Function at 0x471a40
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x64c22d
mov eax, dword fs:[0]
push eax
sub esp, 0x2d8
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0x2d4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x2ec]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], esi
call fcn.004024f0
xor edi, edi
mov dword [esp + 0x2f4], edi
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004688b0
test eax, eax
je 0x472267
lea ecx, [esp + 0x40]
mov dword [esp + 0x1c], edi
call fcn.0051cc30
mov byte [esp + 0x2f4], 1
lea ecx, [esp + 0x50]
call fcn.0051cc30
mov byte [esp + 0x2f4], 2
mov eax, dword [0x75dbac]
mov edx, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edi
lea ecx, [esp + 0x20]
push ecx
push edi
push 0xf003f
push edi
push edi
neg eax
push edi
sbb eax, eax
push edx
add eax, 0x80000002
push eax
call ebx
mov esi, eax
cmp esi, edi
je 0x471c86
cmp esi, 2
je 0x471bcf
lea ecx, [esp + 0x14]
call fcn.004024f0
mov byte [esp + 0x2f4], 3
mov eax, str.CURRENT_USER
cmp dword [0x75dbac], edi
jne 0x471b2e
mov eax, str.MACHINE
mov ecx, dword [esp + 0x18]
push ecx
push eax
lea edx, [esp + 0x1c]
push 0x67bc94
push edx
call fcn.00402f60
mov eax, dword [esp + 0x24]
add esp, 0x10
push eax
lea ecx, [esp + 0x44]
call fcn.0051cd20
test eax, eax
je 0x471b7f
mov eax, dword [0x75dbac]
mov edx, dword [esp + 0x18]
push edi
lea ecx, [esp + 0x20]
push ecx
push edi
push 0xf003f
push edi
push edi
neg eax
push edi
sbb eax, eax
push edx
add eax, 0x80000002
push eax
call ebx
mov esi, eax
cmp esi, edi
je 0x471bbe
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x44]
call fcn.0051cdf0
test eax, eax
je 0x471bbe
mov ecx, dword [0x75dbac]
mov eax, dword [esp + 0x18]
push edi
lea edx, [esp + 0x20]
push edx
push edi
push 0xf003f
push edi
push edi
neg ecx
push edi
sbb ecx, ecx
push eax
add ecx, 0x80000002
push ecx
call ebx
mov esi, eax
mov byte [esp + 0x2f4], 2
lea ecx, [esp + 0x14]
call fcn.00402560
cmp esi, edi
je 0x471c86
cmp dword [0x75dbac], edi
jne 0x472245
mov eax, dword [esp + 0x18]
push edi
lea edx, [esp + 0x20]
push edx
push edi
push 0xf003f
push edi
push edi
push edi
push eax
push 0x80000001
call ebx
test eax, eax
je 0x471c86
lea ecx, [esp + 0x14]
call fcn.004024f0
mov byte [esp + 0x2f4], 4
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push str.CURRENT_USER_s
push edx
call fcn.00402f60
mov eax, dword [esp + 0x20]
add esp, 0xc
push eax
lea ecx, [esp + 0x54]
call fcn.0051cd20
test eax, eax
je 0x471c75
mov edx, dword [esp + 0x18]
push edi
lea ecx, [esp + 0x20]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
push edx
push 0x80000001
call ebx
test eax, eax
je 0x471c75
mov byte [esp + 0x2f4], 2
lea ecx, [esp + 0x14]
call fcn.00402560
jmp 0x472245
mov byte [esp + 0x2f4], 2
lea ecx, [esp + 0x14]
call fcn.00402560
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x472245
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0xec]
push edx
push edi
push edi
push edi
push eax
mov dword [esp + 0x4c], 0x200
call ebp
mov esi, eax
mov al, 0x7f
mov byte [esp + 0x7b], al
mov byte [esp + 0x80], al
mov al, 0x2b
neg esi
mov bl, 0x65
mov byte [esp + 0x81], al
mov byte [esp + 0x8a], al
lea eax, [esp + 0x70]
sbb esi, esi
push eax
inc esi
mov byte [esp + 0x74], 0x58
mov byte [esp + 0x75], 0x44
mov byte [esp + 0x76], 0x4d
mov byte [esp + 0x77], 0x5f
mov byte [esp + 0x78], 0x5c
mov byte [esp + 0x79], 0x4a
mov byte [esp + 0x7a], 0x59
mov byte [esp + 0x7b], 0x4e
mov byte [esp + 0x7c], 0x57
mov byte [esp + 0x7d], 0x42
mov byte [esp + 0x7e], bl
mov byte [esp + 0x80], 0x6e
mov byte [esp + 0x81], 0x79
mov byte [esp + 0x82], bl
mov byte [esp + 0x83], 0x6e
mov byte [esp + 0x86], 0x4f
mov byte [esp + 0x87], 0x64
mov byte [esp + 0x88], 0x7c
mov byte [esp + 0x89], bl
mov byte [esp + 0x8a], 0x67
mov byte [esp + 0x8b], 0x64
mov byte [esp + 0x8c], 0x6a
mov byte [esp + 0x8d], 0x6f
mov byte [esp + 0x8f], 0x46
mov byte [esp + 0x90], 0x6a
mov byte [esp + 0x91], bl
mov byte [esp + 0x92], 0x6a
mov byte [esp + 0x93], 0x6c
mov byte [esp + 0x94], 0x6e
mov byte [esp + 0x95], 0x79
mov byte [esp + 0x96], 0
call fcn.00453ba0
lea ecx, [esp + 0x6c]
push ecx
mov byte [esp + 0x70], 0x58
mov byte [esp + 0x71], 0x6e
mov byte [esp + 0x72], 0x79
mov byte [esp + 0x73], 0x62
mov byte [esp + 0x74], 0x6a
mov byte [esp + 0x75], 0x67
mov byte [esp + 0x76], 0
call fcn.00453ba0
add esp, 8
lea edx, [esp + 0x28]
push edx
push 1
push 0
lea eax, [esp + 0x7c]
push eax
push 0x80000002
mov byte [esp + 0xc8], 0
mov dword [esp + 0x38], 0x32
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x24]
lea edx, [esp + 0xb4]
push ecx
push edx
push 0
test eax, eax
push 0
lea eax, [esp + 0x78]
push eax
jne 0x471e71
mov ecx, dword [esp + 0x3c]
push ecx
call ebp
test eax, eax
je 0x471e5f
lea edx, [esp + 0x24]
push edx
mov edx, dword [0x75dbe4]
lea eax, [esp + 0xb8]
push eax
push 0
push 0
lea ecx, [esp + 0x78]
push ecx
push edx
mov dword [esp + 0x3c], 0x32
call ebp
test eax, eax
jne 0x471e64
mov edi, 1
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x471e81
mov ecx, dword [0x75dbe4]
push ecx
call ebp
test eax, eax
jne 0x471e81
lea edi, [eax + 1]
xor eax, eax
cmp esi, eax
jne 0x4720be
cmp edi, eax
je 0x471f32
mov eax, dword [esp + 0x18]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x471ea0
sub eax, edx
mov edx, eax
lea eax, [esp + 0xb4]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x471eb5
sub eax, esi
lea edx, [eax + edx + 2]
push edx
call fcn.005f4e47
add esp, 4
test eax, eax
je 0x47223a
mov edx, dword [esp + 0x18]
mov esi, eax
lea esp, [esp]
mov cl, byte [edx]
mov byte [esi], cl
inc edx
inc esi
test cl, cl
jne 0x471ee0
mov ecx, dword [esp + 0x18]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x471ef1
sub ecx, esi
mov edx, ecx
lea ecx, [esp + 0xb4]
lea esi, [edx + eax + 1]
mov edx, ecx
sub esi, edx
jmp 0x471f10
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x471f10
push 0
push 0
push 0
push 0
push eax
push 0x467f30
call fcn.006005d0
jmp 0x47223a
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x64], 0x5d
mov byte [esp + 0x65], 0x6e
mov byte [esp + 0x66], 0x79
mov byte [esp + 0x67], 0x78
mov byte [esp + 0x68], 0x62
mov byte [esp + 0x69], 0x64
mov byte [esp + 0x6a], bl
mov byte [esp + 0x6b], 0
call fcn.00453ba0
mov eax, dword [esp + 0x20]
add esp, 4
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [esp + 0x7c]
push edx
push eax
mov dword [esp + 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x47223a
lea ecx, [esp + 0x38]
push ecx
call fcn.0043c830
lea ecx, [esp + 0x38]
call fcn.0043bfd0
sub eax, 0x76c
lea esi, [eax + eax*2]
add esi, esi
lea ecx, [esp + 0x38]
add esi, esi
call fcn.0043c000
add eax, esi
mov esi, eax
shl esi, 4
sub esi, eax
lea ecx, [esp + 0x38]
add esi, esi
call fcn.0043c030
mov ecx, dword [esp + 0x14]
mov edi, eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x98]
push eax
push 0
push 0
push 0
push ecx
add edi, esi
mov dword [esp + 0x48], 0x20
call ebp
test eax, eax
jne 0x47204d
lea edx, [esp + 0x94]
push edx
call fcn.006223ab
add esp, 4
test eax, eax
je 0x4720ae
sub edi, eax
cmp edi, 0x3c
jbe 0x4720ae
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax + 0x20]
push 9
push 0x14b3
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47223a
lea ecx, [esp + 0x20]
call fcn.004024f0
mov byte [esp + 0x2f4], 5
push edi
lea edx, [esp + 0x24]
push 0x6795fc
push edx
call fcn.00402f60
mov edx, dword [esp + 0x2c]
mov eax, edx
add esp, 0xc
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x472080
sub eax, esi
inc eax
push eax
mov eax, dword [esp + 0x18]
push edx
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [esp + 0x2f4], 2
lea ecx, [esp + 0x20]
call fcn.00402560
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47223a
lea edx, [esp + 0x20]
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x20], eax
push edx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0xf0]
push ecx
call fcn.0057bd10
add esp, 0xc
test eax, eax
je 0x472229
mov al, 0x3b
mov cl, 0x39
lea edx, [esp + 0x94]
push edx
mov byte [esp + 0x98], 0x67
mov byte [esp + 0x99], 0x66
mov byte [esp + 0x9a], 0x5c
mov byte [esp + 0x9b], al
mov byte [esp + 0x9c], cl
mov byte [esp + 0x9d], 0x60
mov byte [esp + 0x9e], 0x61
mov byte [esp + 0x9f], 0x46
mov byte [esp + 0xa0], 0x3f
mov byte [esp + 0xa1], al
mov byte [esp + 0xa2], al
mov byte [esp + 0xa3], cl
mov byte [esp + 0xa4], 0x4d
mov byte [esp + 0xa5], 0x4a
mov byte [esp + 0xa6], bl
mov byte [esp + 0xa7], 0x71
mov byte [esp + 0xa8], 0x7c
mov byte [esp + 0xa9], 0x7c
mov byte [esp + 0xaa], 0x78
mov byte [esp + 0xab], 0x4a
mov byte [esp + 0xac], 0x3a
mov byte [esp + 0xad], 0
call fcn.00453ba0
mov esi, vtable.CProtection.0
add esp, 4
mov dword [esp + 0x14], esi
mov byte [esp + 0x2f4], 6
lea eax, [esp + 0x94]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4721c5
mov edx, dword [esp + 0x60]
sub eax, ecx
mov ecx, dword [esp + 0x20]
push eax
lea eax, [esp + 0x98]
push eax
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.00448e40
mov eax, dword [esp + 0x60]
push eax
lea ecx, [esp + 0xb8]
push ecx
call fcn.006226ae
add esp, 8
test eax, eax
je 0x47221d
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0x20]
push 0
push 0x14b3
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [esp + 0x2f4], 2
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x47223a
push eax
call fcn.006220cc
add esp, 4
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x2f4], 1
lea ecx, [esp + 0x50]
call fcn.0051cc90
mov byte [esp + 0x2f4], 0
lea ecx, [esp + 0x40]
call fcn.0051cc90
mov dword [esp + 0x2f4], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00402560
mov ecx, dword [esp + 0x2ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2d4]
xor ecx, esp
call fcn.00620b8d
add esp, 0x2e4
ret