Function at 0x4809d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58735c
mov eax, dword fs:[0]
push eax
sub esp, 0x6b0
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 0x3c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6bc], ecx
mov dword [ebp - 0x18], str.SAMSAMDomainsAccountUsersNames
mov dword [ebp - 0x10], str.SAMSAMDomainsAccountUsers
push 0x20019
mov eax, dword [ebp - 0x18]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.004807c0
test eax, eax
jne 0x480a36
xor eax, eax
jmp 0x4814b0
lea ecx, [ebp - 0x14]
push ecx
push 0x20019
push 0
mov edx, dword [ebp - 0x18]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48147f
mov byte [ebp - 0x144], 0
push 0x103
push 0
lea eax, [ebp - 0x143]
push eax
call fcn.00562540
add esp, 0xc
mov dword [ebp - 0x2c], 0x104
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x254]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x148]
push ecx
lea edx, [ebp - 0x38]
push edx
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x144]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0
jmp 0x480adb
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x38]
jae 0x48147f
mov dword [ebp - 0x24], 0xff
lea edx, [ebp - 0x254]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x48147a
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x47c], 0
mov byte [ebp - 0x46c], 0
push 0x103
push 0
lea ecx, [ebp - 0x46b]
push ecx
call fcn.00562540
add esp, 0xc
lea edx, [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x18]
push eax
push 0x59b144
lea ecx, [ebp - 0x46c]
push ecx
call fcn.00483b40
add esp, 0x10
push 0x20019
lea edx, [ebp - 0x46c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.004807c0
lea eax, [ebp - 0x478]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x46c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x480be0
push 0
push 0
lea edx, [ebp - 0x470]
push edx
push 0
push 0
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
lea edx, [ebp - 0x46c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.004807c0
cmp dword [ebp - 0x47c], 0
je 0x480c07
jmp 0x480ad2
mov byte [ebp - 0x364], 0
push 0x103
push 0
lea eax, [ebp - 0x363]
push eax
call fcn.00562540
add esp, 0xc
mov ecx, dword [ebp - 0x470]
push ecx
push str._08X
lea edx, [ebp - 0x364]
push edx
call fcn.00483b40
add esp, 0xc
lea eax, [ebp - 0x364]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x59b154
lea edx, [ebp - 0x46c]
push edx
call fcn.00483b40
add esp, 0x10
push 0x20019
lea eax, [ebp - 0x46c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.004807c0
test eax, eax
jne 0x480c9c
lea ecx, [ebp - 0x46c]
push ecx
push str.error__S
push 0x59b170
call fcn.0040c050
add esp, 0xc
jmp 0x480ad2
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x49c]
call fcn.00405ef0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x49c]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
add eax, 0x20
mov ecx, eax
call fcn.00405fb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x49c]
call fcn.00405f70
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x4b8]
call fcn.00405ef0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x4b8]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
add eax, 4
mov ecx, eax
call fcn.00405fb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b8]
call fcn.00405f70
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x480], 0
lea edx, [ebp - 0x478]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x46c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x480]
push ecx
push 0
push 0
push 0
push 0x59b198
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x480da4
cmp dword [ebp - 0x480], 0
jne 0x480de8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x59b1a0
push 0x59b1e4
call fcn.0040c050
add esp, 0xc
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
lea ecx, [ebp - 0x46c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.004807c0
jmp 0x480ad2
mov edx, dword [ebp - 0x480]
push edx
call fcn.0055ba39
add esp, 4
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x481454
lea eax, [ebp - 0x480]
push eax
mov ecx, dword [ebp - 0x474]
push ecx
push 0
push 0
push 0x59b19c
mov edx, dword [ebp - 0x478]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x481445
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x4d8]
call fcn.00405ef0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x4d8]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
movzx edx, byte [eax]
neg edx
sbb edx, edx
add edx, 1
mov byte [ebp - 0x4b9], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d8]
call fcn.00405f70
movzx eax, byte [ebp - 0x4b9]
test eax, eax
je 0x48111d
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x4f4]
call fcn.00405ef0
mov dword [ebp - 4], 3
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x510]
call fcn.00405ef0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x52c]
call fcn.00405ef0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x548]
call fcn.00405ef0
mov byte [ebp - 4], 6
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x564]
call fcn.00405ef0
mov byte [ebp - 4], 7
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x580]
call fcn.00405ef0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x474]
movzx edx, byte [ecx + 0x1c]
push edx
mov eax, dword [ebp - 0x474]
movzx ecx, byte [eax + 0x1b]
push ecx
mov edx, dword [ebp - 0x474]
movzx eax, byte [edx + 0x1a]
push eax
mov ecx, dword [ebp - 0x474]
movzx edx, byte [ecx + 0x19]
push edx
mov eax, dword [ebp - 0x474]
movzx ecx, byte [eax + 0x18]
push ecx
lea edx, [ebp - 0x4f4]
push edx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
movzx eax, byte [eax + 0x40]
push eax
lea ecx, [ebp - 0x510]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
movzx edx, byte [eax + 0x3f]
push edx
lea eax, [ebp - 0x52c]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
movzx ecx, byte [eax + 0x3e]
