Function at 0x4ac240
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fbd50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x280
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
push 0x80
mov dword [ebp - 4], esi
call fcn.004f266a
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push 0x1f4
call fcn.004f266a
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push closesocket
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x4ac454
mov dword [ebp - 0x24], esi
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x18]
push ebx
push edx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x80
mov dword [ebp - 0x34], 0x1f4
push 0
mov byte [ebx], 0
mov edx, dword [ebp - 0x20]
push eax
push edi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x4ac454
mov ecx, dword [ebp - 0x24]
xor eax, eax
inc ecx
lea edx, [ebp - 0x98]
mov dword [ebp - 0x24], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x98]
push ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x28c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
cmp ecx, 3
jg 0x4ac364
mov edi, 0x50e258
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, dword [0xf23368]
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + ebx*4]
mov edi, str.HKEY_LOCAL_MACHINE
lea edx, [ebx + ecx*2]
or ecx, 0xffffffff
shl edx, 6
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [edx + 0xe61b08]
mov eax, ecx
mov dword [ebp - 0x14], esi
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [edx + 0xe61b48]
mov eax, ecx
mov dword [ebp - 0x14], esi
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea esi, [edx + 0xe61c48]
sub edi, ecx
mov eax, ecx
mov dword [ebp - 0x14], esi
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
lea edx, [edx + 0xe61cc8]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x28c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc eax
mov dword [0xf23368], ebx
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
jmp 0x4ac2bc
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.004f265f
add esp, 4
push ebx
call fcn.004f265f
add esp, 4
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret