Function at 0x53b7f0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
mov eax, dword [0x601694]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x808], ecx
mov eax, dword [ebp - 0x808]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x808]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x808]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x808]
mov dword [ecx + 0xc], 0
mov edx, 1
imul eax, edx, 0
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 0x800
jae 0x53b858
jmp 0x53b85d
call fcn.0055e8ae
mov ecx, dword [ebp - 0x824]
mov byte [ebp + ecx - 0x804], 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.0056e720
add esp, 4
mov esi, eax
mov eax, dword [ebp + 0x14]
push eax
call fcn.0056e720
add esp, 4
lea ecx, [esi + eax + 8]
mov dword [ebp - 0x834], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x828], edx
cmp dword [ebp - 0x828], 0
je 0x53b8b3
cmp dword [ebp - 0x828], 1
je 0x53b99b
jmp 0x53ba7e
lea eax, [ebp - 0x810]
push eax
push 0x5e0cb8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jne 0x53b996
mov ecx, 0x800
sub ecx, dword [ebp - 0x834]
mov dword [ebp - 0x81c], ecx
lea edx, [ebp - 0x81c]
push edx
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0x820]
push ecx
push 0
push str.Common_AppData
mov edx, dword [ebp - 0x810]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x53b989
cmp dword [ebp - 0x820], 1
jne 0x53b989
mov eax, 1
imul ecx, eax, 0
mov dword [ebp - 0x82c], ecx
cmp dword [ebp - 0x82c], 0x800
jae 0x53b94b
jmp 0x53b950
call fcn.0055e8ae
mov edx, dword [ebp - 0x82c]
mov byte [ebp + edx - 0x804], 0
mov dword [ebp - 0x830], 1
cmp dword [ebp - 0x830], 0x800
jae 0x53b976
jmp 0x53b97b
call fcn.0055e8ae
mov eax, dword [ebp - 0x830]
mov byte [ebp + eax - 0x804], 0
mov ecx, dword [ebp - 0x810]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x53ba7e
lea edx, [ebp - 0x810]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jne 0x53ba7e
mov eax, 0x800
sub eax, dword [ebp - 0x834]
mov dword [ebp - 0x81c], eax
lea ecx, [ebp - 0x81c]
push ecx
lea edx, [ebp - 0x804]
push edx
lea eax, [ebp - 0x820]
push eax
push 0
push str.AppData
mov ecx, dword [ebp - 0x810]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
je 0x53ba71
cmp dword [ebp - 0x820], 1
jne 0x53ba71
mov edx, 1
imul eax, edx, 0
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0x800
jae 0x53ba33
jmp 0x53ba38
call fcn.0055e8ae
mov ecx, dword [ebp - 0x838]
mov byte [ebp + ecx - 0x804], 0
mov dword [ebp - 0x83c], 1
cmp dword [ebp - 0x83c], 0x800
jae 0x53ba5e
jmp 0x53ba63
call fcn.0055e8ae
mov edx, dword [ebp - 0x83c]
mov byte [ebp + edx - 0x804], 0
mov eax, dword [ebp - 0x810]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 1
shl ecx, 0
movsx edx, byte [ebp + ecx - 0x804]
test edx, edx
jne 0x53babf
mov eax, 1
imul ecx, eax, 0
movsx edx, byte [ebp + ecx - 0x804]
test edx, edx
jne 0x53babf
push str.C:FLTK
lea eax, [ebp - 0x804]
push eax
call fcn.0056e620
add esp, 8
jmp 0x53bb64
lea ecx, [ebp - 0x804]
push ecx
call fcn.0056ee29
add esp, 4
lea edx, [eax + eax + 2]
push edx
call fcn.0056660b
add esp, 4
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x804]
push eax
mov ecx, dword [ebp - 0x818]
push ecx
call fcn.0056f6bd
add esp, 8
mov edx, dword [ebp - 0x818]
push edx
call fcn.0056ee29
add esp, 4
push eax
mov eax, dword [ebp - 0x818]
push eax
push 0x7ff
lea ecx, [ebp - 0x804]
push ecx
call fcn.00535ef0
add esp, 0x10
mov dword [ebp - 0x844], eax
mov edx, dword [ebp - 0x844]
mov dword [ebp - 0x840], edx
cmp dword [ebp - 0x840], 0x800
jae 0x53bb42
jmp 0x53bb47
call fcn.0055e8ae
mov eax, dword [ebp - 0x840]
mov byte [ebp + eax - 0x804], 0
mov ecx, dword [ebp - 0x818]
push ecx
call fcn.00560469
add esp, 4
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push str.__s__s.prefs
lea ecx, [ebp - 0x804]
push ecx
call fcn.0056e720
add esp, 4
mov edx, 0x800
sub edx, eax
push edx
lea eax, [ebp - 0x804]
push eax
call fcn.0056e720
add esp, 4
lea ecx, [ebp + eax - 0x804]
push ecx
call fcn.00555fd0
add esp, 0x14
lea edx, [ebp - 0x804]
mov dword [ebp - 0x814], edx
jmp 0x53bbc4
mov eax, dword [ebp - 0x814]
add eax, 1
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp - 0x814]
movsx edx, byte [ecx]
test edx, edx
je 0x53bbea
mov eax, dword [ebp - 0x814]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x53bbe8
mov edx, dword [ebp - 0x814]
mov byte [edx], 0x2f
jmp 0x53bbb5
lea eax, [ebp - 0x804]
push eax
call fcn.0056d74e
add esp, 4
mov ecx, dword [ebp - 0x808]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.0056d74e
add esp, 4
mov ecx, dword [ebp - 0x808]
mov dword [ecx + 8], eax
mov edx, dword [ebp + 0x14]
push edx
call fcn.0056d74e
add esp, 4
mov ecx, dword [ebp - 0x808]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x808]
call fcn.0053beb0
mov eax, dword [ebp - 0x808]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055e98a
mov esp, ebp
pop ebp
ret 0x10