Function at 0x10353c6
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push 0x30
push 0x1035708
call fcn.010015a0
mov dword [ebp - 0x20], 0xd
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x38], esi
push 4
pop edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x24]
push eax
push 0x20019
push esi
push 0x1035688
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x1035622
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
push 0x103565c
push dword [ebp - 0x24]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x1035622
cmp dword [ebp - 0x30], edi
jne 0x1035622
cmp dword [ebp - 0x34], edi
jne 0x1035622
cmp dword [ebp - 0x38], esi
je 0x1035622
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx]
call fcn.0100250b
mov edi, eax
mov dword [ebp - 0x3c], edi
test edi, edi
je 0x1035622
mov ecx, dword [ebx + 0xc]
call fcn.01015807
mov dword [ebp - 0x28], eax
test eax, eax
je 0x1035622
mov ecx, dword [ebx + 0xc]
call fcn.01015810
mov dword [ebp + 8], eax
test eax, eax
je 0x1035622
cmp dword [edi + 0xc], esi
je 0x1035622
mov ebx, dword [edi + 0xc]
mov edi, dword [ebx]
mov dword [ebp - 0x40], edi
cmp edi, 6
je 0x10354c1
cmp edi, 8
je 0x10354c1
cmp edi, 0xd
je 0x10354bc
cmp edi, 0xf
jne 0x1035622
add ebx, 0x14
jmp 0x10354c4
add ebx, 4
mov eax, dword [ebp - 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10354ca
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10354e0
sub eax, edx
sar eax, 1
add eax, ecx
movzx ecx, word [ebx]
lea eax, [ecx + eax*2]
mov dword [ebp - 0x1c], eax
cmp edi, 6
je 0x1035507
cmp edi, 0xd
je 0x1035507
push 0x24
jmp 0x1035509
push 0x1c
pop edi
add dword [ebp - 0x1c], edi
push dword [ebp - 0x1c]
call fcn.01013191
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
jne 0x103552a
mov dword [ebp - 0x20], 0xe
jmp 0x1035622
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1035530
sub eax, edx
sar eax, 1
movzx eax, ax
add eax, eax
mov word [esi + 4], ax
mov word [esi + 6], ax
mov dword [esi + 8], edi
movzx eax, word [esi + 4]
push eax
push dword [ebp + 8]
lea eax, [edi + esi]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
movzx eax, word [esi + 4]
add edi, eax
mov eax, dword [ebp - 0x28]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x103556e
sub eax, ecx
sar eax, 1
movzx eax, ax
add eax, eax
mov word [esi + 0xc], ax
mov word [esi + 0xe], ax
mov dword [esi + 0x10], edi
movzx eax, word [esi + 0xc]
push eax
push dword [ebp - 0x28]
lea eax, [edi + esi]
push eax
call sub.msvcrt.dll_memcpy
movzx eax, word [esi + 0xc]
add edi, eax
movzx eax, word [ebx]
mov word [esi + 0x14], ax
mov word [esi + 0x16], ax
mov dword [esi + 0x18], edi
movzx eax, word [esi + 0x14]
push eax
mov eax, dword [ebx + 4]
mov ebx, dword [ebp - 0x3c]
add eax, dword [ebx + 0xc]
push eax
add edi, esi
push edi
call sub.msvcrt.dll_memcpy
add esp, 0x18
mov eax, dword [ebp - 0x40]
cmp eax, 6
je 0x1035609
cmp eax, 0xd
je 0x1035609
cmp eax, 8
je 0x10355e2
cmp eax, 0xf
jne 0x103560f
mov dword [esi], 7
cmp eax, 8
mov eax, dword [ebx + 0xc]
jne 0x10355fe
mov ecx, dword [eax + 0x14]
mov dword [esi + 0x1c], ecx
mov eax, dword [eax + 0x18]
mov dword [esi + 0x20], eax
jmp 0x103560f
mov ecx, dword [eax + 0x28]
mov dword [esi + 0x1c], ecx
mov eax, dword [eax + 0x2c]
jmp 0x10355f9
mov dword [esi], 2
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ebx + 0xc], esi
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
call fcn.01035641
mov eax, dword [ebp - 0x20]
call fcn.01001580
ret 8