Function at 0x10004eb0
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x1003e030]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x111
lea eax, [ebp - 0x340]
mov edi, ecx
push 0
push eax
mov dword [ebp - 0x350], edi
call fcn.10019c70
push 0x208
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x364], 0
push 0
push eax
mov dword [ebp - 0x35c], 0
call fcn.10019c70
add esp, 0x18
cmp dword [0x10041d60], 0
jne 0x10004f26
mov eax, 0x15
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018459
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x10004f3c
lea eax, [edi + 0x57]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018459
mov esp, ebp
pop ebp
ret
cmp dword [0x10042188], 1
push esi
mov esi, 0x10041d64
jne 0x1000509b
cmp dword [0x10042178], 2
jne 0x100050c0
lea eax, [ebp - 0x34c]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareAhnLabACA
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x34c], esi
mov dword [ebp - 0x348], esi
mov dword [ebp - 0x344], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000507f
mov eax, dword [ebp - 0x34c]
test eax, eax
je 0x100050dd
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x344]
push ecx
lea ecx, [ebp - 0x348]
mov dword [ebp - 0x344], 4
push ecx
push esi
push esi
push str.DebugLog
push eax
call edi
test eax, eax
jne 0x10005079
cmp dword [ebp - 0x348], 1
jne 0x10005079
lea eax, [ebp - 0x344]
mov dword [ebp - 0x344], 0x103
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
push esi
push str.DebugLogPath
push dword [ebp - 0x34c]
call edi
test eax, eax
jne 0x10005036
push 0x5c
push 0x10041d64
call fcn.1001a840
add esp, 8
test eax, eax
je 0x10005079
cmp byte [eax + 1], 0
je 0x10005079
push eax
lea ecx, [ebp - 0x22c]
call fcn.10004830
test eax, eax
js 0x10005079
jmp 0x10005074
lea ecx, [ebp - 0x22c]
mov esi, 0x10041d64
mov eax, ecx
mov edx, 0x104
sub esi, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10005069
mov al, byte [esi + ecx]
test al, al
je 0x10005069
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10005050
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
mov esi, 1
mov edi, dword [ebp - 0x350]
mov eax, dword [ebp - 0x34c]
test eax, eax
je 0x10005090
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 1
jne 0x100050dd
lea esi, [ebp - 0x22c]
mov eax, dword [0x100421ac]
cmp eax, 1
je 0x1000510a
cmp eax, 2
jne 0x100050ef
cmp dword [0x100421c8], 1
jne 0x1000510a
push 0x100421b0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x1000510a
push 0x104
lea edx, [ebp - 0x22c]
mov ecx, 0x10041d64
call fcn.100070e0
add esp, 4
cmp eax, 1
jmp 0x10005093
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018459
mov esp, ebp
pop ebp
ret
cmp dword [0x100421ac], 3
jne 0x1000510a
mov eax, dword [0x100421cc]
test eax, eax
je 0x1000510a
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x10041d60], 0
jne 0x1000511d
mov edi, 0x15
jmp 0x100054b2
cmp dword [0x10042178], 2
lea edx, [ebp - 0x35c]
mov ecx, esi
jne 0x10005135
call fcn.10005c50
jmp 0x1000513a
call fcn.100059a0
mov dword [ebp - 0x34c], eax
cmp eax, 0xffffffff
jne 0x1000515d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x100054b2
lea edi, [eax + 0x6e]
jmp 0x100054b2
mov ecx, 0x800
mov eax, edi
cmp word [eax], 0
je 0x10005172
add eax, 2
sub ecx, 1
jne 0x10005164
mov eax, 0x800
mov edi, ecx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x10005441
test edi, edi
je 0x10005441
cmp edi, 0x800
mov dword [ebp - 0x344], 0
mov eax, 0x7ff
cmovae edi, eax
mov eax, dword [0x100421a4]
cmp eax, 9
je 0x100051bd
cmp eax, 0xc
je 0x100051bd
cmp eax, 8
jne 0x100051c7
mov dword [ebp - 0x344], 0x3f
push 0
push 0
push 0xfc
lea eax, [ebp - 0x340]
push eax
push edi
push dword [ebp - 0x350]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jne 0x10005317
