Function at 0x42e0f0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x71c
mov eax, dword [0x465040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x654]
mov ebx, ecx
push eax
xor esi, esi
mov dword [ebp - 0x718], ebx
push 8
mov dword [ebp - 0x654], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42e161
lea eax, [ebp - 0x65c]
mov dword [ebp - 0x65c], 4
push eax
push 4
lea eax, [ebp - 0x658]
push eax
push 0x14
push dword [ebp - 0x654]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [ebp - 0x658]
mov eax, dword [ebp - 0x654]
test eax, eax
je 0x42e172
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x42ebe3
mov byte [ebp - 0x714], 0
mov esi, 0x7f
mov byte [ebp - 0x713], 0x33
mov byte [ebp - 0x712], 0x11
mov byte [ebp - 0x711], 0x1e
mov byte [ebp - 0x710], 0x11
mov byte [ebp - 0x70f], 2
mov byte [ebp - 0x70e], 0x11
mov byte [ebp - 0x70d], 0x52
mov byte [ebp - 0x70c], 0x11
mov byte [ebp - 0x70b], 0x77
mov byte [ebp - 0x70a], 0x11
mov byte [ebp - 0x709], 0x2e
mov byte [ebp - 0x708], 0x11
mov byte [ebp - 0x707], 0x67
mov byte [ebp - 0x706], 0x11
mov byte [ebp - 0x705], 0x54
mov byte [ebp - 0x704], 0x11
mov byte [ebp - 0x703], 0x77
mov byte [ebp - 0x702], 0x11
mov byte [ebp - 0x701], 0x1b
mov byte [ebp - 0x700], 0x11
mov byte [ebp - 0x6ff], 0x43
mov byte [ebp - 0x6fe], 0x11
mov byte [ebp - 0x6fd], 0xf
mov byte [ebp - 0x6fc], 0x11
mov byte [ebp - 0x6fb], 0x71
mov byte [ebp - 0x6fa], 0x11
mov byte [ebp - 0x6f9], 0x2e
mov byte [ebp - 0x6f8], 0x11
mov byte [ebp - 0x6f7], 0x18
mov byte [ebp - 0x6f6], 0x11
mov byte [ebp - 0x6f5], 0x1b
mov byte [ebp - 0x6f4], 0x11
mov byte [ebp - 0x6f3], 2
mov byte [ebp - 0x6f2], 0x11
mov byte [ebp - 0x6f1], 0x1c
mov byte [ebp - 0x6f0], 0x11
mov byte [ebp - 0x6ef], 0x18
mov byte [ebp - 0x6ee], 0x11
mov byte [ebp - 0x6ed], 0x1e
mov byte [ebp - 0x6ec], 0x11
mov byte [ebp - 0x6eb], 0x51
mov byte [ebp - 0x6ea], 0x11
mov byte [ebp - 0x6e9], 0x67
mov byte [ebp - 0x6e8], 0x11
mov byte [ebp - 0x6e7], 0x77
mov byte [ebp - 0x6e6], 0x11
mov byte [ebp - 0x6e5], 0x41
mov byte [ebp - 0x6e4], 0x11
mov byte [ebp - 0x6e3], 0x11
mov byte [ebp - 0x6e2], 0x11
mov al, byte [ebp - 0x713]
mov al, byte [ebp - 0x714]
test al, al
jne 0x42e32f
xor esi, esi
lea edi, [esi + 0x7f]
nop dword [eax]
mov al, byte [ebp + esi - 0x713]
mov ecx, 0x11
movzx eax, al
sub ecx, eax
lea eax, [ecx + ecx*4]
shl eax, 3
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + esi - 0x713], dl
inc esi
cmp esi, 0x32
jb 0x42e300
mov esi, edi
mov eax, dword [0x461cf4]
movups xmm0, xmmword [str.WallPaper]
mov dword [ebp - 8], eax
mov eax, dword [0x461d10]
mov dword [ebp - 0x20], eax
mov ax, word [0x461d14]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x68c]
push eax
movups xmmword [ebp - 0x18], xmm0
push 0x20019
movups xmm0, xmmword [str.WallpaperStyle]
push 0
push 0x461aac
movups xmmword [ebp - 0x38], xmm0
push SysStringLen
movq xmm0, qword [0x461d08]
movq qword [ebp - 0x28], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42ebc4
push 0x206
push eax
mov word [ebp - 0x448], ax
lea eax, [ebp - 0x446]
push eax
call fcn.00439310
add esp, 0xc
mov dword [ebp - 0x67c], 0x104
lea eax, [ebp - 0x688]
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x674], 0
push eax
lea eax, [ebp - 0x664]
mov dword [ebp - 0x670], 0
push eax
lea eax, [ebp - 0x668]
mov dword [ebp - 0x66c], 0
push eax
lea eax, [ebp - 0x66c]
mov dword [ebp - 0x668], 0
push eax
lea eax, [ebp - 0x670]
mov dword [ebp - 0x664], 0
push eax
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x660]
push eax
push 0
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 0x68c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor eax, eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x660], eax
jbe 0x42ebc4
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [eax]
lea ecx, [ebp - 0x688]
mov dword [ebp - 0x680], 0x104
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x680]
push ecx
lea ecx, [ebp - 0x650]
push ecx
push eax
push dword [ebp - 0x68c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x42eba6
lea eax, [ebp - 0x650]
push eax
push str.Found_sid:__s
call fcn.00424130
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x713]
push eax
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov byte [ebp - 0x6bc], 0
add esp, 0x14
mov byte [ebp - 0x6bb], 0x60
mov byte [ebp - 0x6ba], 0x44
mov byte [ebp - 0x6b9], 0x57
mov byte [ebp - 0x6b8], 0x44
mov byte [ebp - 0x6b7], 0x42
mov byte [ebp - 0x6b6], 0x44
mov byte [ebp - 0x6b5], 0x2d
mov byte [ebp - 0x6b4], 0x44
mov byte [ebp - 0x6b3], 0x43
mov byte [ebp - 0x6b2], 0x44
mov byte [ebp - 0x6b1], 0x78
mov byte [ebp - 0x6b0], 0x44
mov byte [ebp - 0x6af], 0xe
mov byte [ebp - 0x6ae], 0x44
mov byte [ebp - 0x6ad], 4
mov byte [ebp - 0x6ac], 0x44
mov byte [ebp - 0x6ab], 0x71
mov byte [ebp - 0x6aa], 0x44
mov byte [ebp - 0x6a9], 0x23
mov byte [ebp - 0x6a8], 0x44
mov byte [ebp - 0x6a7], 2
mov byte [ebp - 0x6a6], 0x44
mov byte [ebp - 0x6a5], 0x78
mov byte [ebp - 0x6a4], 0x44
mov byte [ebp - 0x6a3], 0x77
mov byte [ebp - 0x6a2], 0x44
mov byte [ebp - 0x6a1], 0x5e
mov byte [ebp - 0x6a0], 0x44
mov byte [ebp - 0x69f], 0x71
mov byte [ebp - 0x69e], 0x44
mov byte [ebp - 0x69d], 0x7c
mov byte [ebp - 0x69c], 0x44
mov byte [ebp - 0x69b], 0x43
mov byte [ebp - 0x69a], 0x44
mov byte [ebp - 0x699], 0x44
mov byte [ebp - 0x698], 0x44
mov al, byte [ebp - 0x6bb]
mov al, byte [ebp - 0x6bc]
test al, al
jne 0x42e619
xor ecx, ecx
nop
mov al, byte [ebp + ecx - 0x6bb]
movzx eax, al
sub eax, 0x44
lea eax, [eax + eax*2]
shl eax, 2
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + ecx - 0x6bb], dl
inc ecx
cmp ecx, 0x24
jb 0x42e5f0
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x6bb]
push eax
call fcn.00424130
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [ebp - 0x690]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x240]
add esi, esi
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42e665
push eax
call edi
xor ebx, ebx
jmp 0x42e6a6
push esi
push ebx
lea eax, [ebp - 0x18]
push eax
push 0x461ca8
call fcn.00424130
add esp, 0x10
lea eax, [ebp - 0x18]
push esi
push ebx
push 1
push 0
push eax
push dword [ebp - 0x690]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x690]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call edi
xor ebx, ebx
test esi, esi
sete bl
mov byte [ebp - 0x6d8], 0
mov byte [ebp - 0x6d7], 0x3d
mov byte [ebp - 0x6d6], 0x15
mov byte [ebp - 0x6d5], 0xa
mov byte [ebp - 0x6d4], 0x15
mov byte [ebp - 0x6d3], 0x1f
mov byte [ebp - 0x6d2], 0x15
mov byte [ebp - 0x6d1], 0xf
mov byte [ebp - 0x6d0], 0x15
mov byte [ebp - 0x6cf], 0x5c
mov byte [ebp - 0x6ce], 0x15
mov byte [ebp - 0x6cd], 0x6a
mov byte [ebp - 0x6cc], 0x15
mov byte [ebp - 0x6cb], 0x60
mov byte [ebp - 0x6ca], 0x15
mov byte [ebp - 0x6c9], 0x60
mov byte [ebp - 0x6c8], 0x15
mov byte [ebp - 0x6c7], 6
mov byte [ebp - 0x6c6], 0x15
mov byte [ebp - 0x6c5], 0x6a
mov byte [ebp - 0x6c4], 0x15
mov byte [ebp - 0x6c3], 0
mov byte [ebp - 0x6c2], 0x15
mov byte [ebp - 0x6c1], 0xa
mov byte [ebp - 0x6c0], 0x15
mov byte [ebp - 0x6bf], 0x4f
mov byte [ebp - 0x6be], 0x15
mov byte [ebp - 0x6bd], 0xf
mov byte [ebp - 0x6bc], 0x15
mov byte [ebp - 0x6bb], 0x37
mov byte [ebp - 0x6ba], 0x15
mov byte [ebp - 0x6b9], 7
mov byte [ebp - 0x6b8], 0x15
mov byte [ebp - 0x6b7], 0x3a
mov byte [ebp - 0x6b6], 0x15
mov byte [ebp - 0x6b5], 0x3a
mov byte [ebp - 0x6b4], 0x15
mov byte [ebp - 0x6b3], 0xa
mov byte [ebp - 0x6b2], 0x15
mov byte [ebp - 0x6b1], 0x37
mov byte [ebp - 0x6b0], 0x15
mov byte [ebp - 0x6af], 0x37
mov byte [ebp - 0x6ae], 0x15
mov byte [ebp - 0x6ad], 0xf
mov byte [ebp - 0x6ac], 0x15
mov byte [ebp - 0x6ab], 0x51
mov byte [ebp - 0x6aa], 0x15
mov byte [ebp - 0x6a9], 0xf
mov byte [ebp - 0x6a8], 0x15
mov byte [ebp - 0x6a7], 0x16
mov byte [ebp - 0x6a6], 0x15
mov byte [ebp - 0x6a5], 0x22
mov byte [ebp - 0x6a4], 0x15
mov byte [ebp - 0x6a3], 0x6c
mov byte [ebp - 0x6a2], 0x15
mov byte [ebp - 0x6a1], 0xf
mov byte [ebp - 0x6a0], 0x15
mov byte [ebp - 0x69f], 0x16
mov byte [ebp - 0x69e], 0x15
mov byte [ebp - 0x69d], 0x22
mov byte [ebp - 0x69c], 0x15
mov byte [ebp - 0x69b], 0x15
mov byte [ebp - 0x69a], 0x15
mov al, byte [ebp - 0x6d7]
mov al, byte [ebp - 0x6d8]
test al, al
jne 0x42e8a6
xor ecx, ecx
lea esi, [ecx + 0x7f]
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x6d7]
movzx eax, al
sub eax, 0x15
imul eax, eax, 0x25
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + ecx - 0x6d7], dl
inc ecx
cmp ecx, 0x3e
jb 0x42e880
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x6d7]
push ebx
push eax
call fcn.00424130
add esp, 0xc
mov dword [ebp - 0x654], 0xa
lea eax, [ebp - 0x658]
push eax
push 0x20006
push 0
lea eax, [ebp - 0x240]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42e8f2
push eax
call edi
xor edi, edi
jmp 0x42e92d
push 4
lea eax, [ebp - 0x654]
push eax
push 4
push 0
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x658]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x658]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x42e928
push esi
call edi
xor edi, edi
jmp 0x42e92d
mov edi, 1
mov dword [ebp - 0x654], edi
mov byte [ebp - 0x6e0], 0
mov byte [ebp - 0x6df], 0x43
mov byte [ebp - 0x6de], 0x2c
mov byte [ebp - 0x6dd], 0x62
mov byte [ebp - 0x6dc], 0x2c
mov byte [ebp - 0x6db], 0x12
mov byte [ebp - 0x6da], 0x2c
mov byte [ebp - 0x6d9], 0x55
mov byte [ebp - 0x6d8], 0x2c
mov byte [ebp - 0x6d7], 0x58
mov byte [ebp - 0x6d6], 0x2c
mov byte [ebp - 0x6d5], 0x4d
mov byte [ebp - 0x6d4], 0x2c
mov byte [ebp - 0x6d3], 0x67
mov byte [ebp - 0x6d2], 0x2c
mov byte [ebp - 0x6d1], 0x67
mov byte [ebp - 0x6d0], 0x2c
mov byte [ebp - 0x6cf], 0x7c
mov byte [ebp - 0x6ce], 0x2c
mov byte [ebp - 0x6cd], 0x4d
mov byte [ebp - 0x6cc], 0x2c
mov byte [ebp - 0x6cb], 0x7c
mov byte [ebp - 0x6ca], 0x2c
mov byte [ebp - 0x6c9], 0x62
mov byte [ebp - 0x6c8], 0x2c
mov byte [ebp - 0x6c7], 0x47
mov byte [ebp - 0x6c6], 0x2c
mov byte [ebp - 0x6c5], 0x43
mov byte [ebp - 0x6c4], 0x2c
mov byte [ebp - 0x6c3], 0x12
mov byte [ebp - 0x6c2], 0x2c
mov byte [ebp - 0x6c1], 0x4c
mov byte [ebp - 0x6c0], 0x2c
mov byte [ebp - 0x6bf], 0x67
mov byte [ebp - 0x6be], 0x2c
mov byte [ebp - 0x6bd], 0x62
mov byte [ebp - 0x6bc], 0x2c
mov byte [ebp - 0x6bb], 0x55
mov byte [ebp - 0x6ba], 0x2c
mov byte [ebp - 0x6b9], 0x6c
mov byte [ebp - 0x6b8], 0x2c
mov byte [ebp - 0x6b7], 0x37
mov byte [ebp - 0x6b6], 0x2c
mov byte [ebp - 0x6b5], 0x18
mov byte [ebp - 0x6b4], 0x2c
mov byte [ebp - 0x6b3], 0x18
mov byte [ebp - 0x6b2], 0x2c
mov byte [ebp - 0x6b1], 0x62
mov byte [ebp - 0x6b0], 0x2c
mov byte [ebp - 0x6af], 0x6c
mov byte [ebp - 0x6ae], 0x2c
mov byte [ebp - 0x6ad], 0x6c
mov byte [ebp - 0x6ac], 0x2c
mov byte [ebp - 0x6ab], 0x55
mov byte [ebp - 0x6aa], 0x2c
mov byte [ebp - 0x6a9], 0xf
mov byte [ebp - 0x6a8], 0x2c
mov byte [ebp - 0x6a7], 0x55
mov byte [ebp - 0x6a6], 0x2c
mov byte [ebp - 0x6a5], 0x10
mov byte [ebp - 0x6a4], 0x2c
mov byte [ebp - 0x6a3], 0x3d
mov byte [ebp - 0x6a2], 0x2c
mov byte [ebp - 0x6a1], 0x15
mov byte [ebp - 0x6a0], 0x2c
mov byte [ebp - 0x69f], 0x55
mov byte [ebp - 0x69e], 0x2c
mov byte [ebp - 0x69d], 0x10
mov byte [ebp - 0x69c], 0x2c
mov byte [ebp - 0x69b], 0x3d
mov byte [ebp - 0x69a], 0x2c
mov byte [ebp - 0x699], 0x2c
mov byte [ebp - 0x698], 0x2c
mov al, byte [ebp - 0x6df]
mov al, byte [ebp - 0x6e0]
test al, al
jne 0x42eb83
xor esi, esi
lea edi, [esi + 0x7f]
nop word [eax + eax]
mov al, byte [ebp + esi - 0x6df]
mov ecx, 0x2c
movzx eax, al
sub ecx, eax
lea eax, [ecx + ecx*2]
shl eax, 3
cdq
idiv edi
lea eax, [edx + 0x7f]
cdq
idiv edi
mov byte [ebp + esi - 0x6df], dl
inc esi
cmp esi, 0x48
jb 0x42eb50
mov edi, dword [ebp - 0x654]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x6df]
push edi
push eax
call fcn.00424130
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
add esp, 0xc
mov ebx, dword [ebp - 0x718]
mov eax, dword [ebp - 0x65c]
mov esi, 0x7f
inc eax
mov dword [ebp - 0x65c], eax
cmp eax, dword [ebp - 0x660]
jb 0x42e470
push dword [ebp - 0x68c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437671
mov esp, ebp
pop ebp
ret
push 1
push ebx
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437671
mov esp, ebp
pop ebp
ret