Function at 0x42fb8c
Capabilities:
Contain obfuscated stackstrings
Encrypt data using dpapi
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x46c8
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x4698]
push eax
push 0x20019
xor ecx, ecx
mov dword [ebp - 0x469c], 0x1388
push ecx
push str.SoftwareMicrosoftIdentityCRLDynamic_Salt
push SysReAllocString
mov dword [ebp - 0x44], 0x470025
mov dword [ebp - 0x40], 0x50004b
mov dword [ebp - 0x3c], 0x5e0024
mov dword [ebp - 0x38], 0x5e0025
mov dword [ebp - 0x34], 0x4c0026
mov dword [ebp - 0x30], 0x28004c
mov dword [ebp - 0x2c], 0x5e0025
mov dword [ebp - 0x28], 0x5e0024
mov dword [ebp - 0x24], 0x26004f
mov dword [ebp - 0x20], 0x520054
mov dword [ebp - 0x1c], 0x5e0024
mov dword [ebp - 0x18], 0x5e0025
mov dword [ebp - 0x14], 0x560047
mov dword [ebp - 0x10], 0x3b0036
mov dword [ebp - 0xc], 0x78006c
mov dword [ebp - 8], 0x64007a
call ebx
test eax, eax
je 0x42fc5d
push eax
push str.RecoverMSN75Password
push str._s_:_Failed_to_find_msn_SALT_value_in_registry__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x42fedf
push esi
push edi
lea eax, [ebp - 0x469c]
push eax
lea eax, [ebp - 0x4694]
push eax
lea eax, [ebp - 0x46b4]
push eax
push 0
push str.Value
push dword [ebp - 0x4698]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x4698]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
call edi
test esi, esi
je 0x42fcab
push esi
push str.RecoverMSN75Password
push str._s_:_Failed_to_find_msn_salt_in_registry__Error0x_.8x
jmp 0x42fdac
push dword [ebp - 0x469c]
push dword [ebp - 0x469c]
push str.RecoverMSN75Password
push str._s_:_Found_msn_salt_value_of_length__d__0x_.8x_
call fcn.00449974
push str._n_Decrypting_SALT_data_now...
call fcn.00449974
add esp, 0x14
mov dword [ebp - 0x46c0], 0x40
lea eax, [ebp - 0x4694]
xor esi, esi
mov dword [ebp - 0x46c4], eax
mov eax, dword [ebp - 0x469c]
mov dword [ebp - 0x46c8], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x46bc], eax
lea eax, [ebp - 0x46b0]
push eax
push 1
push esi
push esi
lea eax, [ebp - 0x46c0]
push eax
push esi
lea eax, [ebp - 0x46c8]
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
jne 0x42fd38
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_n_CryptUnprotectData_failed_to_decrypt_the_salt_with_error__0x_.8x
call fcn.00449974
pop ecx
pop ecx
jmp 0x42fdb4
push dword [ebp - 0x46b0]
push str._n_nDecrypted_MSN_SALT_data_successfully_of_lenth__d
call fcn.00449974
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1f84]
push eax
call fcn.006269d0
push dword [ebp - 0x46b0]
lea eax, [ebp - 0x1f44]
push dword [ebp - 0x46ac]
push eax
call fcn.006269d0
mov eax, dword [ebp - 0x46b0]
add esp, 0x20
add eax, 0x40
mov dword [ebp - 0x46b8], eax
lea eax, [ebp - 0x4698]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftIdentityCRLCreds
push SysReAllocString
call ebx
test eax, eax
je 0x42fdbb
push eax
push str.RecoverMSN75Password
push str._s_:_Failed_to_find_MSN_stored_CREDS_in_the_registry__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x42fedd
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x46a4]
mov ebx, esi
push eax
lea eax, [ebp - 0x42c]
push eax
push esi
jmp 0x42fea1
lea eax, [ebp - 0x42c]
push eax
push str.SoftwareMicrosoftIdentityCRLCreds_s
lea eax, [ebp - 0x814]
push 0x3e8
push eax
call fcn.00445d6d
lea eax, [ebp - 0x42c]
push eax
push str.RecoverMSN75Password
push str._s_:_Now_checking_for_MSN_account_name_for_any_stored_password__s
call fcn.00449974
add esp, 0x1c
lea eax, [ebp - 0x46a8]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x814]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ff6e
lea eax, [ebp - 0x46a0]
mov dword [ebp - 0x46a0], 0x1388
push eax
lea eax, [ebp - 0x330c]
push eax
lea eax, [ebp - 0x46b4]
push eax
push esi
push str.ps:password
push dword [ebp - 0x46a8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x46a8]
mov esi, eax
call edi
test esi, esi
je 0x42feec
push esi
lea eax, [ebp - 0x42c]
push eax
push str.RecoverMSN75Password
push str._s_:_Failed_to_find_stored_msn_password_for_the_account__s_in_registry__Error0x_.8x
call fcn.00449974
add esp, 0x10
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x46a4]
inc ebx
push eax
lea eax, [ebp - 0x42c]
push eax
push ebx
push dword [ebp - 0x4698]
mov dword [ebp - 0x46a4], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x42fdd5
push eax
push str.RecoverMSN75Password
push str._s_:_RegEnumKeyEx_returned_with_status__0x_.8x
call fcn.00449974
add esp, 0xc
push dword [ebp - 0x4698]
call edi
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
lea eax, [ebp - 0x330c]
push eax
push dword [ebp - 0x46a0]
lea eax, [ebp - 0x42c]
push eax
push str.RecoverMSN75Password
push str._s_:_Found_msn_account_password_for__s__password__d___s
call fcn.00449974
push 0x3e8
lea eax, [ebp - 0xbfc]
push eax
push dword [ebp - 0x46b8]
lea eax, [ebp - 0x1f84]
push eax
push dword [ebp - 0x46a0]
lea eax, [ebp - 0x330c]
push eax
call fcn.0040b780
add esp, 0x2c
test eax, eax
je 0x42fe8b
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0xbfc]
push ecx
push eax
lea eax, [ebp - 0x42c]
push eax
push ecx
push ecx
push 0x66
push 3
call fcn.00412c85
add esp, 0x20
jmp 0x42fe8b
push eax
push str.RecoverMSN75Password
push str._s_:_Failed_to_find__msn_username_in_registry__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x42fe8d