Function at 0x11fde40
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa028
call fcn.01255d50
mov eax, dword [0x1286d50]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0xa010]
push ecx
push 0x20119
push 0
push 0x1268a38
push 0x80000001
mov dword [ebp - 0xa018], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11fe076
push eax
mov ecx, dword [ebp - 0xa010]
push eax
push eax
push eax
lea edx, [ebp - 0xa014]
push edx
push eax
push eax
lea eax, [ebp - 0xa028]
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x11fe069
mov eax, dword [ebp - 0xa014]
test eax, eax
je 0x11fe069
xor esi, esi
test eax, eax
je 0x11fe076
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
lea esp, [esp]
xor edx, edx
xor eax, eax
mov word [ebp - 0xa00c], dx
lea ecx, [ebp - 0xa01c]
push ecx
mov word [ebp - 0x800c], ax
lea edx, [ebp - 0xa00c]
push edx
lea eax, [ebp - 0xa024]
push eax
mov eax, dword [ebp - 0xa010]
push 0
lea ecx, [ebp - 0xa020]
push ecx
lea edx, [ebp - 0x800c]
push edx
push esi
push eax
mov dword [ebp - 0xa01c], 0x1000
mov dword [ebp - 0xa020], 0x3fff
call edi
push 0x1268b70
lea ecx, [ebp - 0xa00c]
push ecx
call ebx
test eax, eax
jne 0x11fdf61
inc esi
cmp esi, dword [ebp - 0xa014]
jb 0x11fdee0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0123e488
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0xa018]
push 0x1268bc0
push ebx
call fcn.01204730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x11fdf9c
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11fdf9c
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x11fdfbd
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x11fdfb5
or eax, 4
push 0
push eax
call fcn.011f2d10
push 0x126325c
push ecx
lea edx, [ebp - 0xa00c]
push edx
push ecx
push 0x1264bf8
push ecx
lea eax, [ebp - 0x800c]
push eax
push ecx
push 0x12683f8
push ebx
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x11fe032
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11fe032
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x11fe053
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x11fe04b
or eax, 4
push 0
push eax
call fcn.011f2d10
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0123e488
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xa010]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0123e488
mov esp, ebp
pop ebp
ret