Function at 0x42d572
Capabilities:
Get session user name
Get system information on windows
Query or enumerate registry value
Set registry value

Disassembly:
push 0xb00
mov eax, 0x47525e
call fcn.0044b825
mov eax, dword [ebp + 8]
mov esi, ecx
push dword [esi + 0xc]
xor edi, edi
push edi
push 0x1f0fff
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xac8], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xac4], eax
lea eax, [ebp - 0xab4]
mov dword [ebp - 0xac0], edi
mov dword [ebp - 0xabc], 0x200
mov dword [ebp - 0xab8], eax
mov dword [ebp - 4], edi
cmp byte [esi + 8], 0
mov dword [ebp - 0xacc], 0x493f08
jne 0x42d5e2
mov dword [ebp - 0xacc], 0x493f14
mov eax, 0xfde9
push eax
push 0xffffffffffffffff
push dword [esi]
lea ecx, [ebp - 0x890]
call fcn.00409428
mov ebx, eax
lea eax, [ebp - 0xac0]
add esp, 0xc
push eax
mov ecx, 0x493f4c
call fcn.0040f0ce
pop ecx
push eax
mov eax, ebx
call fcn.0040e3bf
pop ecx
mov ebx, 0x493c60
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
push eax
mov ecx, 0x493f30
call fcn.0040f0ce
pop ecx
mov ecx, dword [ebp - 0xacc]
push eax
call fcn.0040f0ce
pop ecx
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
push edi
push 1
lea ecx, [ebp - 0x890]
call fcn.004063d7
cmp dword [ebp - 0xac4], edi
je 0x42d849
mov eax, dword [esi + 0x18]
cmp eax, edi
je 0x42d849
mov eax, dword [eax + 4]
push dword [eax + 0xb8]
mov edi, dword [ebp - 0xac4]
lea ecx, [ebp - 0x8ac]
call fcn.0042e7d0
mov edi, eax
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 4]
pop ecx
mov ecx, dword [eax + 0xb8]
mov eax, dword [eax + 0xbc]
push 0x3a
push dword [esi + 0x10]
mov dword [ebp - 0xad0], eax
push dword [esi + 0xc]
lea eax, [ebp - 0xac0]
mov dword [ebp - 0x87c], ecx
push eax
mov ecx, 0x493f88
mov dword [ebp - 0x878], 8
mov dword [ebp - 0xacc], 4
call fcn.0040f0ce
pop ecx
mov esi, eax
call fcn.0042e939
pop ecx
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
push eax
mov ecx, 0x493f78
call fcn.0040f0ce
pop ecx
mov esi, eax
call fcn.0042e939
pop ecx
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
push eax
mov ecx, 0x493f64
call fcn.0040f0ce
pop ecx
push eax
mov eax, edi
call fcn.0040e3bf
pop ecx
push eax
mov ecx, 0x493f60
call fcn.0040f0ce
pop ecx
lea esi, [ebp - 0xad0]
mov edi, eax
call fcn.0042e6e9
call fcn.004094fa
pop ecx
lea esi, [ebp - 0x87c]
mov edi, eax
call fcn.0042e6e9
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
push 0
push 1
lea ecx, [ebp - 0x8ac]
call fcn.004063d7
mov eax, dword [ebp - 0xac8]
mov eax, dword [eax + 0x18]
mov eax, dword [eax]
mov eax, dword [eax]
push eax
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x878], 8
call fcn.0042e7a9
mov esi, eax
pop ecx
lea eax, [ebp - 0xac0]
push eax
mov ecx, 0x493fa4
call fcn.0040f0ce
pop ecx
push eax
mov ecx, esi
call fcn.0040f0ce
pop ecx
push eax
mov ecx, 0x493f9c
call fcn.0040f0ce
pop ecx
lea esi, [ebp - 0x87c]
mov edi, eax
call fcn.0042e6e9
push eax
mov ecx, 0x493f98
call fcn.0040f0ce
mov eax, dword [ebp - 0xac8]
mov eax, dword [eax + 0x18]
mov eax, dword [eax]
cmp dword [eax], 0xc0000005
pop ecx
jne 0x42d847
cmp dword [eax + 0x10], 2
jb 0x42d847
cmp dword [eax + 0x14], 0
mov esi, 0x493fe8
jne 0x42d7f4
mov esi, 0x493ff4
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x87c], eax
lea eax, [ebp - 0xac0]
push eax
mov ecx, 0x494000
mov dword [ebp - 0x878], 8
call fcn.0040f0ce
pop ecx
push eax
mov ecx, esi
call fcn.0040f0ce
pop ecx
push eax
mov ecx, 0x493fd8
call fcn.0040f0ce
pop ecx
lea esi, [ebp - 0x87c]
mov edi, eax
call fcn.0042e6e9
push eax
mov ecx, 0x493fb8
call fcn.0040f0ce
pop ecx
xor edi, edi
lea eax, [ebp - 0xad8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0xac0]
push eax
mov ecx, 0x494014
call fcn.0040f0ce
mov esi, eax
pop ecx
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0xad8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
test eax, eax
je 0x42d891
lea eax, [ebp - 0x87c]
push eax
call fcn.0042de06
pop ecx
jmp 0x42d893
mov eax, esi
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
cmp dword [ebp - 0xac4], edi
je 0x42d9b2
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0x870]
push eax
push dword [ebp - 0xac4]
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x42d938
mov eax, dword [ebp - 0xad8]
sub eax, dword [ebp - 0x870]
mov ecx, dword [ebp - 0xad4]
sbb ecx, dword [ebp - 0x86c]
push edi
push 0x2710
push ecx
push eax
call fcn.00458f40
mov dword [ebp - 0x880], eax
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0xac0]
push eax
mov ecx, 0x494028
mov dword [ebp - 0x87c], edx
call fcn.0040f0ce
pop ecx
mov esi, eax
call fcn.0042e733
pop ecx
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
mov ecx, dword [ebp - 0xac4]
lea ebx, [ebp - 0x890]
call fcn.0042dcc9
mov ecx, 0xfde9
push ecx
lea ecx, [ebp - 0x8ac]
push ecx
mov byte [ebp - 4], 1
call fcn.00409499
mov esi, eax
lea eax, [ebp - 0xac0]
push eax
mov ecx, 0x49403c
call fcn.0040f0ce
add esp, 0xc
push eax
mov eax, esi
call fcn.0040e3bf
pop ecx
push eax
mov ecx, 0x493c60
call fcn.0040f0ce
pop ecx
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x8ac]
call fcn.004063d7
push ebx
push 1
lea ecx, [ebp - 0x890]
mov byte [ebp - 4], bl
call fcn.0040363d
mov ebx, 0x493c60
xor edi, edi
lea eax, [ebp - 0xac0]
push eax
mov ecx, ebx
call fcn.0040f0ce
xor eax, eax
mov word [ebp - 0x850], ax
mov dword [esp], 0x7fe
lea eax, [ebp - 0x84e]
push edi
push eax
call fcn.0044bcb0
add esp, 0xc
lea eax, [ebp - 0xadc]
push eax
lea eax, [ebp - 0x850]
mov esi, 0x400
push eax
mov dword [ebp - 0xadc], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x42da18
push 0x49404c
lea eax, [ebp - 0x850]
push esi
push eax
call fcn.0044cdab
add esp, 0xc
mov eax, 0xfde9
push eax
lea eax, [ebp - 0x850]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x8ac]
call fcn.00409428
mov esi, eax
lea eax, [ebp - 0xac0]
add esp, 0xc
push eax
mov ecx, 0x49405c
call fcn.0040f0ce
pop ecx
push eax
mov eax, esi
call fcn.0040e3bf
pop ecx
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
push edi
push 1
lea ecx, [ebp - 0x8ac]
call fcn.004063d7
push 0x3f
lea eax, [ebp - 0x4f]
push edi
push eax
mov byte [ebp - 0x50], 0
call fcn.0044bcb0
add esp, 0xc
lea eax, [ebp - 0xae4]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0xae8]
push eax
push 0x494068
push 0x49406c
mov esi, SysReAllocString
push esi
mov dword [ebp - 0xae8], edi
mov dword [ebp - 0xae4], 0x40
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x42db2a
mov dword [ebp - 0x884], edi
xor eax, eax
lea edi, [ebp - 0x880]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x884]
push eax
call fcn.0042f15a
pop ecx
test al, al
je 0x42db03
push dword [ebp - 0x878]
lea eax, [ebp - 0x50]
push dword [ebp - 0x87c]
push dword [ebp - 0x880]
push dword [ebp - 0x884]
push 0x494084
push eax
call fcn.0042e897
add esp, 0x18
lea eax, [ebp - 0x50]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42db09
sub eax, edx
push eax
lea eax, [ebp - 0x50]
push eax
push 1
push 0x494068
push 0x49406c
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea eax, [ebp - 0xac0]
push eax
mov ecx, 0x4940a8
call fcn.0040f0ce
pop ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.0040f0ce
pop ecx
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
push eax
mov ecx, 0x494098
call fcn.0040f0ce
pop ecx
mov edi, eax
call fcn.0042de9f
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
lea eax, [ebp - 0xb0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0xaf4]
lea eax, [ebp - 0xac0]
push dword [ebp - 0xaf8]
mov ecx, 0x4940c8
push eax
call fcn.0040f0ce
pop ecx
mov esi, eax
call fcn.0042e939
pop ecx
push eax
mov ecx, 0x4940b0
call fcn.0040f0ce
pop ecx
mov esi, eax
call fcn.0042e939
pop ecx
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
lea eax, [ebp - 0xac0]
push eax
mov ecx, 0x4940d4
call fcn.0040f0ce
pop ecx
mov ebx, eax
call fcn.0042dfde
mov edi, 0x493c60
push eax
mov ecx, edi
call fcn.0040f0ce
mov eax, dword [ebp - 0xac4]
pop ecx
mov ebx, 0x4940f0
test eax, eax
je 0x42dc28
mov dword [ebp - 0xac8], eax
lea eax, [ebp - 0xac0]
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
push eax
mov ecx, 0x4940e0
call fcn.0040f0ce
pop ecx
push eax
lea esi, [ebp - 0xac8]
call fcn.0042e12d
pop ecx
push eax
mov ecx, edi
call fcn.0040f0ce
pop ecx
lea eax, [ebp - 0xac0]
push eax
mov ecx, ebx
call fcn.0040f0ce
pop ecx
push eax
mov ecx, 0x49412c
call fcn.0040f0ce
pop ecx
push 0
push 2
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
je 0x42dc5f
push esi
mov ecx, eax
call fcn.0042e51e
pop ecx
jmp 0x42dc61
mov eax, esi
push eax
mov ecx, edi
call fcn.0040f0ce
cmp dword [ebp - 0xac4], 0
pop ecx
je 0x42dc7f
push dword [ebp - 0xac4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xac0]
mov ecx, dword [ebp - 0xab8]
mov edi, dword [ebp - 0xae0]
mov byte [ecx + eax], 0
mov edx, dword [ebp - 0xab8]
push eax
xor ecx, ecx
mov ebx, 0x49413c
call fcn.00430a89
lea eax, [ebp - 0xab4]
pop ecx
cmp dword [ebp - 0xab8], eax
je 0x42dcc3
push dword [ebp - 0xab8]
call fcn.0044c187
pop ecx
call fcn.0044b8a8
ret