Function at 0x47a240
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x64cc5e
mov eax, dword fs:[0]
push eax
sub esp, 0x2e4
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0x2e0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x2f8]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], esi
call fcn.004024f0
xor edi, edi
mov dword [esp + 0x300], edi
lea ecx, [esp + 0x20]
call fcn.004024f0
mov byte [esp + 0x300], 1
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.00469930
test eax, eax
je 0x47acbf
lea ecx, [esp + 0x4c]
mov dword [esp + 0x14], edi
call fcn.0051cc30
mov byte [esp + 0x300], 2
lea ecx, [esp + 0x5c]
call fcn.0051cc30
mov bl, 3
mov byte [esp + 0x300], bl
mov ecx, dword [0x75dbac]
mov eax, dword [esp + 0x24]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x14]
push edx
push 0xf003f
neg ecx
push edi
sbb ecx, ecx
push eax
add ecx, 0x80000002
push ecx
call ebp
mov esi, eax
cmp esi, edi
je 0x47a469
cmp esi, 2
je 0x47a3dd
lea ecx, [esp + 0x28]
call fcn.004024f0
mov byte [esp + 0x300], 4
mov eax, str.CURRENT_USER
cmp dword [0x75dbac], edi
jne 0x47a343
mov eax, str.MACHINE
mov edx, dword [esp + 0x24]
push edx
push eax
lea eax, [esp + 0x30]
push 0x67bc94
push eax
call fcn.00402f60
mov ecx, dword [esp + 0x38]
add esp, 0x10
push ecx
lea ecx, [esp + 0x50]
call fcn.0051cd20
test eax, eax
je 0x47a392
mov ecx, dword [0x75dbac]
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x14]
push edx
push 0xf003f
neg ecx
push edi
sbb ecx, ecx
push eax
add ecx, 0x80000002
push ecx
call ebp
mov esi, eax
cmp esi, edi
je 0x47a3cd
mov edx, dword [esp + 0x28]
push edx
lea ecx, [esp + 0x50]
call fcn.0051cdf0
test eax, eax
je 0x47a3cd
mov edx, dword [0x75dbac]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x14]
push eax
push 0xf003f
neg edx
push edi
sbb edx, edx
push ecx
add edx, 0x80000002
push edx
call ebp
mov esi, eax
mov byte [esp + 0x300], bl
lea ecx, [esp + 0x28]
call fcn.00402560
cmp esi, edi
je 0x47a469
cmp dword [0x75dbac], edi
jne 0x47a469
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x14]
push eax
push 0xf003f
push edi
push ecx
push 0x80000001
call ebp
test eax, eax
je 0x47a469
lea ecx, [esp + 0x18]
call fcn.004024f0
mov byte [esp + 0x300], 5
mov edx, dword [esp + 0x24]
push edx
lea eax, [esp + 0x1c]
push str.CURRENT_USER_s
push eax
call fcn.00402f60
mov ecx, dword [esp + 0x24]
add esp, 0xc
push ecx
lea ecx, [esp + 0x60]
call fcn.0051cd20
test eax, eax
je 0x47a459
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x14]
push edx
push 0xf003f
push edi
push eax
push 0x80000001
call ebp
mov byte [esp + 0x300], bl
lea ecx, [esp + 0x18]
call fcn.00402560
mov dl, 0x63
mov al, 0x79
mov byte [esp + 0x87], dl
mov byte [esp + 0x8c], dl
mov dl, 0x78
mov cl, 0x72
mov byte [esp + 0x86], al
mov bl, 0x65
mov byte [esp + 0x8a], al
mov byte [esp + 0x8f], dl
mov byte [esp + 0x91], al
mov byte [esp + 0x93], dl
mov dl, 0x76
mov byte [esp + 0x99], al
lea eax, [esp + 0x7c]
mov byte [esp + 0x88], cl
mov byte [esp + 0x8b], cl
mov byte [esp + 0x9c], cl
mov byte [esp + 0x7c], 0x44
mov byte [esp + 0x7d], 0x58
mov byte [esp + 0x7e], 0x51
mov byte [esp + 0x7f], 0x43
mov byte [esp + 0x80], 0x40
mov byte [esp + 0x81], 0x56
mov byte [esp + 0x82], 0x45
mov byte [esp + 0x83], 0x52
mov byte [esp + 0x84], 0x4b
mov byte [esp + 0x85], 0x5e
mov byte [esp + 0x89], bl
mov byte [esp + 0x8d], 0x37
mov byte [esp + 0x8e], 0x53
mov byte [esp + 0x90], 0x60
mov byte [esp + 0x92], 0x7b
mov byte [esp + 0x94], dl
mov byte [esp + 0x95], 0x73
mov byte [esp + 0x96], 0x37
mov byte [esp + 0x97], 0x5a
mov byte [esp + 0x98], dl
mov byte [esp + 0x9a], dl
mov byte [esp + 0x9b], 0x70
mov byte [esp + 0x9d], bl
mov byte [esp + 0x9e], 0
lea ecx, [eax + 1]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x47a578
sub eax, ecx
xor ecx, ecx
test eax, eax
jle 0x47a591
xor byte [esp + ecx + 0x7c], 0x17
inc ecx
cmp ecx, eax
jl 0x47a587
lea eax, [esp + 0x74]
mov byte [esp + 0x78], dl
mov byte [esp + 0x74], 0x44
mov byte [esp + 0x75], 0x72
mov byte [esp + 0x76], 0x65
mov byte [esp + 0x77], 0x7e
mov byte [esp + 0x79], 0x7b
mov byte [esp + 0x7a], 0
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47a5c0
sub eax, edx
xor ecx, ecx
test eax, eax
jle 0x47a5da
nop
xor byte [esp + ecx + 0x74], 0x17
inc ecx
cmp ecx, eax
jl 0x47a5d0
lea ecx, [esp + 0x34]
push ecx
push 1
xor edi, edi
push edi
lea edx, [esp + 0x88]
push edx
mov esi, 0x32
push 0x80000002
mov byte [esp + 0xd4], 0
mov dword [esp + 0x3c], edi
mov dword [esp + 0x44], esi
call ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xc4]
push ecx
push edi
lea edx, [esp + 0x80]
push edi
push edx
jne 0x47a671
mov eax, dword [esp + 0x48]
push eax
call ebx
test eax, eax
je 0x47a65c
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [0x75dbe4]
lea edx, [esp + 0xc4]
push edx
push edi
push edi
lea eax, [esp + 0x84]
push eax
push ecx
mov dword [esp + 0x48], esi
call ebx
test eax, eax
jne 0x47a664
mov dword [esp + 0x28], 1
mov edx, dword [esp + 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47a685
mov eax, dword [0x75dbe4]
push eax
call ebx
test eax, eax
jne 0x47a685
mov dword [esp + 0x28], 1
mov eax, dword [esp + 0x14]
mov byte [esp + 0x1f], 0
cmp eax, edi
je 0x47ab77
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0xf8]
push edx
push edi
push edi
push edi
push eax
mov dword [esp + 0x54], 0x200
call ebx
neg eax
sbb eax, eax
inc eax
cmp eax, edi
jne 0x47a853
cmp dword [esp + 0x28], edi
je 0x47a6ce
mov byte [esp + 0x1f], 1
jmp 0x47a9c0
lea eax, [esp + 0x6c]
push eax
mov byte [esp + 0x70], 0x41
mov byte [esp + 0x71], 0x72
mov byte [esp + 0x72], 0x65
mov byte [esp + 0x73], 0x64
mov byte [esp + 0x74], 0x7e
mov byte [esp + 0x75], 0x78
mov byte [esp + 0x76], 0x79
mov byte [esp + 0x77], 0
call fcn.00453b10
mov eax, dword [esp + 0x18]
add esp, 4
push edi
lea ecx, [esp + 0x1c]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
lea edx, [esp + 0x88]
push edx
push eax
mov dword [esp + 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x47a9c0
lea ecx, [esp + 0x44]
push ecx
call fcn.0043c830
lea ecx, [esp + 0x44]
call fcn.0043bfd0
sub eax, 0x76c
lea esi, [eax + eax*2]
add esi, esi
lea ecx, [esp + 0x44]
add esi, esi
call fcn.0043c000
add eax, esi
mov esi, eax
shl esi, 4
sub esi, eax
lea ecx, [esp + 0x44]
add esi, esi
call fcn.0043c030
mov ecx, dword [esp + 0x18]
mov edi, eax
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0xa4]
push eax
push 0
push 0
push 0
push ecx
add edi, esi
mov dword [esp + 0x58], 0x20
call ebx
test eax, eax
jne 0x47a7e6
lea edx, [esp + 0xa0]
push edx
call fcn.006223ab
add esp, 4
test eax, eax
je 0x47a841
sub edi, eax
cmp edi, 0x3c
jbe 0x47a841
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x20]
push 9
push 0x14b5
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
jmp 0x47a9c0
lea ecx, [esp + 0x2c]
call fcn.004024f0
mov byte [esp + 0x300], 6
push edi
lea edx, [esp + 0x30]
push 0x6795fc
push edx
call fcn.00402f60
mov edx, dword [esp + 0x38]
mov eax, edx
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47a813
sub eax, esi
inc eax
push eax
mov eax, dword [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [esp + 0x300], 3
lea ecx, [esp + 0x2c]
call fcn.00402560
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
jmp 0x47a9c0
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0xfc]
push ecx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x38], edi
call fcn.0057bd10
add esp, 0xc
test eax, eax
je 0x47a9af
mov al, 0x27
mov cl, 0x25
mov byte [esp + 0xa3], al
mov byte [esp + 0xa4], cl
mov byte [esp + 0xa9], al
mov byte [esp + 0xaa], al
mov byte [esp + 0xab], cl
mov cl, 0x56
mov al, 0x60
lea edx, [esp + 0xa0]
push edx
mov byte [esp + 0xa4], 0x7b
mov byte [esp + 0xa5], 0x7a
mov byte [esp + 0xa6], 0x40
mov byte [esp + 0xa9], 0x7c
mov byte [esp + 0xaa], 0x7d
mov byte [esp + 0xab], 0x5a
mov byte [esp + 0xac], 0x23
mov byte [esp + 0xb0], 0x51
mov byte [esp + 0xb1], cl
mov byte [esp + 0xb2], 0x79
mov byte [esp + 0xb3], 0x6d
mov byte [esp + 0xb4], al
mov byte [esp + 0xb5], al
mov byte [esp + 0xb6], 0x64
mov byte [esp + 0xb7], cl
mov byte [esp + 0xb8], 0x26
mov byte [esp + 0xb9], 0
call fcn.00453b10
mov esi, vtable.CProtection.0
add esp, 4
mov dword [esp + 0x18], esi
mov byte [esp + 0x300], 7
lea eax, [esp + 0xa0]
lea ecx, [eax + 1]
jmp 0x47a960
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x47a960
mov edx, dword [esp + 0x6c]
sub eax, ecx
mov ecx, dword [esp + 0x2c]
push eax
lea eax, [esp + 0xa4]
push eax
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.00448e40
mov eax, dword [esp + 0x6c]
push eax
lea ecx, [esp + 0xc4]
push ecx
call fcn.006226ae
add esp, 8
test eax, eax
je 0x47a9a3
mov byte [esp + 0x1f], 1
mov byte [esp + 0x300], 3
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x6c]
cmp eax, edi
je 0x47a9c0
push eax
call fcn.006220cc
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x1f], 0
je 0x47ac9d
mov eax, dword [0x75dbac]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push 1
neg eax
push edi
sbb eax, eax
push edx
add eax, 0x80000002
push eax
call ebp
mov esi, eax
cmp esi, edi
je 0x47ab48
mov dword [esp + 0x14], edi
cmp esi, 2
je 0x47aac1
lea ecx, [esp + 0x18]
call fcn.004024f0
mov byte [esp + 0x300], 8
mov eax, str.CURRENT_USER
cmp dword [0x75dbac], edi
jne 0x47aa2e
mov eax, str.MACHINE
mov ecx, dword [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x20]
push 0x67bc94
push edx
call fcn.00402f60
mov eax, dword [esp + 0x28]
add esp, 0x10
push eax
lea ecx, [esp + 0x50]
call fcn.0051cd20
test eax, eax
je 0x47aa78
mov eax, dword [0x75dbac]
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push 1
neg eax
push edi
sbb eax, eax
push edx
add eax, 0x80000002
push eax
call ebp
mov esi, eax
cmp esi, edi
je 0x47aab0
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x50]
call fcn.0051cdf0
test eax, eax
je 0x47aab0
mov ecx, dword [0x75dbac]
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push 1
neg ecx
push edi
sbb ecx, ecx
push eax
add ecx, 0x80000002
push ecx
call ebp
mov esi, eax
mov byte [esp + 0x300], 3
lea ecx, [esp + 0x18]
call fcn.00402560
cmp esi, edi
je 0x47ab48
cmp dword [0x75dbac], edi
jne 0x47ab48
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push 1
push edi
push eax
push 0x80000001
call ebp
test eax, eax
je 0x47ab48
lea ecx, [esp + 0x2c]
call fcn.004024f0
mov byte [esp + 0x300], 9
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0x30]
push str.CURRENT_USER_s
push edx
call fcn.00402f60
mov eax, dword [esp + 0x38]
add esp, 0xc
push eax
lea ecx, [esp + 0x60]
call fcn.0051cd20
test eax, eax
je 0x47ab37
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push ecx
push 1
push edi
push edx
push 0x80000001
call ebp
mov byte [esp + 0x300], 3
lea ecx, [esp + 0x2c]
call fcn.00402560
cmp dword [esp + 0x14], edi
je 0x47abbc
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x20]
push edi
push 0x14b5
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47ac9d
cmp dword [esp + 0x28], edi
jne 0x47a9d6
mov edx, dword [0x75dbac]
mov ecx, dword [esp + 0x24]
push edi
lea eax, [esp + 0x18]
push eax
push edi
push 0xf003f
push edi
push edi
neg edx
push edi
sbb edx, edx
push ecx
add edx, 0x80000002
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47a9d6
cmp dword [esp + 0x28], edi
je 0x47ac9d
mov eax, dword [esp + 0x20]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47abd0
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47abe2
sub eax, edx
mov edx, eax
lea eax, [esp + 0xc0]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47abf7
sub eax, esi
add eax, edx
lea eax, [eax + edi + 3]
push eax
call fcn.005f4e47
add esp, 4
test eax, eax
je 0x47ac9d
mov edx, dword [esp + 0x20]
mov esi, eax
lea ecx, [ecx]
mov cl, byte [edx]
mov byte [esi], cl
inc edx
inc esi
test cl, cl
jne 0x47ac20
mov ecx, dword [esp + 0x20]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x47ac31
mov edx, dword [esp + 0x24]
sub ecx, esi
lea esi, [ecx + eax + 1]
mov cl, byte [edx]
mov byte [esi], cl
inc edx
inc esi
test cl, cl
jne 0x47ac42
mov ecx, dword [esp + 0x20]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x47ac53
sub ecx, esi
mov esi, ecx
mov ecx, dword [esp + 0x24]
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x47ac65
sub ecx, edi
add ecx, esi
lea edx, [esp + 0xc0]
lea esi, [ecx + eax + 2]
mov ecx, edx
sub esi, ecx
nop
mov cl, byte [edx]
mov byte [edx + esi], cl
inc edx
test cl, cl
jne 0x47ac80
push 0
push 0
push 0
push 0
push eax
push 0x4795f0
call fcn.006005d0
mov byte [esp + 0x300], 2
lea ecx, [esp + 0x5c]
call fcn.0051cc90
mov byte [esp + 0x300], 1
lea ecx, [esp + 0x4c]
call fcn.0051cc90
mov byte [esp + 0x300], 0
lea ecx, [esp + 0x20]
call fcn.00402560
mov dword [esp + 0x300], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.00402560
mov ecx, dword [esp + 0x2f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2e0]
xor ecx, esp
call fcn.00620b8d
add esp, 0x2f0
ret