Function at 0xa5de40
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa028
call fcn.00ab5d50
mov eax, dword [0xae6d50]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0xa010]
push ecx
push 0x20119
push 0
push 0xac8a38
push 0x80000001
mov dword [ebp - 0xa018], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa5e076
push eax
mov ecx, dword [ebp - 0xa010]
push eax
push eax
push eax
lea edx, [ebp - 0xa014]
push edx
push eax
push eax
lea eax, [ebp - 0xa028]
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0xa5e069
mov eax, dword [ebp - 0xa014]
test eax, eax
je 0xa5e069
xor esi, esi
test eax, eax
je 0xa5e076
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
lea esp, [esp]
xor edx, edx
xor eax, eax
mov word [ebp - 0xa00c], dx
lea ecx, [ebp - 0xa01c]
push ecx
mov word [ebp - 0x800c], ax
lea edx, [ebp - 0xa00c]
push edx
lea eax, [ebp - 0xa024]
push eax
mov eax, dword [ebp - 0xa010]
push 0
lea ecx, [ebp - 0xa020]
push ecx
lea edx, [ebp - 0x800c]
push edx
push esi
push eax
mov dword [ebp - 0xa01c], 0x1000
mov dword [ebp - 0xa020], 0x3fff
call edi
push 0xac8b70
lea ecx, [ebp - 0xa00c]
push ecx
call ebx
test eax, eax
jne 0xa5df61
inc esi
cmp esi, dword [ebp - 0xa014]
jb 0xa5dee0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00a9e488
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0xa018]
push 0xac8bc0
push ebx
call fcn.00a64730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa5df9c
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa5df9c
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa5dfbd
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa5dfb5
or eax, 4
push 0
push eax
call fcn.00a52d10
push 0xac325c
push ecx
lea edx, [ebp - 0xa00c]
push edx
push ecx
push 0xac4bf8
push ecx
lea eax, [ebp - 0x800c]
push eax
push ecx
push 0xac83f8
push ebx
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa5e032
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa5e032
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa5e053
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa5e04b
or eax, 4
push 0
push eax
call fcn.00a52d10
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00a9e488
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xa010]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00a9e488
mov esp, ebp
pop ebp
ret