Function at 0x5f3438ee
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x3c]
push eax
xor ebx, ebx
mov edi, 0x2001f
push edi
push ebx
push dword [0x5f341d90]
mov dword [ebp - 8], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
call esi
cmp eax, ebx
jne 0x5f343c7d
lea eax, [ebp - 4]
push eax
push edi
push ebx
push dword [0x5f341d5c]
push dword [ebp + 8]
call esi
cmp eax, ebx
jne 0x5f343c7d
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [0x5f341d80]
push dword [ebp - 4]
call esi
test eax, eax
je 0x5f343a34
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0x10]
push 1
push ebx
push dword [0x5f341d80]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp edi, ebx
je 0x5f343999
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x5f343c7d
push 4
pop edi
lea eax, [ebp - 0x10]
push eax
push 0x5f345c40
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [0x5f341d70]
mov dword [ebp - 0x10], edi
push dword [ebp - 4]
call esi
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x5f343c71
cmp dword [ebp - 0xc], edi
jne 0x5f343c71
lea eax, [ebp - 0x10]
push eax
push 0x5f345c44
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [0x5f341d74]
mov dword [ebp - 0x10], edi
push dword [ebp - 4]
call esi
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x5f343c71
cmp dword [ebp - 0xc], edi
jne 0x5f343c71
lea eax, [ebp - 0x10]
push eax
push 0x5f345c4c
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [0x5f341d6c]
mov dword [ebp - 0x10], edi
push dword [ebp - 4]
call esi
test eax, eax
mov ecx, 0x10000
jne 0x5f343a26
cmp dword [ebp - 0xc], edi
je 0x5f343a2c
mov dword [0x5f345c4c], ecx
cmp dword [0x5f345c4c], ecx
je 0x5f343a3e
mov eax, 0xaa
jmp 0x5f343c7d
mov ebx, dword [sym.imp.msvcrt.dll_malloc]
push 0x208
call ebx
mov dword [ebp + 0x10], eax
mov dword [esp], 0x208
call ebx
cmp dword [ebp + 0x10], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
pop ecx
mov dword [ebp - 0x18], eax
je 0x5f343c2f
test eax, eax
je 0x5f343c2f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x5f341d74]
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
call esi
test eax, eax
mov dword [ebp + 8], eax
jne 0x5f343c36
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x5f341d7c]
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
call esi
test eax, eax
mov dword [ebp + 8], eax
jne 0x5f343c36
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x5f341d70]
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
call esi
test eax, eax
mov dword [ebp + 8], eax
jne 0x5f343c36
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [0x5f341d78]
mov dword [ebp - 8], edi
push dword [ebp + 0xc]
call esi
test eax, eax
mov dword [ebp + 8], eax
jne 0x5f343c36
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x30]
cmp eax, ecx
mov dword [ebp - 0x20], eax
jbe 0x5f343b1f
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x38]
cmp eax, ecx
mov dword [ebp - 0x24], eax
jae 0x5f343b2f
mov dword [ebp - 0x24], ecx
push dword [ebp + 0x10]
mov esi, dword [sym.imp.msvcrt.dll__msize]
xor eax, eax
mov dword [0x5f345c48], eax
mov dword [0x5f345c3c], eax
mov dword [ebp - 0x14], eax
call esi
pop ecx
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x5f343c36
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.5f3433df
test eax, eax
je 0x5f343ba9
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp + 0x10]
push eax
push dword [ebp - 0x34]
call fcn.5f343788
test eax, eax
jne 0x5f343ba9
mov dword [ebp - 0x1c], 1
push dword [ebp + 0x10]
inc dword [ebp - 0x14]
call esi
pop ecx
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp - 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x5f343b64
cmp dword [ebp - 0x1c], 0
je 0x5f343c36
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push 0x5f345c3c
push edi
push 0
push dword [0x5f341d74]
mov dword [ebp - 8], edi
push dword [ebp - 4]
call esi
push edi
push 0x5f345c48
push edi
push 0
push dword [0x5f341d70]
mov dword [ebp - 8], edi
push dword [ebp - 4]
call esi
push dword [0x5f341d7c]
mov esi, dword [ebp + 0xc]
push esi
mov dword [ebp + 8], eax
call ebx
push dword [0x5f341d74]
push esi
call ebx
push dword [0x5f341d78]
push esi
call ebx
push dword [0x5f341d70]
push esi
call ebx
jmp 0x5f343c36
mov dword [ebp + 8], 0xe
push dword [0x5f341d80]
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x3c]
call esi
cmp dword [ebp + 0x10], 0
mov esi, dword [sym.imp.msvcrt.dll_free]
je 0x5f343c63
push dword [ebp + 0x10]
call esi
pop ecx
cmp dword [ebp - 0x18], 0
je 0x5f343c7a
push dword [ebp - 0x18]
call esi
pop ecx
jmp 0x5f343c7a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc