Function at 0x463c20
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x4fc040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2c4], eax
mov esi, ecx
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x290], edx
mov dword [ebp - 0x2c8], eax
call fcn.00463b80
test eax, eax
je 0x4640c7
mov esi, dword [esi + 4]
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x28c], ax
add esi, 5
lea eax, [ebp - 0x28a]
push eax
call fcn.00497aa0
add esp, 0xc
lea eax, [ebp - 0x28c]
push pe_nt_image_headers32
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4640c7
push str.sk_ecdsa_sha2_nistp256
push edi
xor esi, esi
xor ebx, ebx
call fcn.00496f90
add esp, 8
cmp eax, edi
je 0x463d15
push str.sk_ecdsa_sha2_nistp384
push edi
call fcn.00496f90
add esp, 8
cmp eax, edi
jne 0x463ce5
mov esi, 0x4ee6f4
mov ebx, 0x30
jmp 0x463d1f
push str.sk_ecdsa_sha2_nistp521
push edi
call fcn.00496f90
add esp, 8
cmp eax, edi
jne 0x463d03
mov esi, str.SHA_512
mov ebx, 0x40
jmp 0x463d1f
push str.sk_ssh_ed25519
push edi
call fcn.00496f90
add esp, 8
cmp eax, edi
jne 0x463d1f
mov ebx, 0x20
mov esi, str.SHA_256
push 0x80
lea eax, [ebp - 0x8c]
push 0
push eax
call fcn.00497aa0
add esp, 0xc
mov dword [ebp - 0x294], 0x80
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0
push 8
lea eax, [ebp - 0x28c]
push eax
push str.SoftwareSimonTathamPuTTYFidoCredIdBlobs
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x463d76
mov dword [ebp - 0x294], 0
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x29c], 1
push eax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x298], 0
push eax
push 0
push 0x10
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x2b8], 4
push eax
push str.SoftwareSimonTathamPuTTYFidoUserVerification
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x463ddb
mov eax, dword [ebp - 0x298]
cmp eax, 1
je 0x463dd1
cmp eax, 2
jne 0x463ddb
mov dword [ebp - 0x29c], 3
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movq qword [ebp - 0x2e4], xmm0
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x2e0], eax
lea eax, [ebp - 0x8c]
movq qword [ebp - 0x2d4], xmm0
push 0x3c
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x340]
mov dword [ebp - 0x2dc], 0
push 0
mov dword [ebp - 0x2dc], esi
mov esi, dword [ebp - 0x294]
mov dword [ebp - 0x2cc], 0
push eax
mov dword [ebp - 0x2e8], 1
mov dword [ebp - 0x2d8], 1
mov dword [ebp - 0x2d4], esi
mov dword [ebp - 0x2cc], str.public_key
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x344], 5
call fcn.00497aa0
add esp, 0xc
test esi, esi
je 0x463e94
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x33c], 1
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x31c], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x2b4], eax
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x344]
push 0
mov dword [ebp - 0x2a8], eax
lea eax, [ebp - 0x28c]
push 0
mov dword [ebp - 0x2b0], eax
lea eax, [ebp - 0x2b4]
push eax
push 0x463bd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [ebp - 0x290], ecx
test ecx, ecx
je 0x4640c7
mov ecx, dword [ebp - 0x2b4]
test ecx, ecx
je 0x463f89
push 0
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
jne 0x463f89
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [ebp - 0x304]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x463f89
nop dword [eax + eax]
cmp dword [ebp - 0x300], 0x400
je 0x463f89
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x304]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea eax, [ebp - 0x304]
push eax
call esi
test eax, eax
jg 0x463f50
mov esi, dword [ebp - 0x290]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2c0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c0], 0
jne 0x4640c7
push str.sk_ssh_ed25519
push edi
call fcn.00496f90
add esp, 8
cmp eax, edi
mov eax, dword [ebp - 0x2a4]
jne 0x46400f
push dword [eax + 0xc]
call fcn.004a6e5e
mov edi, eax
add esp, 4
test edi, edi
je 0x4640c7
mov ecx, dword [ebp - 0x2a4]
push dword [ecx + 0xc]
push dword [ecx + 0x10]
push edi
call fcn.00497c70
mov esi, dword [ebp - 0x2a4]
add esp, 0xc
mov ecx, dword [ebp - 0x2a0]
mov eax, dword [esi + 0xc]
mov dword [ecx], eax
jmp 0x464089
mov eax, dword [eax + 0x10]
movzx esi, byte [eax + 3]
sub esi, ebx
add esi, 4
js 0x4640c7
add eax, esi
movzx eax, byte [eax + ebx + 1]
add eax, 2
add eax, esi
mov dword [ebp - 0x290], eax
js 0x4640c7
mov ecx, dword [ebp - 0x2a0]
lea eax, [ebx + ebx]
push eax
mov dword [ecx], eax
call fcn.004a6e5e
mov edi, eax
add esp, 4
test edi, edi
je 0x4640c7
mov eax, dword [ebp - 0x2a4]
push ebx
mov eax, dword [eax + 0x10]
add eax, esi
push eax
push edi
call fcn.00497c70
mov eax, dword [ebp - 0x2a4]
push ebx
mov eax, dword [eax + 0x10]
add eax, dword [ebp - 0x290]
push eax
lea eax, [edi + ebx]
push eax
call fcn.00497c70
mov esi, dword [ebp - 0x2a4]
add esp, 0x18
mov esi, dword [esi + 8]
push dword [esi + 0x21]
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [ebp - 0x2c4]
push dword [ebp - 0x2a4]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x2c8]
mov al, byte [esi + 0x20]
mov byte [ecx], al
call dword [sym.imp.webauthn.dll_WebAuthNFreeAssertion]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00495b16
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495b16
mov esp, ebp
pop ebp
ret