Function at 0x1000788e
Capabilities:
Get user security identifier
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
lea eax, [ebp - 0x24]
push edi
xor ebx, ebx
push eax
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x24], 0x12
mov byte [ebp - 0x23], 0x78
mov byte [ebp - 0x22], 0x79
mov byte [ebp - 0x21], 0x7a
mov byte [ebp - 0x20], 0x7d
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x70
mov byte [ebp - 0x1d], 0x68
mov byte [ebp - 0x1c], bl
call fcn.100075fc
mov dword [esp], str.KHO_LU
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x34], edi
je 0x10007935
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.khoyRIQYN_HYoYOOUSRO
push edi
call esi
push str.khomIYNEoYOOUSRuRZSNQ_HUSR
push edi
mov dword [0x1001082c], eax
call esi
push str.khozNYYqYQSNE
push edi
mov dword [0x10010830], eax
call esi
cmp dword [0x1001082c], ebx
mov dword [0x10010834], eax
je 0x1000792b
cmp dword [0x10010830], ebx
je 0x1000792b
cmp eax, ebx
je 0x1000792b
mov dword [ebp - 0x28], 1
jmp 0x10007935
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 4], 0x4dd
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10007b0c
cmp dword [ebp - 0x28], 1
jne 0x10007b0c
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push ebx
push ebx
call dword [0x1001082c]
test eax, eax
je 0x10007b0c
cmp dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], ebx
jbe 0x10007af0
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
add eax, ecx
cmp dword [eax + 8], ebx
jne 0x10007add
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 8]
push ecx
push 5
push dword [eax]
push ebx
call dword [0x10010830]
test eax, eax
je 0x10007add
lea eax, [ebp - 0x48]
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push ebx
push eax
push ebx
mov dword [ebp - 0x30], ebx
push dword [ebp - 8]
mov dword [ebp - 0x38], ebx
push ebx
call edi
test eax, eax
jne 0x10007ad1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7a
pop esi
cmp eax, esi
jne 0x10007ad1
push dword [ebp - 0x30]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp dword [ebp - 0xc], ebx
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
je 0x10007ad1
cmp eax, ebx
je 0x10007ad1
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push ebx
call edi
test eax, eax
je 0x10007abf
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push dword [ebp - 0xc]
call fcn.1000760a
add esp, 0xc
test eax, eax
jne 0x10007abf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x10007abf
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x10007a60
mov eax, dword [ebp - 0x40]
cmp dword [ecx], eax
jae 0x10007a60
mov dword [ecx], eax
mov dword [ebp - 4], esi
mov edi, dword [ebp + 0x14]
cmp edi, ebx
je 0x10007a73
mov eax, dword [ebp - 0x10]
cmp dword [edi], eax
jae 0x10007a73
mov dword [edi], eax
mov dword [ebp - 4], esi
cmp dword [ebp - 4], esi
je 0x10007abf
cmp dword [ebp + 8], ebx
je 0x10007a95
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp edi, ebx
je 0x10007a92
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x10], ebx
je 0x10007abf
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call fcn.1000760a
add esp, 0xc
test eax, eax
jne 0x10007abf
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x10007abc
mov ecx, dword [ebp - 0x40]
mov dword [eax], ecx
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x3c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
push dword [ebp - 8]
call dword [0x10010834]
mov dword [ebp - 8], ebx
inc dword [ebp - 0x14]
add dword [ebp - 0x2c], 0xc
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x44]
jb 0x10007980
push dword [ebp - 0x18]
call dword [0x10010834]
cmp dword [ebp - 4], ebx
je 0x10007caa
cmp dword [ebp - 4], 0x7a
je 0x10007caa
push ebx
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x14c]
push eax
push ebx
push 0x80000003
mov dword [ebp - 8], 0x104
mov dword [ebp - 0x14], ebx
call edi
cmp eax, 0x103
je 0x10007ca4
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x10007b6b
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x14
jle 0x10007c6b
lea eax, [ebp - 0x14c]
push eax
call fcn.1000771c
cmp eax, ebx
pop ecx
mov dword [ebp - 0x18], eax
je 0x10007c6b
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0xc], ebx
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc]
push ebx
push ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
jne 0x10007c6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x7a
pop edx
cmp eax, edx
jne 0x10007c62
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x10007c62
cmp dword [ebp - 0x10], ebx
je 0x10007c62
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x10007bde
cmp dword [ecx], eax
jae 0x10007bde
mov dword [ecx], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
je 0x10007bf1
mov eax, dword [ebp - 8]
cmp dword [ecx], eax
jae 0x10007bf1
mov dword [ecx], eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edx
je 0x10007c62
push dword [ebp - 0x10]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp dword [ebp + 8], ebx
pop ecx
mov esi, eax
je 0x10007c62
cmp esi, ebx
je 0x10007c62
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push esi
push eax
push dword [ebp + 8]
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x10007c5b
cmp dword [ebp + 0x10], ebx
mov dword [ebp - 4], ebx
je 0x10007c4f
lea eax, [ebp - 0x14c]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x10007c4c
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x10007c5b
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
inc dword [ebp - 0x14]
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x14c]
push eax
mov byte [ebp - 0x14c], bl
push dword [ebp - 0x14]
mov dword [ebp - 8], 0x104
push 0x80000003
call edi
cmp eax, 0x103
je 0x10007ca4
cmp dword [ebp - 4], ebx
jne 0x10007b3e
cmp dword [ebp - 0x28], 1
jne 0x10007cb8
cmp dword [ebp - 0x34], ebx
je 0x10007cb8
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 4]
mov dword [0x1001082c], ebx
mov dword [0x10010830], ebx
mov dword [0x10010834], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret