Function at 0x40de40
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa028
call fcn.00465d50
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0xa010]
push ecx
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
mov dword [ebp - 0xa018], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e076
push eax
mov ecx, dword [ebp - 0xa010]
push eax
push eax
push eax
lea edx, [ebp - 0xa014]
push edx
push eax
push eax
lea eax, [ebp - 0xa028]
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40e069
mov eax, dword [ebp - 0xa014]
test eax, eax
je 0x40e069
xor esi, esi
test eax, eax
je 0x40e076
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
lea esp, [esp]
xor edx, edx
xor eax, eax
mov word [ebp - 0xa00c], dx
lea ecx, [ebp - 0xa01c]
push ecx
mov word [ebp - 0x800c], ax
lea edx, [ebp - 0xa00c]
push edx
lea eax, [ebp - 0xa024]
push eax
mov eax, dword [ebp - 0xa010]
push 0
lea ecx, [ebp - 0xa020]
push ecx
lea edx, [ebp - 0x800c]
push edx
push esi
push eax
mov dword [ebp - 0xa01c], 0x1000
mov dword [ebp - 0xa020], 0x3fff
call edi
push str.RegRead_HKCU_software_xswloader_
lea ecx, [ebp - 0xa00c]
push ecx
call ebx
test eax, eax
jne 0x40df61
inc esi
cmp esi, dword [ebp - 0xa014]
jb 0x40dee0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044e488
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0xa018]
push str._r_nXSWKIT_Infection_Detected:__r_n
push ebx
call fcn.00414730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x40df9c
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x40df9c
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x40dfbd
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x40dfb5
or eax, 4
push 0
push eax
call fcn.00402d10
push 0x47325c
push ecx
lea edx, [ebp - 0xa00c]
push edx
push ecx
push 0x474bf8
push ecx
lea eax, [ebp - 0x800c]
push eax
push ecx
push str._r_n_
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x40e032
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x40e032
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x40e053
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x40e04b
or eax, 4
push 0
push eax
call fcn.00402d10
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044e488
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xa010]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0044e488
mov esp, ebp
pop ebp
ret