Function at 0x1001fb10
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Get token membership
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x100ef0f8]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x100e6530]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100f29c4]
movups xmmword [ebp - 0x54], xmm0
push esi
movaps xmm0, xmmword [0x100e6550]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x10100f9c]
movups xmmword [ebp - 0x44], xmm0
mov word [ebp - 0x14], 0x5a40
movaps xmm0, xmmword [0x100e66a0]
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x12], 0x2e
movaps xmm0, xmmword [0x100e65f0]
movups xmmword [ebp - 0x24], xmm0
cmp eax, dword [esi + 4]
jle 0x1001fbae
push 0x10100f9c
call fcn.10084984
add esp, 4
cmp dword [0x10100f9c], 0xffffffff
jne 0x1001fbae
lea eax, [ebp - 0x54]
mov ecx, 0x10100ff0
push eax
call fcn.10020ed0
push 0x100c35c0
call fcn.10084d5f
push 0x10100f9c
call fcn.1008493a
add esp, 8
cmp byte [0x10101032], 0
je 0x1001fc21
movaps xmm2, xmmword [0x100e64a0]
mov eax, 0x40
movups xmm0, xmmword [0x10100ff0]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmm0, xmmword [0x10101000]
movups xmmword [0x10100ff0], xmm1
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmm0, xmmword [0x10101010]
movups xmmword [0x10101000], xmm1
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmm0, xmmword [0x10101020]
movups xmmword [0x10101010], xmm1
pxor xmm2, xmm0
movups xmmword [0x10101020], xmm2
xor byte [eax + 0x10100ff0], 0x2e
inc eax
cmp eax, 0x43
jb 0x1001fc14
lea eax, [ebp - 0x64]
push eax
push 0x20019
push 0
push 0x10100ff0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001fdd2
mov dword [ebp - 0x60], eax
mov eax, dword [0x10100f84]
push ebx
mov bl, 0x2e
mov dword [ebp - 0x10], 0x4b584163
mov dword [ebp - 0xc], 0x494f4367
mov word [ebp - 8], 0x5d4b
cmp eax, dword [esi + 4]
jle 0x1001fcb5
push 0x10100f84
call fcn.10084984
add esp, 4
cmp dword [0x10100f84], 0xffffffff
jne 0x1001fcb5
movq xmm0, qword [ebp - 0x10]
mov ax, word [ebp - 8]
push 0x100c35a0
movq qword [0x10100f74], xmm0
mov word [0x10100f7c], ax
mov byte [0x10100f7e], bl
call fcn.10084d5f
push 0x10100f84
call fcn.1008493a
add esp, 8
cmp byte [0x10100f7e], 0
pop ebx
je 0x1001fcce
xor eax, eax
xor byte [eax + 0x10100f74], 0x2e
inc eax
cmp eax, 0xb
jb 0x1001fcc1
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x10100f74
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001fd05
mov dword [0x100f3958], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10084864
mov esp, ebp
pop ebp
ret
xor esi, esi
mov dword [ebp - 0x5c], 0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1001fd4d
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x58]
push esi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1001fd55
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x1001fd6a
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x58], 0
test esi, esi
jne 0x1001fde3
cmp dword [ebp - 0x5c], esi
je 0x1001fdbd
cmp dword [0x100f3958], esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
jne 0x1001fd92
push 0
push 0
push 0
push 0x1001f450
push 0
push 0
call esi
cmp dword [0x100f395c], 0
jne 0x1001fdd2
push 0
push 0
push 0
push 0x1001f670
push 0
push 0
call esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10084864
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x1001fa10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10084864
mov esp, ebp
pop ebp
ret
push 0x100ed0a0
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], esi
push eax
call fcn.1009d0cd
int3