Function at 0x100652e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x74
push 0xffffffffffffffff
push 0x10234b38
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 0x7c]
mov dword [ebp + 0x10], ebx
test eax, eax
je 0x10065812
mov esi, dword [0x1024d1ac]
push str.RegOpenKeyExW
push eax
call esi
push str.RegEnumKeyExW
push dword [edi]
mov dword [ebp + 8], eax
call esi
push str.RegCloseKey
push dword [edi]
mov dword [ebp + 0xc], eax
call esi
cmp dword [ebp + 8], 0
mov esi, eax
je 0x10065812
cmp dword [ebp + 0xc], 0
je 0x10065812
test esi, esi
je 0x10065812
mov ecx, edi
mov byte [ebp + 7], 0
call fcn.10067b20
test eax, eax
mov ecx, 0x804
cmove eax, ecx
movzx ecx, ax
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x34], ecx
call fcn.10067e90
test al, al
je 0x100654d0
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x2c], 0x6f0053
mov dword [ebp + 0x30], 0x740066
mov dword [ebp + 0x34], 0x610077
mov dword [ebp + 0x38], 0x650072
mov dword [ebp + 0x3c], 0x4d005c
mov dword [ebp + 0x40], 0x630069
mov dword [ebp + 0x44], 0x6f0072
mov dword [ebp + 0x48], 0x6f0073
mov dword [ebp + 0x4c], 0x740066
mov dword [ebp + 0x50], 0x43005c
mov dword [ebp + 0x54], 0x460054
mov dword [ebp + 0x58], 0x41005c
mov dword [ebp + 0x5c], 0x730073
mov dword [ebp + 0x60], 0x6d0065
mov dword [ebp + 0x64], 0x6c0062
mov dword [ebp + 0x68], 0x650069
mov dword [ebp + 0x6c], 0x73
call fcn.10007fd4
mov dword [ebp - 4], 0
lea eax, [ebp + 0x2c]
push str.34745C63_B2F0_4784_8B67_5E12C8701A31
push dword [ebx + 0x34]
push eax
lea eax, [ebp + 0x14]
push str._s0x_08x_s
push eax
call fcn.10074cd0
mov dword [ebp + 0xc], 0
add esp, 0x14
mov dword [ebp + 0x10], 0
mov dword [ebp + 0xc], 0
mov byte [ebp - 4], 1
lea eax, [ebp + 0x10]
push eax
push 0x20019
push 0
lea ecx, [ebp + 0x14]
call fcn.10007f54
push eax
push 0x20019
lea ecx, [ebp + 0xc]
call fcn.1008ae20
push eax
call dword [ebp + 8]
test eax, eax
jne 0x100654ab
push str.Default
lea ecx, [ebp - 0x30]
call fcn.10005e0a
mov byte [ebp - 4], 2
lea eax, [ebp - 0x30]
push ebx
push eax
push dword [ebp + 0x10]
mov ecx, edi
call fcn.10068880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.10005e05
push dword [ebp + 0x10]
call esi
mov bl, 1
jmp 0x100654ae
mov bl, byte [ebp + 7]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.1008afc0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.10005e05
mov al, bl
jmp 0x10065814
lea esi, [ebx + 0x38]
push str.00000000_0000_0000_0000_000000000000
mov dword [ebp + 8], esi
call fcn.10005f42
add esp, 4
mov ecx, esi
mov ebx, eax
call fcn.10005e30
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [ebp], eax
cmp ebx, eax
ja 0x1006552c
mov esi, edi
cmp eax, 8
jb 0x10065501
mov esi, dword [edi]
push ebx
push str.00000000_0000_0000_0000_000000000000
push esi
mov dword [edi + 0x10], ebx
call fcn.10005f10
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
add esp, 0x14
jmp 0x10065664
mov ecx, esi
call fcn.1000608d
cmp ebx, eax
ja 0x10065833
mov ecx, esi
call fcn.1000608d
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [ebp - 0x10], ecx
cmp ecx, esi
ja 0x1006557f
mov ecx, dword [ebp + 8]
call fcn.10005e30
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x1006557f
lea eax, [ecx + edx]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10005ed6
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x10065591
or ecx, 0xffffffff
jmp 0x10065599
cmp ecx, 0x1000
jb 0x100655c4
lea eax, [ecx + 0x23]
cmp eax, ecx
mov ecx, 0xffffffff
cmovbe eax, ecx
push eax
call fcn.101e4da1
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10065838
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x100655d5
test ecx, ecx
je 0x100655d3
push ecx
call fcn.101e4da1
add esp, 4
jmp 0x100655d5
xor eax, eax
mov dword [ebp + 0xc], eax
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [ebp + 0xc]
push str.00000000_0000_0000_0000_000000000000
push esi
call fcn.10005f29
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
mov ecx, dword [ebp]
add esp, 0x14
cmp ecx, 8
jb 0x10065644
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x10065633
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10065838
mov eax, edx
push ecx
push eax
call fcn.101e4d70
mov eax, dword [ebp + 0xc]
add esp, 8
mov dword [edi], eax
jmp 0x10065664
lea eax, [ebp + 0xc]
push eax
call fcn.10005f6e
push edi
mov esi, eax
call fcn.10005f6e
push eax
push 4
call fcn.10005b84
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
mov esi, dword [ebp + 0x10]
add esi, 0x50
push str.00000000_0000_0000_0000_000000000000
mov dword [ebp], esi
call fcn.10005f42
add esp, 4
mov ecx, esi
mov ebx, eax
call fcn.10005e30
mov edi, eax
mov eax, dword [edi + 0x14]
mov dword [ebp + 8], eax
cmp ebx, eax
ja 0x100656c3
mov esi, edi
cmp eax, 8
jb 0x10065698
mov esi, dword [edi]
push ebx
push str.00000000_0000_0000_0000_000000000000
push esi
mov dword [edi + 0x10], ebx
call fcn.10005f10
lea eax, [ebp]
mov dword [ebp], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
add esp, 0x14
jmp 0x100657f7
mov ecx, esi
call fcn.1000608d
cmp ebx, eax
ja 0x1006583d
mov ecx, esi
call fcn.1000608d
mov ecx, ebx
mov esi, eax
or ecx, 7
mov dword [ebp - 0x14], ecx
cmp ecx, esi
ja 0x10065716
mov ecx, dword [ebp]
call fcn.10005e30
mov edx, dword [eax + 0x14]
mov ecx, edx
shr ecx, 1
mov eax, esi
sub eax, ecx
cmp edx, eax
ja 0x10065716
lea eax, [ecx + edx]
mov dword [ebp], eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10005ed6
add esp, 8
mov esi, dword [eax]
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x10065728
or ecx, 0xffffffff
jmp 0x10065730
cmp ecx, 0x1000
jb 0x1006575b
lea eax, [ecx + 0x23]
cmp eax, ecx
mov ecx, 0xffffffff
cmovbe eax, ecx
push eax
call fcn.101e4da1
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10065838
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1006576c
test ecx, ecx
je 0x1006576a
push ecx
call fcn.101e4da1
add esp, 4
jmp 0x1006576c
xor eax, eax
mov dword [ebp + 0xc], eax
push ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], esi
mov esi, dword [ebp + 0xc]
push str.00000000_0000_0000_0000_000000000000
push esi
call fcn.10005f29
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
lea eax, [esi + ebx*2]
push eax
call fcn.10005eff
mov ecx, dword [ebp + 8]
add esp, 0x14
cmp ecx, 8
jb 0x100657d7
mov eax, dword [edi]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x100657c6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10065838
mov eax, edx
push ecx
push eax
call fcn.101e4d70
mov eax, dword [ebp + 0xc]
add esp, 8
mov dword [edi], eax
jmp 0x100657f7
lea eax, [ebp + 0xc]
push eax
call fcn.10005f6e
push edi
mov esi, eax
call fcn.10005f6e
push eax
push 4
call fcn.10005b84
mov ecx, dword [esi]
add esp, 0x10
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx + 0x34]
cmp eax, edx
jne 0x1006580a
imul eax, edx, 0x10001
mov bl, 1
mov dword [ecx], eax
mov al, bl
jmp 0x10065814
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.101e48f0
lea esp, [ebp + 0x74]
pop ebp
ret 4
call fcn.1000604b
call fcn.10205f6e
call fcn.1000604b
int3