Function at 0x4f1197
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5134df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc68
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x42c], 0
lea ecx, [ebp - 0x438]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x428]
call sub.MFC42.DLL_CStringArray::CStringArray
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x428]
call fcn.0050f5b0
cmp dword [0x5b84d4], 0
je 0x4f1213
push 0x5b84c0
call dword [0x5b84cc]
lea eax, [ebp - 0x444]
push eax
push 0x20119
push 0
push 0x5a6e60
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4f1461
mov dword [ebp - 0x440], 0
jmp 0x4f1254
mov ecx, dword [ebp - 0x440]
add ecx, 1
mov dword [ebp - 0x440], ecx
mov dword [ebp - 0x414], 0x400
mov byte [ebp - 0x40c], 0
mov dword [ebp - 0x410], 0x800
mov byte [ebp - 0xc44], 0
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0xc44]
push eax
push 0
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x40c]
push edx
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x444]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x4f12b3
jmp 0x4f1454
lea edx, [ebp - 0xc44]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], 0
mov dword [0x5b84b8], 0
jmp 0x4f130a
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x434]
jge 0x4f133b
mov edx, dword [0x5b84b8]
movsx eax, byte [edx + 0x5b6504]
cmp eax, 0x5c
jne 0x4f1339
mov ecx, dword [ebp - 0x430]
add ecx, 1
mov dword [ebp - 0x430], ecx
jmp 0x4f12fd
push 0x5a6e90
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f136d
push 0x5a6e9c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f144f
cmp dword [ebp - 0x430], 2
jne 0x4f144f
lea edx, [ebp - 0xc44]
push edx
lea eax, [ebp - 0x40c]
push eax
push str.O4___HKLM..Run:___s___s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0xc44]
push ecx
lea edx, [ebp - 0xc48]
push edx
call fcn.0040360d
add esp, 8
mov dword [ebp - 0xc58], eax
mov eax, dword [ebp - 0xc58]
mov dword [ebp - 0xc5c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xc5c]
push ecx
lea ecx, [ebp - 0x438]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc48]
call sub.MFC42.DLL_CString::CString
push 0x5a6ec8
lea edx, [ebp - 0x438]
push edx
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4f143f
push 0x5a6ed0
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x438]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5a6ed8
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
lea ecx, [ebp - 0x428]
call fcn.0050f680
jmp 0x4f1245
mov eax, dword [ebp - 0x444]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x444]
push ecx
push 0x20119
push 0
push 0x5a6edc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4f16b0
mov dword [ebp - 0x440], 0
jmp 0x4f14a2
mov edx, dword [ebp - 0x440]
add edx, 1
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x414], 0x400
mov byte [ebp - 0x40c], 0
mov dword [ebp - 0x410], 0x800
mov byte [ebp - 0xc44], 0
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0xc44]
push ecx
push 0
push 0
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [ebp - 0x440]
push ecx
mov edx, dword [ebp - 0x444]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x4f1501
jmp 0x4f16a3
lea eax, [ebp - 0xc44]
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], 0
mov dword [0x5b84b8], 0
jmp 0x4f155a
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov edx, dword [0x5b84b8]
cmp edx, dword [ebp - 0x434]
jge 0x4f158a
mov eax, dword [0x5b84b8]
movsx ecx, byte [eax + 0x5b6504]
cmp ecx, 0x5c
jne 0x4f1588
mov edx, dword [ebp - 0x430]
add edx, 1
mov dword [ebp - 0x430], edx
jmp 0x4f154b
push 0x5a6f18
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f15bc
push 0x5a6f24
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f169e
cmp dword [ebp - 0x430], 2
jne 0x4f169e
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0x40c]
push ecx
push str.O4___HKLM..Wow6432Node..Run:___s___s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0xc44]
push edx
lea eax, [ebp - 0xc4c]
push eax
call fcn.0040360d
add esp, 8
mov dword [ebp - 0xc60], eax
mov ecx, dword [ebp - 0xc60]
mov dword [ebp - 0xc64], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xc64]
push edx
lea ecx, [ebp - 0x438]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc4c]
call sub.MFC42.DLL_CString::CString
push 0x5a6f60
lea eax, [ebp - 0x438]
push eax
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4f168e
push 0x5a6f68
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x438]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5a6f70
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
lea ecx, [ebp - 0x428]
call fcn.0050f680
jmp 0x4f1493
mov ecx, dword [ebp - 0x444]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5b4120], 0
jmp 0x4f16cb
mov edx, dword [0x5b4120]
add edx, 1
mov dword [0x5b4120], edx
mov ecx, 0x5b7890
call fcn.0050f110
cmp dword [0x5b4120], eax
jge 0x4f1c54
mov eax, dword [0x5b4120]
push eax
mov ecx, 0x5b7890
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b79a4
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [0x5b4120]
push ecx
mov ecx, 0x5b7878
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b78a4
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b79a4
push 0x5b7aa4
push str._s_s_ntuser.dat
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
push 0x5b78a4
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
push 0x5b78a4
push str._sSoftwareMicrosoftWindowsCurrentVersionRun
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x444]
push edx
push 0x20119
push 0
push 0x5b6504
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4f19cf
mov dword [ebp - 0x440], 0
jmp 0x4f17b7
mov eax, dword [ebp - 0x440]
add eax, 1
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x414], 0x400
mov byte [ebp - 0x40c], 0
mov dword [ebp - 0x410], 0x800
mov byte [ebp - 0xc44], 0
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0xc44]
push edx
push 0
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x40c]
push ecx
mov edx, dword [ebp - 0x440]
push edx
mov eax, dword [ebp - 0x444]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x4f1816
jmp 0x4f19c2
lea ecx, [ebp - 0xc44]
push ecx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], 0
mov dword [0x5b84b8], 0
jmp 0x4f186f
mov edx, dword [0x5b84b8]
add edx, 1
mov dword [0x5b84b8], edx
mov eax, dword [0x5b84b8]
cmp eax, dword [ebp - 0x434]
jge 0x4f189f
mov ecx, dword [0x5b84b8]
movsx edx, byte [ecx + 0x5b6504]
cmp edx, 0x5c
jne 0x4f189d
mov eax, dword [ebp - 0x430]
add eax, 1
mov dword [ebp - 0x430], eax
jmp 0x4f1860
push 0x5a6fbc
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f18d1
push 0x5a6fc8
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f19bd
cmp dword [ebp - 0x430], 2
jne 0x4f19bd
push 0x5b79a4
lea ecx, [ebp - 0xc44]
push ecx
lea edx, [ebp - 0x40c]
push edx
push 0x5b78a4
push str.O4___HKUS_s..Run:___s___s__User__s_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0xc50]
push ecx
call fcn.0040360d
add esp, 8
mov dword [ebp - 0xc68], eax
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0xc6c], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xc6c]
push eax
lea ecx, [ebp - 0x438]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc50]
call sub.MFC42.DLL_CString::CString
push 0x5a7004
lea ecx, [ebp - 0x438]
push ecx
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4f19ad
push 0x5a700c
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x438]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5a7014
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
lea ecx, [ebp - 0x428]
call fcn.0050f680
jmp 0x4f17a8
mov edx, dword [ebp - 0x444]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5b78a4
push str._sSoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
push 0x20119
push 0
push 0x5b6504
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4f1c3f
mov dword [ebp - 0x440], 0
jmp 0x4f1a28
mov ecx, dword [ebp - 0x440]
add ecx, 1
mov dword [ebp - 0x440], ecx
mov dword [ebp - 0x414], 0x400
mov byte [ebp - 0x40c], 0
mov dword [ebp - 0x410], 0x800
mov byte [ebp - 0xc44], 0
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0xc44]
push eax
push 0
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x40c]
push edx
mov eax, dword [ebp - 0x440]
push eax
mov ecx, dword [ebp - 0x444]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x4f1a87
jmp 0x4f1c32
lea edx, [ebp - 0xc44]
push edx
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call fcn.00401fca
add esp, 4
push 0x5b6504
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], 0
mov dword [0x5b84b8], 0
jmp 0x4f1ade
mov eax, dword [0x5b84b8]
add eax, 1
mov dword [0x5b84b8], eax
mov ecx, dword [0x5b84b8]
cmp ecx, dword [ebp - 0x434]
jge 0x4f1b0f
mov edx, dword [0x5b84b8]
movsx eax, byte [edx + 0x5b6504]
cmp eax, 0x5c
jne 0x4f1b0d
mov ecx, dword [ebp - 0x430]
add ecx, 1
mov dword [ebp - 0x430], ecx
jmp 0x4f1ad1
push str.:WINDOWS_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f1b41
push str.:PROGRAMDATA_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f1c2d
cmp dword [ebp - 0x430], 2
jne 0x4f1c2d
push 0x5b79a4
lea edx, [ebp - 0xc44]
push edx
lea eax, [ebp - 0x40c]
push eax
push 0x5b78a4
push str.O4___HKUS_s..Wow6432Node..Run:___s___s__User__s_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
lea ecx, [ebp - 0xc44]
push ecx
lea edx, [ebp - 0xc54]
push edx
call fcn.0040360d
add esp, 8
mov dword [ebp - 0xc70], eax
mov eax, dword [ebp - 0xc70]
mov dword [ebp - 0xc74], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0xc74]
push ecx
lea ecx, [ebp - 0x438]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc54]
call sub.MFC42.DLL_CString::CString
push 0x5a70ac
lea edx, [ebp - 0x438]
push edx
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4f1c1d
push str.__MD5:
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x438]
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5a70bc
push 0x5b6504
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x5b6504
lea ecx, [ebp - 0x428]
call fcn.0050f680
jmp 0x4f1a19
mov eax, dword [ebp - 0x444]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5b78a4
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyA]
jmp 0x4f16bc
cmp dword [0x5b84d4], 0
je 0x4f1c6a
mov ecx, dword [0x5b84c0]
push ecx
call dword [0x5b84d0]
lea ecx, [ebp - 0x428]
call fcn.0050f110
test eax, eax
je 0x4f1c97
push str._nRELACI
mov ecx, 0x5b5b78
call fcn.0050f680
push str.______________________________________________________________________n
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x43c], 0
jmp 0x4f1cb2
mov edx, dword [ebp - 0x43c]
add edx, 1
mov dword [ebp - 0x43c], edx
lea ecx, [ebp - 0x428]
call fcn.0050f110
cmp dword [ebp - 0x43c], eax
jge 0x4f1cfe
mov eax, dword [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x428]
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push 0x5a7150
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4f1ca3
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x428]
call fcn.0051046c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret