp - 0x174], eax
mov ch, 0x71
mov dword [ebp - 0x170], eax
mov dl, ch
mov dword [ebp - 0x16c], eax
xor dl, 0x44
mov al, ch
mov byte [ebp - 0x168], ch
xor al, 0x55
mov byte [ebp - 0x13c], dl
mov byte [ebp - 0x140], al
mov ah, ch
mov al, ch
mov byte [ebp - 0x138], dl
xor al, 0x73
mov dword [ebp - 0x178], 0x101ec19c
mov byte [ebp - 0x13f], al
mov cl, ch
mov al, ch
mov byte [ebp - 0x135], 0
xor al, 0x65
xor ah, 0x72
mov byte [ebp - 0x13e], al
xor cl, 0x61
mov al, ch
mov byte [ebp - 0x13d], ah
xorps xmm0, xmm0
mov byte [ebp - 0x13b], cl
xor al, 0x74
mov byte [ebp - 0x139], cl
xor ch, 0x69
mov byte [ebp - 0x13a], al
xor edx, edx
mov byte [ebp - 0x137], ch
movups xmmword [ebp - 0x164], xmm0
mov byte [ebp - 0x136], ah
xor esi, esi
movups xmmword [ebp - 0x154], xmm0
nop
mov eax, esi
add esi, 0x5bd1e995
xor eax, 0xb895047e
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
sar eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
sar eax, 0xf
xor eax, ecx
mov dword [ebp + edx*4 - 0x164], eax
inc edx
cmp edx, 8
jb 0x10005cd0
push 0xb
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x178]
call fcn.100046f0
xor edx, edx
mov dword [ebp - 0x144], eax
xor esi, esi
nop
mov eax, esi
add esi, 0x5bd1e995
xor eax, 0xb895047e
imul ecx, eax, 0x286a90b9
xor ecx, 0xaa2a7357
mov eax, ecx
sar eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
sar eax, 0xf
xor eax, ecx
mov dword [ebp + edx*4 - 0x164], eax
inc edx
cmp edx, 8
jb 0x10005d30
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x170]
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x170], esi
mov dword [ebp - 0x16c], eax
cmp esi, ecx
ja 0x10005dfd
push esi
call fcn.101a087d
mov ecx, eax
add esp, 4
mov dword [ebp - 0x174], ecx
test ecx, ecx
je 0x10005dfd
mov eax, dword [ebp - 0x144]
add esi, 0xfffffff8
push esi
add eax, 8
push eax
push ecx
call fcn.10190960
mov ecx, dword [ebp - 0x174]
lea eax, [ebp - 0x164]
push eax
push 0
mov edx, esi
call fcn.10004600
mov edx, dword [ebp - 0x174]
add esp, 0x14
test edx, edx
je 0x10005dfd
xor ecx, ecx
nop dword [eax]
lea eax, [edx + ecx]
mov dl, byte [ebp - 0x168]
xor byte [eax], dl
inc ecx
mov edx, dword [ebp - 0x174]
cmp ecx, 0xb
jb 0x10005de0
mov byte [edx + 0xb], 0
jmp 0x10005dff
xor edx, edx
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push edx
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x134]
test eax, eax
jne 0x10005ebf
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea ecx, [ebp - 0x114]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
lea edx, [ecx + 1]
mov dword [edi + 0x14], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005e50
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
mov ecx, edi
call fcn.100191c0
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0xf
jbe 0x10005ea2
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10005e98
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005f13
push ecx
push edx
call fcn.1018eb3e
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1018e7c9
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
mov ecx, edi
push 0
movups xmmword [edi], xmm0
push 0x101ebc35
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.100191c0
mov ecx, dword [ebp - 0x11c]
cmp ecx, 0xf
jbe 0x10005ea2
mov edx, dword [ebp - 0x130]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10005e98
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10005e98
call fcn.1019b181
call fcn.10001750
int3