Function at 0x42d160
Capabilities:
Get session user name
Get user security identifier
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc54
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x828]
push eax
push 0xf003f
xor esi, esi
push esi
push str.SOFTWARECyberLinkCBE
push SysReAllocString
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x840], ebx
mov dword [ebp - 0x828], esi
call edi
test eax, eax
jne 0x42d248
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004866f0
add esp, 0xc
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x830]
push eax
push esi
push str.UUID
push dword [ebp - 0x828]
mov dword [ebp - 0x82c], 0x104
mov dword [ebp - 0x830], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42d234
lea ecx, [ebp - 0x20c]
mov edx, ebx
mov eax, ecx
sub edx, eax
jmp 0x42d220
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x42d220
mov esi, 1
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x42d625
lea eax, [ebp - 0x828]
push eax
push 0xf003f
push 0
push str.SOFTWARECyberLinkCBE_OEM
push SysReAllocString
call edi
test eax, eax
jne 0x42d36a
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004866f0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x82c]
push eax
push 0
push str.UUID
push dword [ebp - 0x828]
mov dword [ebp - 0x830], 0x104
mov dword [ebp - 0x82c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42d2e6
lea ecx, [ebp - 0x20c]
mov edx, ebx
mov eax, ecx
sub edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x42d2d2
mov esi, 1
push dword [ebp - 0x828]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
test esi, esi
je 0x42d36a
push 0
lea eax, [ebp - 0x828]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARECyberLinkCBE
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42d625
mov ecx, ebx
lea edx, [ecx + 2]
jmp 0x42d330
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42d330
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push 0
push str.UUID
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x828]
call edi
jmp 0x42d625
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.004866f0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x414]
push eax
push 2
mov dword [ebp - 0x830], 0x104
call sub.Secur32.dll_GetUserNameExW
push 0x40c
lea eax, [ebp - 0xc50]
push 0
push eax
mov dword [ebp - 0x83c], 0x104
mov dword [ebp - 0x838], 0x104
mov dword [ebp - 0xc54], 0
call fcn.004866f0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.004866f0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004866f0
add esp, 0x24
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0xc54]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x42d625
lea eax, [ebp - 0xc54]
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x42d46f
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00487c50
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0xc54]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov esi, eax
lea eax, [ebp - 0xc54]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx eax, byte [eax]
push 1
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x20c]
push str.S__lu_
push eax
call fcn.00486625
mov cl, byte [esi]
add esp, 0xc
mov edi, eax
test cl, cl
jne 0x42d4fb
cmp byte [esi + 1], cl
jne 0x42d4fb
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
push ecx
push 0x4ad2a0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x20c]
push eax
call fcn.00486625
add esp, 0xc
jmp 0x42d53a
movzx eax, byte [esi + 5]
push eax
movzx eax, byte [esi + 4]
push eax
movzx eax, byte [esi + 3]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, cl
push eax
push str.0x_02hx_02hx_02hx_02hx_02hx_02hx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x20c]
push eax
call fcn.00486625
add esp, 0x20
xor esi, esi
add edi, eax
cmp dword [ebp - 0x82c], esi
jbe 0x42d584
mov ebx, dword [ebp - 0x82c]
lea esp, [esp]
push esi
lea eax, [ebp - 0xc54]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
push dword [eax]
lea eax, [ebp - 0x20c]
push str.__lu
lea eax, [eax + edi*2]
push eax
call fcn.00486625
inc esi
add esp, 0xc
add edi, eax
cmp esi, ebx
jb 0x42d550
mov ebx, dword [ebp - 0x840]
mov ecx, dword [ebp - 0x834]
lea eax, [ebp - 0x824]
push eax
call fcn.0042ce20
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push eax
push str._s__s
push ebx
call fcn.0042f2d0
push ebx
call fcn.0048a7d8
add esp, 0x14
lea eax, [ebp - 0x828]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARECyberLinkCBE
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42d620
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42d5e7
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push 0
push str.UUID
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00487c50
mov esp, ebp
pop ebp
ret 4