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x348], eax
cmp eax, 0x7a
je 0x10005220
mov esi, dword [ebp - 0x34c]
mov edi, eax
test edi, edi
jne 0x10005454
mov edi, 0x54f
jmp 0x10005454
push 0
push 0
push 0
push 0
push edi
push dword [ebp - 0x350]
mov dword [ebp - 0x348], 0x57
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jne 0x10005259
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1000544e
mov ecx, dword [ebp - 0x344]
mov eax, esi
cdq
idiv ecx
mov dword [ebp - 0x358], esi
test edx, edx
je 0x10005274
mov eax, ecx
sub eax, edx
add esi, eax
add esi, 0x10
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x360], esi
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.1001eb0e
add esp, 4
mov dword [ebp - 0x354], eax
test eax, eax
je 0x10005448
lea ecx, [esi + 1]
push ecx
push 0
push eax
call fcn.10019c70
add esp, 0xc
mov dword [ebp - 0x364], 1
push 0
push 0
push esi
push dword [ebp - 0x354]
push edi
push dword [ebp - 0x350]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [ebp - 0x358], eax
je 0x1000534d
mov edi, dword [ebp - 0x348]
mov esi, dword [ebp - 0x34c]
mov eax, dword [ebp - 0x354]
test eax, eax
je 0x10005454
cmp dword [ebp - 0x364], 1
jne 0x10005454
push eax
call fcn.1001c393
add esp, 4
jmp 0x10005454
mov ecx, dword [ebp - 0x344]
lea eax, [ebp - 0x340]
mov dword [ebp - 0x354], eax
mov eax, esi
cdq
idiv ecx
test edx, edx
je 0x10005344
mov eax, ecx
sub eax, edx
add esi, eax
cmp esi, 0x100
jg 0x10005437
add esi, 0x10
mov dword [ebp - 0x360], esi
movups xmm0, xmmword [0x100421d0]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x358], 4
mov dword [ebp - 0x350], eax
movups xmmword [ebp - 0x24], xmm0
movups xmm0, xmmword [0x100421e0]
movups xmmword [ebp - 0x14], xmm0
mov esi, dword [eax]
mov edx, 0x2898bd67
mov edi, dword [eax + 4]
mov dword [ebp - 0x348], 0x1f
nop word [eax + eax]
mov ecx, esi
mov eax, esi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, edx
shr eax, 0xd
add ecx, esi
and eax, 3
mov eax, dword [eax*4 + 0x10039220]
add eax, edx
add edx, 0x61c98647
xor ecx, eax
sub edi, ecx
mov ecx, edi
mov eax, edi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, edx
and eax, 3
add ecx, edi
mov eax, dword [eax*4 + 0x10039220]
add eax, edx
xor ecx, eax
sub esi, ecx
sub dword [ebp - 0x348], 1
jne 0x10005390
mov eax, dword [ebp - 0x350]
mov dword [eax], esi
mov dword [eax + 4], edi
add eax, 8
sub dword [ebp - 0x358], 1
mov dword [ebp - 0x350], eax
jne 0x10005376
push dword [ebp - 0x344]
mov esi, dword [ebp - 0x34c]
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x354]
push ecx
push eax
push dword [0x100421a4]
mov ecx, esi
push dword [ebp - 0x360]
call fcn.10005520
add esp, 0x14
mov edi, eax
jmp 0x100052ee
mov edi, 0x57
jmp 0x100052e8
mov edi, 0x57
jmp 0x1000544e
mov edi, dword [ebp - 0x348]
mov esi, dword [ebp - 0x34c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x35c], 1
jne 0x100054b2
cmp dword [0x10042178], 2
push ecx
mov ecx, 0x10041d64
jne 0x10005492
movq xmm0, qword [0x10039028]
lea edx, [ebp - 0x10]
mov al, byte [0x10039030]
movq qword [ebp - 0x10], xmm0
mov byte [ebp - 8], al
call fcn.10006b60
jmp 0x100054af
movups xmm0, xmmword [str.everyone]
mov ax, word [0x10039044]
lea edx, [ebp - 0x18]
mov word [ebp - 8], ax
movups xmmword [ebp - 0x18], xmm0
call fcn.100065e0
add esp, 4
mov eax, dword [0x100421ac]
cmp eax, 1
je 0x10005500
cmp eax, 2
jne 0x100054e7
cmp dword [0x100421c8], 1
jne 0x10005500
push 0x100421b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018459
mov esp, ebp
pop ebp
ret
cmp dword [0x100421ac], 3
jne 0x10005500
mov eax, dword [0x100421cc]
test eax, eax
je 0x10005500
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
mov eax, edi
pop esi
xor ecx, ebp
pop edi
call fcn.10018459
mov esp, ebp
pop ebp
ret