Function at 0x10015ed0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a647e
mov eax, dword fs:[0]
push eax
sub esp, 0x510
mov eax, dword [0x10216040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x510], ecx
mov dword [ebp - 0x514], ecx
push 0x400
lea eax, [ebp - 0x490]
mov dword [ebp - 0x51c], 0
push 0
push eax
mov dword [ebp - 0x514], ecx
mov dword [ebp - 0x4a8], 1
mov dword [ebp - 0x4dc], 0
call fcn.1017cab0
push 0x80
lea eax, [ebp - 0x90]
mov dword [ebp - 0x4a4], 0x400
push 0
push eax
call fcn.1017cab0
xorps xmm0, xmm0
mov dword [ebp - 0x4b0], 0
movups xmmword [ebp - 0x4c0], xmm0
add esp, 0x18
mov dword [ebp - 0x4ac], 0xf
mov byte [ebp - 0x4c0], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x508]
xor esi, esi
movq qword [ebp - 0x4a0], xmm0
xor eax, eax
mov dword [ebp - 0x498], 0
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 0x508], 0x54464f53
xor edi, edi
mov dword [ebp - 0x504], 0x45524157
sub ecx, edx
mov dword [ebp - 0x500], 0x63694d5c
mov dword [ebp - 0x4fc], 0x6f736f72
mov dword [ebp - 0x4f8], 0x575c7466
mov dword [ebp - 0x4f4], 0x6f646e69
mov dword [ebp - 0x4f0], 0x4e207377
mov dword [ebp - 0x4ec], 0x75435c54
mov dword [ebp - 0x4e8], 0x6e657272
mov dword [ebp - 0x4e4], 0x72655674
mov dword [ebp - 0x4e0], 0x6e6f6973
mov dword [ebp - 0x518], esi
mov dword [ebp - 0x4a0], esi
mov dword [ebp - 0x49c], edi
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x494], ecx
je 0x10016095
cmp ecx, 0x7fffffff
ja 0x100165a9
push ecx
lea ecx, [ebp - 0x4a0]
call fcn.10002a90
mov edi, dword [ebp - 0x494]
lea eax, [ebp - 0x508]
mov esi, dword [ebp - 0x4a0]
push edi
push eax
push esi
mov dword [ebp - 0x518], esi
call fcn.1017c530
mov eax, dword [ebp - 0x498]
add esp, 0xc
add edi, esi
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x49c], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4d8]
push 0x40
xorps xmm0, xmm0
mov dword [ebp - 0x4c8], 0
push str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movups xmmword [ebp - 0x4d8], xmm0
mov dword [ebp - 0x4c4], 0
call fcn.1000d570
mov byte [ebp - 4], 3
xor ecx, ecx
mov dword [ebp - 0x4e4], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x51c], 2
mov edx, 0xf
mov dword [ebp - 0x4e0], edx
movups xmmword [ebp - 0x4f4], xmm0
mov byte [ebp - 0x4f4], cl
cmp esi, edi
je 0x10016173
mov edi, esi
mov esi, dword [ebp - 0x49c]
mov al, byte [edi]
mov byte [ebp - 0x494], al
cmp ecx, edx
jae 0x1001613b
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [ebp - 0x4e4], eax
lea eax, [ebp - 0x4f4]
cmova eax, dword [ebp - 0x4f4]
add eax, ecx
mov cl, byte [ebp - 0x494]
mov byte [eax + 1], 0
mov byte [eax], cl
jmp 0x1001615a
push dword [ebp - 0x494]
mov byte [ebp - 0x514], 0
push dword [ebp - 0x514]
push ecx
lea ecx, [ebp - 0x4f4]
call fcn.100151e0
mov edx, dword [ebp - 0x4e0]
inc edi
cmp edi, esi
je 0x1001616d
mov ecx, dword [ebp - 0x4e4]
jmp 0x10016106
mov esi, dword [ebp - 0x518]
cmp edx, 0xf
lea ecx, [ebp - 0x4dc]
lea eax, [ebp - 0x4f4]
cmova eax, dword [ebp - 0x4f4]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov byte [ebp - 4], 2
mov edi, eax
mov ecx, dword [ebp - 0x4e0]
cmp ecx, 0xf
jbe 0x100161d6
mov edx, dword [ebp - 0x4f4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100161cc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100165ae
push ecx
push edx
call fcn.10178716
add esp, 8
test edi, edi
jne 0x100164f1
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x4a8]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x101f1670
push dword [ebp - 0x4dc]
call edi
test eax, eax
jne 0x100164f1
lea eax, [ebp - 0x490]
push eax
lea ecx, [ebp - 0x4c0]
call fcn.1000ccb0
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x4a8]
push eax
push 0
push str.CurrentBuild
push dword [ebp - 0x4dc]
call edi
push dword [ebp - 0x4dc]
test eax, eax
jne 0x100163bf
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x101f168c
lea edx, [ebp - 0x4c0]
lea ecx, [ebp - 0x4f4]
call fcn.10018fe0
add esp, 4
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.1000ccb0
mov edi, dword [ebp - 0x510]
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x4e0]
cmp ecx, 0xf
jbe 0x100162f9
mov edx, dword [ebp - 0x4f4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100162ef
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100165b3
push ecx
push edx
call fcn.10178716
add esp, 8
mov ecx, dword [ebp - 0x4c4]
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 0x4e0], 0xf
mov byte [ebp - 0x4f4], 0
cmp ecx, 0xf
jbe 0x1001634e
mov edx, dword [ebp - 0x4d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016344
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100165b3
push ecx
push edx
call fcn.10178716
add esp, 8
test esi, esi
je 0x10016382
mov ecx, dword [ebp - 0x50c]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x10016378
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100165b3
push ecx
push esi
call fcn.10178716
add esp, 8
mov ecx, dword [ebp - 0x4ac]
cmp ecx, 0xf
jbe 0x1001658c
mov edx, dword [ebp - 0x4c0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016582
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100165b3
jmp 0x10016582
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x101f168c
lea edx, [ebp - 0x4c0]
lea ecx, [ebp - 0x4f4]
call fcn.10018fe0
add esp, 4
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 5
push ecx
mov ecx, eax
call fcn.1000ccb0
mov edi, dword [ebp - 0x510]
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [edi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x4e0]
cmp ecx, 0xf
jbe 0x10016465
mov edx, dword [ebp - 0x4f4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001645b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100165b3
push ecx
push edx
call fcn.10178716
add esp, 8
mov ecx, dword [ebp - 0x4c4]
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 0x4e0], 0xf
mov byte [ebp - 0x4f4], 0
cmp ecx, 0xf
jbe 0x100164ba
mov edx, dword [ebp - 0x4d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100164b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100165b3
push ecx
push edx
call fcn.10178716
add esp, 8
test esi, esi
je 0x10016382
mov ecx, dword [ebp - 0x50c]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x10016378
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100165b3
jmp 0x10016378
mov edi, dword [ebp - 0x510]
xorps xmm0, xmm0
push 0
push 0x101f082c
mov ecx, edi
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
call fcn.1000d570
mov ecx, dword [ebp - 0x4c4]
cmp ecx, 0xf
jbe 0x1001654f
mov edx, dword [ebp - 0x4d8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016545
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100165b3
push ecx
push edx
call fcn.10178716
add esp, 8
test esi, esi
je 0x10016382
mov ecx, dword [ebp - 0x50c]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x10016378
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100165b3
jmp 0x10016378
push ecx
push edx
call fcn.10178716
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101786e5
mov esp, ebp
pop ebp
ret
call fcn.10002a80
call fcn.1018001f
call fcn.1018001f
int3