push ecx
lea edx, [ebp - 0x548]
push edx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
movzx eax, byte [eax + 0x3d]
push eax
lea ecx, [ebp - 0x564]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
movzx edx, byte [eax + 0x3c]
push edx
lea eax, [ebp - 0x580]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
add eax, 0x20
mov ecx, eax
call fcn.00406030
push eax
push 0x1da
push str.MyDebugINfo__d_:__S_Init__02x__02x__02x__02x__02x_____02x__02x__02x__02x__02x
push 0x59b2b4
call fcn.0040c050
add esp, 0x38
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x580]
call fcn.00405f70
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x564]
call fcn.00405f70
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x548]
call fcn.00405f70
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x52c]
call fcn.00405f70
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x510]
call fcn.00405f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f4]
call fcn.00405f70
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x59c]
call fcn.00405ef0
mov dword [ebp - 4], 9
mov esi, dword [ebp - 0x474]
add esi, 0x18
lea edx, [ebp - 0x59c]
push edx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
add eax, 0x3c
mov ecx, dword [esi]
mov dword [eax], ecx
mov dl, byte [esi + 4]
mov byte [eax + 4], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x59c]
call fcn.00405f70
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x5b8]
call fcn.00405ef0
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x5b8]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
mov byte [eax], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b8]
call fcn.00405f70
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x5d8]
call fcn.00405ef0
mov dword [ebp - 4], 0xb
mov ebx, 5
mov edi, dword [ebp - 0x474]
add edi, 0x18
lea eax, [ebp - 0x5d8]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
add eax, 0x3c
mov esi, eax
mov ecx, ebx
xor edx, edx
mov eax, 0
repe cmpsb byte [esi], byte es:[edi]
setne al
mov byte [ebp - 0x5b9], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d8]
call fcn.00405f70
movzx ecx, byte [ebp - 0x5b9]
test ecx, ecx
je 0x481445
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x5f4]
call fcn.00405ef0
mov dword [ebp - 4], 0xc
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x610]
call fcn.00405ef0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x62c]
call fcn.00405ef0
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x648]
call fcn.00405ef0
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x664]
call fcn.00405ef0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x364]
push ecx
lea ecx, [ebp - 0x680]
call fcn.00405ef0
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x474]
movzx eax, byte [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x474]
movzx edx, byte [ecx + 0x1b]
push edx
mov eax, dword [ebp - 0x474]
movzx ecx, byte [eax + 0x1a]
push ecx
mov edx, dword [ebp - 0x474]
movzx eax, byte [edx + 0x19]
push eax
mov ecx, dword [ebp - 0x474]
movzx edx, byte [ecx + 0x18]
push edx
lea eax, [ebp - 0x5f4]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
movzx ecx, byte [eax + 0x40]
push ecx
lea edx, [ebp - 0x610]
push edx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
movzx eax, byte [eax + 0x3f]
push eax
lea ecx, [ebp - 0x62c]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
movzx edx, byte [eax + 0x3e]
push edx
lea eax, [ebp - 0x648]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
movzx ecx, byte [eax + 0x3d]
push ecx
lea edx, [ebp - 0x664]
push edx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
movzx eax, byte [eax + 0x3c]
push eax
lea ecx, [ebp - 0x680]
push ecx
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
add eax, 0x20
mov ecx, eax
call fcn.00406030
push eax
push 0x1ed
push str.MyDebugINfo__d_:__S_pwd_changed__02x__02x__02x__02x__02x_____02x__02x__02x__02x__02x
push str.CUserPrivilegeMonitor::DetectPwdChanged
call fcn.0040c050
add esp, 0x38
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x680]
call fcn.00405f70
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x664]
call fcn.00405f70
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x648]
call fcn.00405f70
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x62c]
call fcn.00405f70
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x610]
call fcn.00405f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5f4]
call fcn.00405f70
mov ecx, dword [ebp - 0x6bc]
call fcn.004814d0
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x69c]
call fcn.00405ef0
mov dword [ebp - 4], 0x12
push 0x59b20c
lea eax, [ebp - 0x69c]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
add eax, 0x20
mov ecx, eax
call fcn.00406030
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x28
push ecx
call fcn.004329e0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x69c]
call fcn.00405f70
lea edx, [ebp - 0x364]
push edx
lea ecx, [ebp - 0x6b8]
call fcn.00405ef0
mov dword [ebp - 4], 0x13
mov esi, dword [ebp - 0x474]
add esi, 0x18
lea eax, [ebp - 0x6b8]
push eax
mov ecx, dword [ebp - 0x6bc]
add ecx, 0x12c
call fcn.00481650
add eax, 0x3c
mov ecx, dword [esi]
mov dword [eax], ecx
mov dl, byte [esi + 4]
mov byte [eax + 4], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b8]
call fcn.00405f70
mov eax, dword [ebp - 0x474]
push eax
call fcn.0055b95c
add esp, 4
mov ecx, dword [ebp - 0x478]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
lea edx, [ebp - 0x46c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.004807c0
jmp 0x480ad2
push 0x10
mov eax, dword [ebp - 0x18]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 0x6bc]
call fcn.004807c0
cmp dword [ebp - 0x14], 0
je 0x4814ab
cmp dword [ebp - 0x14], 0xffffffff
je 0x4814ab
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x3c]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret