Function at 0x4347a7
Capabilities:
Get hostname
Impersonate user
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd94
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xd48], edi
call fcn.00434409
lea eax, [ebp - 0xd48]
push eax
push 0x20119
push edi
push 0x4094e0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43501c
mov dword [ebp - 0xd58], 0x80
mov ebx, edi
mov dword [ebp - 0xd60], edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xd58]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push dword [ebp - 0xd48]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x435010
lea eax, [ebp - 0xd60]
mov dword [ebp - 0xd58], 0x80
push eax
push 0x20119
push edi
lea eax, [ebp - 0x108]
inc ebx
push eax
push dword [ebp - 0xd48]
mov dword [ebp - 0xd54], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x435010
lea eax, [ebp - 0x108]
push eax
push 0x409544
push 4
call fcn.0041e83a
add esp, 0xc
mov dword [ebp - 0xd3c], edi
lea eax, [ebp - 0xd3c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x434a4a
mov eax, 0x104
mov esi, edi
mov dword [ebp - 0xd40], eax
mov dword [ebp - 0xd44], eax
lea eax, [ebp - 0xd64]
push eax
lea eax, [ebp - 0xd44]
push eax
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0xd40]
push eax
lea eax, [ebp - 0x720]
push eax
push dword [ebp - 0xd3c]
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x43497a
lea ecx, [ebp - 0x720]
mov eax, 0x4015d0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x434917
test dx, dx
je 0x434913
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x434917
add eax, 4
add ecx, 4
test dx, dx
jne 0x4348f1
mov eax, edi
jmp 0x43491c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x434958
mov eax, dword [ebp - 0xd64]
cmp eax, 6
je 0x4349a1
cmp eax, 8
je 0x4349a1
cmp eax, 9
je 0x4349a1
cmp eax, 3
je 0x4349a1
cmp eax, 7
je 0x4349a1
push ecx
lea eax, [ebp - 0x108]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x720]
call fcn.0040c1c3
lea eax, [ebp - 0xd44]
mov dword [ebp - 0xd44], 0x104
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x4349ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x434991
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x434a4f
mov esi, 0x80004005
jmp 0x434a4f
mov esi, 0x80070523
jmp 0x434a4f
lea ecx, [ebp - 0x518]
mov eax, 0x4015d0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4349dc
test dx, dx
je 0x4349d8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4349dc
add eax, 4
add ecx, 4
test dx, dx
jne 0x4349b6
mov eax, edi
jmp 0x4349e1
sbb eax, eax
or eax, 1
test eax, eax
je 0x434a2f
push 0xffffffffffffffff
lea eax, [ebp - 0x310]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x518]
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x434a2f
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x518]
push eax
push 0x401d10
lea eax, [ebp - 0xb30]
push 0x208
push eax
call fcn.0040c125
add esp, 0x14
jmp 0x434a4f
push ecx
lea eax, [ebp - 0x720]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0xb30]
call fcn.0040c1c3
jmp 0x434a4f
mov esi, 0x80070057
cmp dword [ebp - 0xd3c], 0
je 0x434a64
push dword [ebp - 0xd3c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
js 0x434ffe
lea eax, [ebp - 0x108]
mov dword [ebp - 0xd44], edi
push eax
push 0x408e30
mov esi, 0x208
mov dword [ebp - 0xd40], edi
lea eax, [ebp - 0x310]
mov ebx, edi
push esi
push eax
call fcn.0040c125
add esp, 0x10
lea eax, [ebp - 0xd40]
push eax
push 0x101
push edi
lea eax, [ebp - 0x310]
push eax
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x434b39
lea eax, [ebp - 0xd68]
mov dword [ebp - 0xd5c], 1
push eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0xd68], esi
push eax
lea eax, [ebp - 0xd5c]
push eax
push edi
push 0x408eb8
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x434b25
cmp dword [ebp - 0xd5c], 1
jne 0x434b25
lea eax, [ebp - 0x310]
push eax
push 0x408ed4
lea eax, [ebp - 0x928]
push esi
push eax
call fcn.0040c125
xor ebx, ebx
add esp, 0x10
test eax, eax
setns bl
ret
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x434ee7
or dword [ebp - 0xd3c], 0xffffffff
lea eax, [ebp - 0xd3c]
push eax
push 0x2e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x434fe6
push 0x20
call fcn.00440dea
mov esi, eax
pop ecx
test esi, esi
je 0x434ece
lea ecx, [esi + 4]
mov dword [esi], 1
push ecx
push 0x408f08
push edi
mov dword [esi + 0x10], 2
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [esi + 0x14]
mov dword [esi + 0xc], 2
push eax
push 0x408f30
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push edi
push edi
push edi
push esi
push edi
mov dword [esi + 0x1c], 2
push dword [ebp - 0xd3c]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ecx
lea eax, [ebp - 0xb30]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x720]
call fcn.0040c1c3
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0xd90]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x720]
mov dword [ebp - 0xd90], 0x20
mov dword [ebp - 0xd88], eax
lea eax, [ebp - 0xd90]
push eax
push dword [ebp - 0xd3c]
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
je 0x434ea8
push 0x104
lea eax, [ebp - 0x518]
push eax
push 0x408f54
push dword [ebp - 0xd3c]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserW]
test eax, eax
je 0x434cb1
lea eax, [ebp - 0x720]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x434c7a
lea eax, [ebp - 0x720]
push 0x40
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x434c7a
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x434cb1
jmp 0x434c94
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x434cb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x434ca1
push 0x57
pop eax
push eax
push 0x408f6c
push 4
call fcn.0041e83a
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x408fa0
lea eax, [ebp - 0x310]
push 0x208
push eax
call fcn.0040c125
add esp, 0x10
xor edi, edi
test eax, eax
js 0x434db6
lea eax, [ebp - 0xd40]
push eax
push 1
push edi
lea eax, [ebp - 0x310]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x434db6
lea eax, [ebp - 0xd6c]
mov dword [ebp - 0xd4c], 1
push eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0xd6c], 0x208
push eax
lea eax, [ebp - 0xd4c]
push eax
push edi
push 0x409018
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x434da2
cmp dword [ebp - 0xd4c], 2
je 0x434d58
cmp dword [ebp - 0xd4c], 1
jne 0x434da2
lea eax, [ebp - 0x310]
jmp 0x434d81
push 0x104
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0xd3c]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserW]
test eax, eax
je 0x434da2
lea eax, [ebp - 0x518]
push eax
push 0x409040
lea eax, [ebp - 0x928]
push 0x208
push eax
call fcn.0040c125
xor ebx, ebx
add esp, 0x10
test eax, eax
setns bl
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x434e8b
lea eax, [ebp - 0xd40]
push eax
push 0x101
push edi
push 0x4090b8
push dword [ebp - 0xd74]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x434e8b
lea eax, [ebp - 0xd70]
mov dword [ebp - 0xd50], 1
push eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0xd70], 0x208
push eax
lea eax, [ebp - 0xd50]
push eax
push edi
push 0x408eb8
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x434e7f
cmp dword [ebp - 0xd50], 2
je 0x434e35
cmp dword [ebp - 0xd50], 1
jne 0x434e7f
lea eax, [ebp - 0x310]
jmp 0x434e5e
push 0x104
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0xd3c]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserW]
test eax, eax
je 0x434e7f
lea eax, [ebp - 0x518]
push eax
push 0x408ed4
lea eax, [ebp - 0x928]
push 0x208
push eax
call fcn.0040c125
xor ebx, ebx
add esp, 0x10
test eax, eax
setns bl
push dword [ebp - 0xd40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xd74], 0xffffffff
je 0x434eaa
push dword [ebp - 0xd74]
push dword [ebp - 0xd3c]
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
jmp 0x434eaa
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x434eb7
push 0x57
pop eax
push eax
push 0x40913c
push 4
call fcn.0041e83a
add esp, 0xc
push esi
call fcn.00440db7
pop ecx
push dword [ebp - 0xd3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x434fe6
mov esi, 0x208
lea eax, [ebp - 0x108]
push eax
push 0x409570
lea eax, [ebp - 0xd38]
push esi
push eax
call fcn.0040c125
add esp, 0x10
lea eax, [ebp - 0xd44]
push edi
push eax
push edi
push 0x20106
push edi
push edi
push edi
lea eax, [ebp - 0xd38]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x434fcf
lea ecx, [ebp - 0xb30]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x434f37
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xb30]
push eax
push 1
push edi
push 0x4095d4
push dword [ebp - 0xd44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x928]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x434f72
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x928]
push eax
push 1
push edi
push 0x4095ec
push dword [ebp - 0xd44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xd44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x442534], 0xffffffff
jne 0x434fc2
push ecx
push 4
pop edx
call fcn.0041e30f
push 4
mov edx, 0x409610
pop ecx
call fcn.0041e767
mov ebx, dword [ebp - 0xd54]
push dword [ebp - 0xd60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x434803
lea eax, [ebp - 0xb30]
push eax
push 0x409624
push 2
call fcn.0041e83a
add esp, 0xc
jmp 0x434fcf
push esi
push 0x40964c
push 2
call fcn.0041e83a
add esp, 0xc
jmp 0x434fd5
push dword [ebp - 0xd48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave