Function at 0x1001abc5
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov eax, 0x1005f4bd
call fcn.1005e6e0
sub esp, 0xf4
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
mov edi, ecx
je 0x1001acd0
cmp byte [ebp + 0x24], 0
je 0x1001aca4
mov dword [ebp - 0x18], 0x2c0f
xor ebx, ebx
cmp dword [ebp - 0x18], 0x2cd1
jle 0x1001ac61
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov ecx, ebx
mov dword [ebp + 8], ebx
mov eax, esi
mov dword [ebp - 0x38], ebx
cdq
idiv ecx
mov esi, edx
mov eax, esi
mov ecx, 0x1007ab78
xor eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10001bfe
inc ebx
cmp ebx, 0x5f0b
jl 0x1001ac1b
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x20]
inc ecx
mov dword [ebp + 8], ecx
push 0
pop ebx
cmp ecx, 0x3ae3
jl 0x1001ac11
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x2c2c
jl 0x1001ac0c
inc edi
cmp edi, 0x3a49
jl 0x1001ac07
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x292a
jge 0x1001ac9a
mov edx, str.vkrqvlq_ldv_znelmde_ayaa_myc_aljbn
mov ecx, 0x1007ab78
call fcn.100039fb
jmp 0x1001ac9a
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
jmp 0x1001b55d
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1001b55d
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x3342eb90
inc dword [edx]
cmp dword [edx], 3
jl 0x1001acb9
jmp 0x1001b55d
cmp byte [ebp + 0x20], 0
je 0x1001acf8
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x1001acee
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xa151cd25
inc dword [edx]
cmp dword [edx], 4
jl 0x1001ace1
jmp 0x1001b55d
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 0x28]
xor ecx, ecx
mov dword [ebp - 0x1c], 0xfffffffe
inc ecx
mov dword [ebp - 0x24], 0x270f9e3
mov dword [ebp - 0x20], 0x2522abf7
mov dword [ebp - 0x20], 0x40dfe9f4
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], 0x509b9552
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], ebx
jmp 0x1001ad45
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x58], 0x93bd5de1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x1001ad37
cmp dword [ebp - 0x1c], ebx
je 0x1001ad58
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x58]
xor edx, edx
mov dword [ebp - 0x58], 0xf7d9
mov eax, dword [ebp - 0x1c]
cmp eax, 0x1585d
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
push edi
setge cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x20], ecx
inc edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 0xa1c1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setne cl
imul eax, ecx, 0xf1e2
lea ecx, [ebp - 0x84]
cmp eax, 0x91f199e1
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
call fcn.10001d13
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0x3099cfe0
mov dword [ebp - 0x24], 0x7c422d5f
mov dword [ebp - 0x2c], 0x9305
mov dword [ebp - 0x18], ebx
jmp 0x1001ae10
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x54], 0xf07b4bc6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001ae02
lea eax, [ebp - 0x28]
push eax
sub esp, 0xc
call fcn.1001bd3c
add esp, 0x10
mov dword [ebp - 0x28], ebx
jmp 0x1001aeea
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], 0xcaf1e2cd
mov dword [ebp - 0x14], ebx
jmp 0x1001ae50
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8], 0x520f3038
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001ae3f
mov dword [ebp - 0x14], ebx
jmp 0x1001ae69
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64], 0xdefcecb2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001ae5b
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x18], 0xd06721f7
cmp dword [ebp - 0x50], ebx
jne 0x1001ae80
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x54]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0xa4], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x54]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x54]
cmp edx, eax
setl cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0x74006310
setg cl
mov dword [ebp - 0x64], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jle 0x1001ae2d
push ecx
push esi
lea ecx, [ebp - 0x84]
call fcn.1001daf4
mov dword [ebp - 0x44], eax
cmp eax, 0xffffffff
je 0x1001b129
mov dword [ebp - 0x1c], 0xd6c05baf
mov dword [ebp - 0x1c], 0xfffffffd
cmp dword [ebp - 0x1c], 0x11
jl 0x1001b0f7
mov dword [ebp - 0x14], 0xd14cd495
xor edx, edx
inc edx
mov ecx, 0xffff06f2
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x40], 0xdb6377f0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
sub ecx, eax
add ecx, dword [ebp - 0x1c]
xor eax, eax
cmp ecx, 4
mov ecx, dword [ebp - 0x1c]
setle al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x14]
jg 0x1001afd6
mov dword [ebp - 0x2c], 0x20dd93ba
mov dword [ebp - 0x18], ebx
jmp 0x1001af80
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa0], 0xad5befa1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001af6f
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1001b0ef
push 0x725
push ecx
push edx
sub esp, 0xc
mov byte [ebp + 0xb], bl
mov edx, 0x466a
lea ecx, [ebp + 0xb]
call fcn.1001968d
mov eax, dword [ebp - 0x14]
xor edx, edx
add esp, 0x18
mov eax, dword [ebp + eax*4 - 0xa0]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
push 1
setne dl
mov dword [ebp - 0x2c], edx
dec dword [ebp - 0x14]
pop edx
jns 0x1001af92
jmp 0x1001b0ef
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 0x81a
cmp dword [ebp - 0x18], 0x9fb
jle 0x1001b040
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x20], 0x76aa
mov dword [ebp - 0x40], ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x1007ab78
cdq
push edx
push eax
call fcn.10001bfe
inc ebx
cmp ebx, 0x723b
jl 0x1001affa
add edi, esi
dec dword [ebp - 0x20]
push 0
pop ebx
jne 0x1001aff7
inc esi
cmp esi, 0xd7e
jl 0x1001afee
push ebx
push ebx
push 0x1f06
push 0x5d4
push 0xfaf
call dword [sym.imp.USER32.dll_ScrollWindow]
mov dword [ebp - 0x20], 0xf6679856
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 0x69b
jge 0x1001b087
mov edx, str.giwjzr_hzfkhci_wmtry_ngigkie_viunoq_berzl_suyysfmw_wokxfethi_iwd_gpmddfz_jnmljnu_skr
mov ecx, 0x1007ab78
call fcn.100039fb
jmp 0x1001b087
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], ebx
jne 0x1001b096
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
test edx, edx
jns 0x1001b0b3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
add ecx, 0x68d3
cmp ecx, 0xfffffffd
setle al
imul eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x725dc8ff
setg al
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x1c]
jmp 0x1001af1b
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x84]
inc eax
push eax
push ebx
lea eax, [ebp - 0xd0]
push eax
call fcn.1001db7a
push eax
lea ecx, [ebp - 0x84]
call fcn.10001d4e
push ebx
push 1
lea ecx, [ebp - 0xd0]
call fcn.100021bc
mov dword [ebp - 0x1c], 0xffffffff
xor edx, edx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x20], 0x9124c6e1
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], 1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x1fb9
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, edx
setle cl
imul eax, ecx, 0x4b26
sub eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
jns 0x1001b1a2
push ecx
call fcn.1001c915
jmp 0x1001b339
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x5c], 0x2ee8b720
mov dword [ebp - 0x14], 0x4c3c
cmp dword [ebp - 0x14], 0x4e95
jle 0x1001b209
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x2c], 0x3a24
mov dword [ebp - 0x40], ebx
mov eax, edi
mov ecx, 0x1007ab78
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001bfe
inc ebx
cmp ebx, 0x7f7c
jl 0x1001b1ce
add edi, esi
dec dword [ebp - 0x2c]
push 0
pop ebx
jne 0x1001b1cb
inc esi
cmp esi, 0x8bd
jl 0x1001b1c2
push 0x10eb
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], 0x4902
jge 0x1001b249
mov edx, str.niraoeeci_cmc_svbi_ymtrru_bnftucc_gfmgrq_bpurejf_auritlsqf_nhqel_swcbcbgha_ytuagdfl_gojejver
mov ecx, 0x1007ab78
call fcn.100039fb
jmp 0x1001b249
push 2
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1001b265
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x98], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001b254
mov dword [ebp - 0x14], ebx
jmp 0x1001b280
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb8], 0xb8a8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001b26f
call fcn.1001ab83
cmp dword [ebp - 0x18], ebx
je 0x1001b29a
cmp dword [ebp - 0x1c], ebx
je 0x1001b29a
xor edx, edx
inc edx
jmp 0x1001b29c
mov edx, ebx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, edx
setne cl
sub ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x24]
je 0x1001b2bc
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x5c], 0x2bb1
sub eax, 0x4a5bf585
je 0x1001b32a
mov dword [ebp - 0x24], 0x9c94
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setl dl
cmp edx, 0xe821
jle 0x1001b2f7
cmp dword [ebp - 0x14], ebx
jne 0x1001b2fa
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xb4]
imul ecx, eax, 0xf60
mov eax, dword [ebp - 0x94]
cmp ecx, eax
setne dl
mov dword [ebp - 0x14], edx
jmp 0x1001b33a
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x1001b33a
push ecx
call fcn.10019917
pop ecx
mov dword [ebp - 0x38], 0x1ef8
cmp dword [ebp - 0x38], 0x2166
jle 0x1001b39d
push ebx
push 0xa7c
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0xe8]
or eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001b376
mov eax, dword [eax]
push eax
call fcn.10047d34
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xe8]
call fcn.10002050
inc edi
cmp edi, 0x1523
jl 0x1001b35a
inc esi
cmp esi, 0x60b9
jl 0x1001b358
push ecx
lea eax, [ebp - 0x6c]
mov edx, 0x4003
push eax
push ebx
mov ecx, 0x6458
call fcn.10019748
add esp, 0xc
cmp dword [ebp - 0x38], 0x1db1
jge 0x1001b3c9
push str.leldw_lcikrj_kcop_mbltnwa_hqoshka_bjez_afwyzo_yckyrzqln_goxghxgp
call fcn.10047d34
pop ecx
mov edx, dword [ebp - 0x48]
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 2
push eax
push ecx
call fcn.1001c77d
add esp, 0xc
cmp dword [ebp - 0x44], 0xffffffff
je 0x1001b4f1
push 1
lea ecx, [ebp - 0x90]
call fcn.1000efc4
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0x3c], 0xecf54c3c
push 0x17d7
mov dword [ebp - 0x60], ebx
mov edx, 0x5a6
push eax
xor cl, cl
call fcn.1001ca5d
add esp, 0xc
mov dword [ebp - 0x3c], ebx
jmp 0x1001b496
push 0x2297
push 0x442
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0xc4530722
push eax
push 0x5b89
push ebx
push ebx
lea eax, [ebp - 0x3c]
mov edx, 0x4bb2
push eax
lea eax, [ebp - 0x90]
mov cl, 1
push eax
call fcn.1001c7ab
add esp, 0x20
mov dword [ebp - 0x34], ebx
jmp 0x1001b48d
lea eax, [ebp - 0x90]
push eax
push ecx
push ebx
sub esp, 0xc
lea edx, [ebp - 0x34]
mov ecx, 0x1d1f
call fcn.1001968d
add esp, 0x18
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 1
jl 0x1001b46e
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], ebx
jle 0x1001b433
push ebx
push 0x2ab9
mov edx, 0x778f
lea ecx, [ebp - 0x60]
call fcn.100198e2
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x90]
call fcn.1000f047
push 0xffffffffffffffff
push dword [ebp - 0x44]
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x84]
call fcn.1001db7a
push eax
lea ecx, [ebp - 0x84]
call fcn.10001d4e
push ebx
push 1
lea ecx, [ebp - 0x100]
call fcn.100021bc
mov dword [ebp - 0x48], 0x5933
cmp dword [ebp - 0x48], 0x5bbe
jle 0x1001b537
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x1007ab78
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001bfe
inc edi
cmp edi, 0x4cc5
jl 0x1001b511
inc esi
cmp esi, 0x29a7
jl 0x1001b50f
mov eax, dword [ebp + 0x28]
lea ecx, [ebp - 0x84]
cmp eax, ecx
je 0x1001b54f
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.100020e2
push ebx
push 1
lea ecx, [ebp - 0x84]
call fcn.100021bc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret