Function at 0x49af60
Capabilities:
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0x7388
call fcn.0040d036
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x49af8d
mov eax, 0x68
jmp 0x49b5e8
push 0x7388
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.00402610
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x49afbc
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040d01b
add esp, 4
mov eax, 0x1f5
jmp 0x49b5e8
mov edx, dword [ebp + 8]
push edx
call fcn.0040cf90
add esp, 4
test eax, eax
jne 0x49afe2
mov eax, dword [ebp - 4]
push eax
call fcn.0040d01b
add esp, 4
mov eax, 0x1f5
jmp 0x49b5e8
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
add edx, 0x3069
push edx
call fcn.0040ce90
add esp, 8
mov eax, dword [ebp - 4]
add eax, 0x3069
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x3069
push ecx
call fcn.004a0a10
add esp, 8
mov edx, dword [ebp - 4]
add edx, 0x7284
push edx
mov eax, dword [ebp - 4]
add eax, 0x7183
push eax
push 0
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x3069
push ecx
call fcn.0042d3f8
add esp, 0x14
mov edx, dword [ebp - 4]
add edx, 0x7284
push edx
mov eax, dword [ebp - 4]
add eax, 0x7284
push eax
call fcn.0049e4f0
add esp, 8
push 0x58da84
mov ecx, dword [ebp - 4]
add ecx, 0x7284
push ecx
call fcn.00427390
add esp, 8
test eax, eax
je 0x49b0bd
push 0x58da7c
mov edx, dword [ebp - 4]
add edx, 0x7284
push edx
call fcn.00427390
add esp, 8
test eax, eax
je 0x49b0bd
push 0x58da74
mov eax, dword [ebp - 4]
add eax, 0x7284
push eax
call fcn.00427390
add esp, 8
test eax, eax
je 0x49b0bd
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040d01b
add esp, 4
mov eax, 0x1f6
jmp 0x49b5e8
mov edx, dword [ebp - 4]
add edx, 0x3069
push edx
mov eax, dword [ebp - 4]
add eax, 0x406a
push eax
call fcn.0040ce90
add esp, 8
push str..Log
mov ecx, dword [ebp - 4]
add ecx, 0x406a
push ecx
call fcn.0040cea0
add esp, 8
push 0x58da14
mov edx, dword [ebp - 4]
add edx, 0x406a
push edx
call fcn.0040d309
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2064], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2064], 0
jne 0x49b131
mov eax, dword [ebp - 4]
push eax
call fcn.0040d01b
add esp, 4
mov eax, 0x1f5
jmp 0x49b5e8
push 0x58da18
mov ecx, dword [ebp - 4]
add ecx, 0x54
push ecx
call fcn.0040ce90
add esp, 8
push 0x58da10
mov edx, dword [ebp - 4]
add edx, 0x54
push edx
call fcn.0040cea0
add esp, 8
mov eax, dword [ebp - 4]
add eax, 0x7183
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x54
push ecx
call fcn.0040cea0
add esp, 8
push 0x58da0c
mov edx, dword [ebp - 4]
add edx, 0x54
push edx
call fcn.0040cea0
add esp, 8
push 0x58d9e8
mov eax, dword [ebp - 4]
add eax, 0x54
push eax
call fcn.0040cea0
add esp, 8
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
push 0xf003f
push 0
mov edx, dword [ebp - 4]
add edx, 0x54
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x49b233
mov eax, dword [ebp - 4]
add eax, 0x7284
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x7183
push ecx
push str.Entry_Not_Found:__s_s_n
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2064]
push eax
call fcn.00401040
add esp, 0x10
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2064], 0
je 0x49b21d
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2064]
push eax
call fcn.0040d693
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2064], 0
mov edx, dword [ebp - 4]
push edx
call fcn.0040d01b
add esp, 4
mov eax, 0x1f9
jmp 0x49b5e8
mov eax, dword [ebp - 4]
mov dword [eax + 0x4c], 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
add ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], ecx
mov eax, dword [ebp - 8]
push eax
push 0x58d9c4
mov ecx, dword [ebp - 4]
add ecx, 0xc
push ecx
call fcn.004010f0
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [edx + 0x2058], 0x1000
push 0x1001
push 0
mov eax, dword [ebp - 4]
add eax, 0x1055
push eax
call fcn.00402610
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, 0x2058
push ecx
mov edx, dword [ebp - 4]
add edx, 0x1055
push edx
push 0
push 0
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x49b2ed
mov eax, dword [ebp - 4]
add eax, 0x1055
push eax
push 0x58d9c0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2064]
push edx
call fcn.00401040
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
add eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4c], eax
mov edx, dword [ebp - 0xc]
push edx
push 0x58d9b4
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
call fcn.004010f0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2058], 0x1000
push 0x1001
push 0
mov edx, dword [ebp - 4]
add edx, 0x1055
push edx
call fcn.00402610
add esp, 0xc
mov eax, dword [ebp - 4]
add eax, 0x2058
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x1055
push ecx
push 0
push 0
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x49b39e
mov ecx, dword [ebp - 4]
add ecx, 0x1055
push ecx
push 0x58d9b0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2064]
push eax
call fcn.00401040
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, 0x5070
push ecx
call fcn.0049ec70
add esp, 4
mov edx, dword [ebp - 4]
add edx, 0x5070
push edx
call fcn.0049ecb0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x506c], eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x5078], 0x1000
mov eax, dword [ebp - 4]
add eax, 0x5078
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x507c
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x506c]
push eax
call fcn.0042b93e
add esp, 4
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x507c
push ecx
push str.__Exported_by__s_on__s
mov edx, dword [ebp - 4]
add edx, 0x607d
push edx
call fcn.004010f0
add esp, 0x10
mov eax, dword [ebp - 4]
add eax, 0x607d
push eax
call fcn.0040cf90
add esp, 4
mov ecx, dword [ebp - 4]
mov byte [ecx + eax + 0x607c], 0
mov edx, dword [ebp - 4]
add edx, 0x607d
push edx
push 0x58d994
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2064]
push ecx
call fcn.00401040
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
add edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x4c], edx
mov ecx, dword [ebp - 0x10]
push ecx
push 0x58d988
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
call fcn.004010f0
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [eax + 0x2058], 0x1000
push 0x1001
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x1055
push ecx
call fcn.00402610
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, 0x2058
push edx
mov eax, dword [ebp - 4]
add eax, 0x1055
push eax
push 0
push 0
mov ecx, dword [ebp - 4]
add ecx, 0xc
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x49b5a2
mov eax, dword [ebp - 4]
add eax, 0x1055
push eax
push 0x58d984
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2064]
push edx
call fcn.00401040
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
add eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4c], eax
mov edx, dword [ebp - 0x14]
push edx
push 0x58d978
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
call fcn.004010f0
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2058], 0x1000
push 0x1001
push 0
mov edx, dword [ebp - 4]
add edx, 0x1055
push edx
call fcn.00402610
add esp, 0xc
mov eax, dword [ebp - 4]
add eax, 0x2058
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x1055
push ecx
push 0
push 0
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
jmp 0x49b4e9
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2064], 0
je 0x49b5cd
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2064]
push edx
call fcn.0040d693
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0x2064], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
push eax
call fcn.0040d01b
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret