Function at 0x5a1040
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d87ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x630
mov eax, str.Logvtewce_IYCAIDmeZZQY_K
push ebx
sub eax, 0x1b9250dc
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x24], 0xff
call fcn.0059af30
lea ecx, [ebp - 0x10]
push ecx
push 0xf003f
xor ebx, ebx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x5a130e
mov edx, str.DajnqOqpT
sub edx, 0x2026c624
push edx
lea ecx, [ebp - 0x1b]
call fcn.0059af80
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x23c]
push edx
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x5a130e
push esi
mov eax, 0x66b368
push edi
sub eax, 0x1e97489e
push eax
lea ecx, [ebp - 0x80]
call fcn.0059b010
mov edi, 0xf
mov ecx, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x58], bl
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x5a1105
sub ecx, esi
push ecx
push eax
lea ecx, [ebp - 0x5c]
call fcn.00406de0
push 0x71894c58
lea ecx, [ebp - 0x1b]
call fcn.0059b060
mov esi, eax
lea ecx, [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x7c]
push eax
mov byte [ebp - 4], 3
call fcn.004133c0
push esi
push eax
lea ecx, [ebp - 0x40]
push ecx
mov byte [ebp - 4], 4
call fcn.00584240
add esp, 0x18
mov esi, 0x10
cmp dword [ebp - 0x64], esi
jb 0x5a1167
mov edx, dword [ebp - 0x78]
push edx
call fcn.00570810
add esp, 4
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x78], bl
xor eax, eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0xa0]
push edx
mov byte [ebp - 4], 7
call fcn.004133c0
add esp, 0xc
mov byte [ebp - 4], 8
cmp dword [ebp - 0x28], esi
jb 0x5a11af
cmp dword [ebp - 0x3c], ebx
je 0x5a12b8
push 1
lea ecx, [ebp - 0x13c]
call fcn.00411930
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x28], esi
jae 0x5a11cb
lea eax, [ebp - 0x3c]
push 0x40
push 1
push eax
lea ecx, [ebp - 0x13c]
call fcn.00411ad0
cmp dword [ebp - 0xe8], ebx
je 0x5a1290
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax + 4]
test byte [ebp + ecx - 0x134], 1
jne 0x5a1285
mov edi, edi
lea edx, [ebp - 0x63c]
push edx
lea eax, [ebp - 0x13c]
push eax
call fcn.005a0e90
lea ecx, [ebp - 0x63c]
push ecx
call sub.MSVCR90.dll_remove
mov eax, dword [ebp - 0x3c]
add esp, 0xc
cmp dword [ebp - 0x28], esi
jae 0x5a122d
lea eax, [ebp - 0x3c]
push eax
call sub.MSVCR90.dll_remove
add esp, 4
lea ecx, [ebp - 0x134]
call fcn.00412290
test eax, eax
jne 0x5a126e
mov edx, dword [ebp - 0x13c]
mov ecx, dword [edx + 4]
mov eax, dword [ebp + ecx - 0x134]
lea ecx, [ebp + ecx - 0x13c]
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x5a1267
or eax, 4
push ebx
push eax
call fcn.00410280
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax + 4]
test byte [ebp + ecx - 0x134], 1
je 0x5a1200
push 0x21a
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 8
call fcn.00411a60
lea edx, [ebp - 0xe4]
push edx
mov dword [ebp - 0xe4], vtable.std::ios_base.0
call fcn.005c64b9
add esp, 4
cmp dword [ebp - 0x88], esi
jb 0x5a12cf
mov eax, dword [ebp - 0x9c]
push eax
call fcn.00570810
add esp, 4
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x8c], ebx
mov byte [ebp - 0x9c], bl
cmp dword [ebp - 0x28], esi
jb 0x5a12f2
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.00570810
add esp, 4
cmp dword [ebp - 0x44], esi
mov dword [ebp - 0x28], edi
pop edi
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x3c], bl
pop esi
jb 0x5a130e
mov edx, dword [ebp - 0x58]
push edx
call fcn.00570810
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret