Function at 0x434def
Capabilities:
Get hostname
Impersonate user
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd94
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xd48], edi
call fcn.00434a50
lea eax, [ebp - 0xd48]
push eax
push 0x20119
push edi
push 0x4094e0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x435664
mov dword [ebp - 0xd58], 0x80
mov ebx, edi
mov dword [ebp - 0xd60], edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xd58]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push dword [ebp - 0xd48]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x435658
lea eax, [ebp - 0xd60]
mov dword [ebp - 0xd58], 0x80
push eax
push 0x20119
push edi
lea eax, [ebp - 0x108]
inc ebx
push eax
push dword [ebp - 0xd48]
mov dword [ebp - 0xd54], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x435658
lea eax, [ebp - 0x108]
push eax
push 0x409544
push 4
call fcn.0041ea5f
add esp, 0xc
mov dword [ebp - 0xd3c], edi
lea eax, [ebp - 0xd3c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x435092
mov eax, 0x104
mov esi, edi
mov dword [ebp - 0xd40], eax
mov dword [ebp - 0xd44], eax
lea eax, [ebp - 0xd64]
push eax
lea eax, [ebp - 0xd44]
push eax
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0xd40]
push eax
lea eax, [ebp - 0x720]
push eax
push dword [ebp - 0xd3c]
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x434fc2
lea ecx, [ebp - 0x720]
mov eax, 0x4015c0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x434f5f
test dx, dx
je 0x434f5b
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x434f5f
add eax, 4
add ecx, 4
test dx, dx
jne 0x434f39
mov eax, edi
jmp 0x434f64
sbb eax, eax
or eax, 1
test eax, eax
jne 0x434fa0
mov eax, dword [ebp - 0xd64]
cmp eax, 6
je 0x434fe9
cmp eax, 8
je 0x434fe9
cmp eax, 9
je 0x434fe9
cmp eax, 3
je 0x434fe9
cmp eax, 7
je 0x434fe9
push ecx
lea eax, [ebp - 0x108]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x720]
call fcn.0040c197
lea eax, [ebp - 0xd44]
mov dword [ebp - 0xd44], 0x104
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x434ff3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x434fd9
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x435097
mov esi, 0x80004005
jmp 0x435097
mov esi, 0x80070523
jmp 0x435097
lea ecx, [ebp - 0x518]
mov eax, 0x4015c0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x435024
test dx, dx
je 0x435020
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x435024
add eax, 4
add ecx, 4
test dx, dx
jne 0x434ffe
mov eax, edi
jmp 0x435029
sbb eax, eax
or eax, 1
test eax, eax
je 0x435077
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x518]
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x435077
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x518]
push eax
push 0x401d00
lea eax, [ebp - 0xb30]
push 0x208
push eax
call fcn.0040c0f9
add esp, 0x14
jmp 0x435097
push ecx
lea eax, [ebp - 0x720]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0xb30]
call fcn.0040c197
jmp 0x435097
mov esi, 0x80070057
cmp dword [ebp - 0xd3c], 0
je 0x4350ac
push dword [ebp - 0xd3c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
js 0x435646
lea eax, [ebp - 0x108]
mov dword [ebp - 0xd44], edi
push eax
push 0x408e30
mov esi, 0x208
mov dword [ebp - 0xd40], edi
lea eax, [ebp - 0x310]
mov ebx, edi
push esi
push eax
call fcn.0040c0f9
add esp, 0x10
lea eax, [ebp - 0xd40]
push eax
push 0x101
push edi
lea eax, [ebp - 0x310]
push eax
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x435181
lea eax, [ebp - 0xd68]
mov dword [ebp - 0xd5c], 1
push eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0xd68], esi
push eax
lea eax, [ebp - 0xd5c]
push eax
push edi
push 0x408eb8
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43516d
cmp dword [ebp - 0xd5c], 1
jne 0x43516d
lea eax, [ebp - 0x310]
push eax
push 0x408ed4
lea eax, [ebp - 0x928]
push esi
push eax
call fcn.0040c0f9
xor ebx, ebx
add esp, 0x10
test eax, eax
setns bl
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x43552f
or dword [ebp - 0xd3c], 0xffffffff
lea eax, [ebp - 0xd3c]
push eax
push 0x2e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x43562e
push 0x20
call fcn.0044183a
mov esi, eax
pop ecx
test esi, esi
je 0x435516
lea ecx, [esi + 4]
mov dword [esi], 1
push ecx
push 0x408f08
push edi
mov dword [esi + 0x10], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [esi + 0x14]
mov dword [esi + 0xc], 2
push eax
push 0x408f30
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push edi
push edi
push edi
push esi
push edi
mov dword [esi + 0x1c], 2
push dword [ebp - 0xd3c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ecx
lea eax, [ebp - 0xb30]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x720]
call fcn.0040c197
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0xd90]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x720]
mov dword [ebp - 0xd90], 0x20
mov dword [ebp - 0xd88], eax
lea eax, [ebp - 0xd90]
push eax
push dword [ebp - 0xd3c]
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x4354f0
push 0x104
lea eax, [ebp - 0x518]
push eax
push 0x408f54
push dword [ebp - 0xd3c]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserW]
test eax, eax
je 0x4352f9
lea eax, [ebp - 0x720]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x4352c2
lea eax, [ebp - 0x720]
push 0x40
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x4352c2
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4352f9
jmp 0x4352dc
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x4352f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4352e9
push 0x57
pop eax
push eax
push 0x408f6c
push 4
call fcn.0041ea5f
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x408fa0
lea eax, [ebp - 0x310]
push 0x208
push eax
call fcn.0040c0f9
add esp, 0x10
xor edi, edi
test eax, eax
js 0x4353fe
lea eax, [ebp - 0xd40]
push eax
push 1
push edi
lea eax, [ebp - 0x310]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4353fe
lea eax, [ebp - 0xd6c]
mov dword [ebp - 0xd4c], 1
push eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0xd6c], 0x208
push eax
lea eax, [ebp - 0xd4c]
push eax
push edi
push 0x409018
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4353ea
cmp dword [ebp - 0xd4c], 2
je 0x4353a0
cmp dword [ebp - 0xd4c], 1
jne 0x4353ea
lea eax, [ebp - 0x310]
jmp 0x4353c9
push 0x104
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0xd3c]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserW]
test eax, eax
je 0x4353ea
lea eax, [ebp - 0x518]
push eax
push 0x409040
lea eax, [ebp - 0x928]
push 0x208
push eax
call fcn.0040c0f9
xor ebx, ebx
add esp, 0x10
test eax, eax
setns bl
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x4354d3
lea eax, [ebp - 0xd40]
push eax
push 0x101
push edi
push 0x4090b8
push dword [ebp - 0xd74]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4354d3
lea eax, [ebp - 0xd70]
mov dword [ebp - 0xd50], 1
push eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0xd70], 0x208
push eax
lea eax, [ebp - 0xd50]
push eax
push edi
push 0x408eb8
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4354c7
cmp dword [ebp - 0xd50], 2
je 0x43547d
cmp dword [ebp - 0xd50], 1
jne 0x4354c7
lea eax, [ebp - 0x310]
jmp 0x4354a6
push 0x104
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0xd3c]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserW]
test eax, eax
je 0x4354c7
lea eax, [ebp - 0x518]
push eax
push 0x408ed4
lea eax, [ebp - 0x928]
push 0x208
push eax
call fcn.0040c0f9
xor ebx, ebx
add esp, 0x10
test eax, eax
setns bl
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xd74], 0xffffffff
je 0x4354f2
push dword [ebp - 0xd74]
push dword [ebp - 0xd3c]
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
jmp 0x4354f2
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4354ff
push 0x57
pop eax
push eax
push 0x40913c
push 4
call fcn.0041ea5f
add esp, 0xc
push esi
call fcn.00441807
pop ecx
push dword [ebp - 0xd3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x43562e
mov esi, 0x208
lea eax, [ebp - 0x108]
push eax
push 0x409570
lea eax, [ebp - 0xd38]
push esi
push eax
call fcn.0040c0f9
add esp, 0x10
lea eax, [ebp - 0xd44]
push edi
push eax
push edi
push 0x20106
push edi
push edi
push edi
lea eax, [ebp - 0xd38]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x435617
lea ecx, [ebp - 0xb30]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x43557f
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xb30]
push eax
push 1
push edi
push 0x4095d4
push dword [ebp - 0xd44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x928]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4355ba
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x928]
push eax
push 1
push edi
push 0x4095ec
push dword [ebp - 0xd44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xd44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x443534], 0xffffffff
jne 0x43560a
push ecx
push 4
pop edx
call fcn.0041e530
push 4
mov edx, 0x409610
pop ecx
call fcn.0041fb3c
mov ebx, dword [ebp - 0xd54]
push dword [ebp - 0xd60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x434e4b
lea eax, [ebp - 0xb30]
push eax
push 0x409624
push 2
call fcn.0041ea5f
add esp, 0xc
jmp 0x435617
push esi
push 0x40964c
push 2
call fcn.0041ea5f
add esp, 0xc
jmp 0x43561d
push dword [ebp - 0xd48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret