Function at 0x42aac3
Capabilities:
Contain obfuscated stackstrings
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x4a5569
mov eax, dword fs:[0]
push eax
sub esp, 0x39c
mov eax, dword [0x4d3a00]
xor eax, esp
mov dword [esp + 0x398], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d3a00]
xor eax, esp
push eax
lea eax, [esp + 0x3b0]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3b8], ebx
mov esi, str.SYSTEMCurrentControlSet_servicesQQPCRTP
push 0x20219
push esi
mov edi, reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x2c]
push edi
call fcn.004315e0
test eax, eax
je 0x42ab41
push 0x20119
push esi
push edi
lea ecx, [esp + 0x30]
call fcn.004315e0
xor eax, eax
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], ebx
mov word [esp + 0x74], ax
inc eax
mov byte [esp + 0x3b8], al
lea eax, [esp + 0x74]
push eax
push str.ImagePath
lea ecx, [esp + 0x2c]
call fcn.004316d0
push ecx
lea ecx, [esp + 0x40]
call fcn.004341a0
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
call fcn.00434cb0
mov byte [esp + 0x3b8], 2
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x40]
call fcn.00434750
mov byte [esp + 0x3b8], 3
lea ecx, [esp + 0x14c]
call fcn.004419f0
mov byte [esp + 0x3b8], 4
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x150]
call fcn.004417a0
test al, al
je 0x42ac26
mov eax, dword [esp + 0x174]
mov edx, vtable.base::win::PEImage.0
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov byte [esp + 0x3b8], 5
lea ecx, [esp + 0x30]
call fcn.0044f440
push 1
test al, al
movzx ebx, bl
pop ebp
cmovne ebx, ebp
mov byte [esp + 0x3b8], 4
mov dword [esp + 0x30], edx
jmp 0x42ac29
xor ebp, ebp
inc ebp
xor eax, eax
xor edi, edi
push 0x200
mov word [esp + 0x1a8], ax
lea eax, [esp + 0x1aa]
push edi
push eax
call fcn.00482250
add esp, 0xc
mov dword [esp + 0x38], 0x100
lea eax, [esp + 0x38]
mov esi, edi
push eax
lea eax, [esp + 0x1a8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x42ac87
lea eax, [esp + 0x1a4]
push str.system
push eax
call fcn.0047b6f6
mov esi, eax
neg esi
pop ecx
sbb esi, esi
pop ecx
inc esi
lea edx, [esp + 0x18]
mov dword [esp + 0x18], edi
mov ecx, esi
call fcn.0042a70d
mov dword [esp + 0x14], eax
xor eax, eax
push 0xf
pop edi
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa0], edi
mov dword [esp + 0x9c], eax
mov byte [esp + 0x8c], al
mov byte [esp + 0x3b8], 6
test esi, esi
lea edx, [esp + 0x8c]
setne cl
call fcn.0042a4d8
push 0x4ba184
lea ecx, [esp + 0x138]
call fcn.004014ed
mov byte [esp + 0x3b8], 7
lea ecx, [esp + 0xec]
push 0x4ba174
call fcn.004014ed
mov byte [esp + 0x3b8], 8
lea ecx, [esp + 0x104]
push 0x4ba178
call fcn.004014ed
mov byte [esp + 0x3b8], 9
lea ecx, [esp + 0xd4]
push 0x4ba160
call fcn.004014ed
mov byte [esp + 0x3b8], 0xa
lea ecx, [esp + 0xbc]
push str.stype
call fcn.004014ed
mov byte [esp + 0x3b8], 0xb
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xb8], edi
mov dword [esp + 0xb4], eax
mov byte [esp + 0xa4], al
mov byte [esp + 0x3b8], 0xc
lea ecx, [esp + 0x5c]
push 0xc
push 0x53
call fcn.0046b350
mov ecx, eax
mov byte [esp + 0x3b8], 0xd
lea eax, [esp + 0xa4]
fild dword [esp + 0x18]
push eax
push ecx
push ecx
lea eax, [esp + 0x140]
fstp qword [esp + 0x28]
fld qword [esp + 0x28]
fstp qword [esp]
fild dword [esp + 0x20]
push eax
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0x100]
push eax
fstp qword [esp + 0x34]
fld qword [esp + 0x34]
lea eax, [esp + 0x11c]
push ecx
push ecx
fstp qword [esp]
push eax
movzx eax, bl
mov dword [esp + 0x38], eax
lea eax, [esp + 0xf8]
fild dword [esp + 0x38]
push ecx
push ecx
fstp qword [esp + 0x48]
fld qword [esp + 0x48]
fstp qword [esp]
fld qword [0x4bfc58]
push eax
push ecx
push ecx
lea eax, [esp + 0xf4]
fstp qword [esp]
push eax
call fcn.0046bba0
mov ecx, eax
call fcn.0046bba0
mov ecx, eax
call fcn.0046bba0
mov ecx, eax
call fcn.0046b940
mov ecx, eax
call fcn.0046bba0
mov ecx, eax
call fcn.0046bcd0
mov byte [esp + 0x3b8], 0xc
lea ecx, [esp + 0x5c]
call fcn.0046b3c0
mov byte [esp + 0x3b8], 0xb
xor edi, edi
push edi
push ebp
lea ecx, [esp + 0xac]
call fcn.0040162e
mov byte [esp + 0x3b8], 0xa
lea ecx, [esp + 0xbc]
push edi
push ebp
call fcn.0040162e
mov byte [esp + 0x3b8], 9
lea ecx, [esp + 0xd4]
push edi
push ebp
call fcn.0040162e
mov byte [esp + 0x3b8], 8
lea ecx, [esp + 0x104]
push edi
push ebp
call fcn.0040162e
mov byte [esp + 0x3b8], 7
lea ecx, [esp + 0xec]
push edi
push ebp
call fcn.0040162e
mov byte [esp + 0x3b8], 6
lea ecx, [esp + 0x134]
push edi
push ebp
call fcn.0040162e
mov byte [esp + 0x3b8], 4
lea ecx, [esp + 0x8c]
push edi
push ebp
call fcn.0040162e
mov byte [esp + 0x3b8], 3
lea ecx, [esp + 0x14c]
call fcn.00441710
mov byte [esp + 0x3b8], 2
lea ecx, [esp + 0x11c]
call fcn.004300b0
xor eax, eax
inc eax
mov byte [esp + 0x3b8], al
lea ecx, [esp + 0x3c]
call fcn.00434280
mov byte [esp + 0x3b8], 0
xor eax, eax
push edi
inc eax
push eax
lea ecx, [esp + 0x7c]
call fcn.0040314a
or dword [esp + 0x3b8], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.00431540
mov al, bl
mov ecx, dword [esp + 0x3b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x398]
xor ecx, esp
call fcn.0047aabf
add esp, 0x3a8
ret