Function at 0x487370
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58d85c
mov eax, dword fs:[0]
push eax
sub esp, 0x6b0
mov eax, dword [0x61b000]
xor eax, ebp
mov dword [ebp - 0x3c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6bc], ecx
mov dword [ebp - 0x18], str.SAMSAMDomainsAccountUsersNames
mov dword [ebp - 0x10], str.SAMSAMDomainsAccountUsers
push 0x20019
mov eax, dword [ebp - 0x18]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.00487160
test eax, eax
jne 0x4873d6
xor eax, eax
jmp 0x487e50
lea ecx, [ebp - 0x14]
push ecx
push 0x20019
push 0
mov edx, dword [ebp - 0x18]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x487e1f
mov byte [ebp - 0x144], 0
push 0x103
push 0
lea eax, [ebp - 0x143]
push eax
call fcn.00568440
add esp, 0xc
mov dword [ebp - 0x2c], 0x104
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x254]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x38]
push edx
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0
jmp 0x48747b
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x38]
jae 0x487e1f
mov dword [ebp - 0x24], 0xff
lea edx, [ebp - 0x254]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x487e1a
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x47c], 0
mov byte [ebp - 0x46c], 0
push 0x103
push 0
lea ecx, [ebp - 0x46b]
push ecx
call fcn.00568440
add esp, 0xc
lea edx, [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0x5a1144
lea ecx, [ebp - 0x46c]
push ecx
call fcn.0048a4e0
add esp, 0x10
push 0x20019
lea edx, [ebp - 0x46c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.00487160
lea eax, [ebp - 0x478]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x46c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x487580
push 0
push 0
lea edx, [ebp - 0x470]
push edx
push 0
push 0
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
lea edx, [ebp - 0x46c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.00487160
cmp dword [ebp - 0x47c], 0
je 0x4875a7
jmp 0x487472
mov byte [ebp - 0x364], 0
push 0x103
push 0
lea eax, [ebp - 0x363]
push eax
call fcn.00568440
add esp, 0xc
mov ecx, dword [ebp - 0x470]
push ecx
push str._08X
lea edx, [ebp - 0x364]
push edx
call fcn.0048a4e0
add esp, 0xc
lea eax, [ebp - 0x364]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x5a1154
lea edx, [ebp - 0x46c]
push edx
call fcn.0048a4e0
add esp, 0x10
push 0x20019
lea eax, [ebp - 0x46c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.00487160
test eax, eax
jne 0x48763c
lea ecx, [ebp - 0x46c]
push ecx
push str.error__S
push 0x5a1170
call fcn.0040c230
add esp, 0xc
jmp 0x487472
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x49c]
call fcn.00406050
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x49c]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
add eax, 0x20
mov ecx, eax
call fcn.00406110
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x49c]
call fcn.004060d0
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x4b8]
call fcn.00406050
mov dword [ebp - 4], 1
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x4b8]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
add eax, 4
mov ecx, eax
call fcn.00406110
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b8]
call fcn.004060d0
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x480], 0
lea edx, [ebp - 0x478]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x46c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x480]
push ecx
push 0
push 0
push 0
push 0x5a1198
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x487744
cmp dword [ebp - 0x480], 0
jne 0x487788
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x5a11a0
push 0x5a11e4
call fcn.0040c230
add esp, 0xc
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
lea ecx, [ebp - 0x46c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.00487160
jmp 0x487472
mov edx, dword [ebp - 0x480]
push edx
call fcn.00561ab0
add esp, 4
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x487df4
lea eax, [ebp - 0x480]
push eax
mov ecx, dword [ebp - 0x474]
push ecx
push 0
push 0
push 0x5a119c
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x487de5
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x4d8]
call fcn.00406050
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x4d8]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
movzx edx, byte [eax]
neg edx
sbb edx, edx
add edx, 1
mov byte [ebp - 0x4b9], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d8]
call fcn.004060d0
movzx eax, byte [ebp - 0x4b9]
test eax, eax
je 0x487abd
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x4f4]
call fcn.00406050
mov dword [ebp - 4], 3
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x510]
call fcn.00406050
mov byte [ebp - 4], 4
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x52c]
call fcn.00406050
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x548]
call fcn.00406050
mov byte [ebp - 4], 6
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x564]
call fcn.00406050
mov byte [ebp - 4], 7
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x580]
call fcn.00406050
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x474]
movzx edx, byte [ecx + 0x1c]
push edx
mov eax, dword [ebp - 0x474]
movzx ecx, byte [eax + 0x1b]
push ecx
mov edx, dword [ebp - 0x474]
movzx eax, byte [edx + 0x1a]
push eax
mov ecx, dword [ebp - 0x474]
movzx edx, byte [ecx + 0x19]
push edx
mov eax, dword [ebp - 0x474]
movzx ecx, byte [eax + 0x18]
push ecx
lea edx, [ebp - 0x4f4]
push edx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
movzx eax, byte [eax + 0x40]
push eax
lea ecx, [ebp - 0x510]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
movzx edx, byte [eax + 0x3f]
push edx
lea eax, [ebp - 0x52c]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
movzx ecx, byte [eax + 0x3e]
push ecx
lea edx, [ebp - 0x548]
push edx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
movzx eax, byte [eax + 0x3d]
push eax
lea ecx, [ebp - 0x564]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
movzx edx, byte [eax + 0x3c]
push edx
lea eax, [ebp - 0x580]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
add eax, 0x20
mov ecx, eax
call fcn.00406190
push eax
push 0x1da
push str.MyDebugINfo__d_:__S_Init__02x__02x__02x__02x__02x_____02x__02x__02x__02x__02x
push 0x5a12b4
call fcn.0040c230
add esp, 0x38
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x580]
call fcn.004060d0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
call fcn.004060d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x548]
call fcn.004060d0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x52c]
call fcn.004060d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x510]
call fcn.004060d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f4]
call fcn.004060d0
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x59c]
call fcn.00406050
mov dword [ebp - 4], 9
mov esi, dword [ebp - 0x474]
add esi, 0x18
lea edx, [ebp - 0x59c]
push edx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
add eax, 0x3c
mov ecx, dword [esi]
mov dword [eax], ecx
mov dl, byte [esi + 4]
mov byte [eax + 4], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x59c]
call fcn.004060d0
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x5b8]
call fcn.00406050
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x5b8]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
mov byte [eax], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b8]
call fcn.004060d0
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x5d8]
call fcn.00406050
mov dword [ebp - 4], 0xb
mov ebx, 5
mov edi, dword [ebp - 0x474]
add edi, 0x18
lea eax, [ebp - 0x5d8]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
add eax, 0x3c
mov esi, eax
mov ecx, ebx
xor edx, edx
mov eax, 0
repe cmpsb byte [esi], byte es:[edi]
setne al
mov byte [ebp - 0x5b9], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d8]
call fcn.004060d0
movzx ecx, byte [ebp - 0x5b9]
test ecx, ecx
je 0x487de5
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x5f4]
call fcn.00406050
mov dword [ebp - 4], 0xc
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x610]
call fcn.00406050
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x62c]
call fcn.00406050
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x648]
call fcn.00406050
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x664]
call fcn.00406050
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x680]
call fcn.00406050
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x474]
movzx eax, byte [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x474]
movzx edx, byte [ecx + 0x1b]
push edx
mov eax, dword [ebp - 0x474]
movzx ecx, byte [eax + 0x1a]
push ecx
mov edx, dword [ebp - 0x474]
movzx eax, byte [edx + 0x19]
push eax
mov ecx, dword [ebp - 0x474]
movzx edx, byte [ecx + 0x18]
push edx
lea eax, [ebp - 0x5f4]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
movzx ecx, byte [eax + 0x40]
push ecx
lea edx, [ebp - 0x610]
push edx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
movzx eax, byte [eax + 0x3f]
push eax
lea ecx, [ebp - 0x62c]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
movzx edx, byte [eax + 0x3e]
push edx
lea eax, [ebp - 0x648]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
movzx ecx, byte [eax + 0x3d]
push ecx
lea edx, [ebp - 0x664]
push edx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
movzx eax, byte [eax + 0x3c]
push eax
lea ecx, [ebp - 0x680]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
add eax, 0x20
mov ecx, eax
call fcn.00406190
push eax
push 0x1ed
push str.MyDebugINfo__d_:__S_pwd_changed__02x__02x__02x__02x__02x_____02x__02x__02x__02x__02x
push str.CUserPrivilegeMonitor::DetectPwdChanged
call fcn.0040c230
add esp, 0x38
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x680]
call fcn.004060d0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x664]
call fcn.004060d0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x648]
call fcn.004060d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x62c]
call fcn.004060d0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x610]
call fcn.004060d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5f4]
call fcn.004060d0
mov ecx, dword [ebp - 0x6bc]
call fcn.00487e70
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x69c]
call fcn.00406050
mov dword [ebp - 4], 0x12
push 0x5a120c
lea eax, [ebp - 0x69c]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
add eax, 0x20
mov ecx, eax
call fcn.00406190
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x28
push ecx
call fcn.004339d0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x69c]
call fcn.004060d0
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x6b8]
call fcn.00406050
mov dword [ebp - 4], 0x13
mov esi, dword [ebp - 0x474]
add esi, 0x18
lea eax, [ebp - 0x6b8]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00487ff0
add eax, 0x3c
mov ecx, dword [esi]
mov dword [eax], ecx
mov dl, byte [esi + 4]
mov byte [eax + 4], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b8]
call fcn.004060d0
mov eax, dword [ebp - 0x474]
push eax
call fcn.005619d3
add esp, 4
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
lea edx, [ebp - 0x46c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.00487160
jmp 0x487472
push 0x10
mov eax, dword [ebp - 0x18]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.00487160
cmp dword [ebp - 0x14], 0
je 0x487e4b
cmp dword [ebp - 0x14], 0xffffffff
je 0x487e4b
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x3c]
xor ecx, ebp
call fcn.00560c61
mov esp, ebp
pop ebp
ret