Function at 0x401450
Capabilities:
Create directory
Get user security identifier
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x408198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push edi
push str.ModifyPermissions
lea ecx, [esp + 0x44]
call fcn.00401000
xor edi, edi
push 0x104
push edi
mov dword [esp + 0x58], edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
jne 0x4014a7
lea eax, [esp + 0x40]
push str.LocalAlloc_returned_NULL
push eax
call fcn.00401120
add esp, 8
jmp 0x401a9c
mov ecx, dword [esp + 0x5c]
push ebp
push esi
push 0x40a438
push ecx
call fcn.00402e5c
mov esi, eax
add esp, 8
mov dword [esp + 0x64], esi
jmp 0x4014c7
mov esi, dword [esp + 0x64]
mov ebp, dword [esp + 0x68]
mov dword [esp + 0x1c], edi
push ebp
push 0x104
push ebx
push 0x40ce6c
push str.UserOrGroup
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x401503
push esi
lea edx, [esp + 0x4c]
push str.Unable_to_read_UserOrGroup_in_section:__s
push edx
call fcn.00401120
add esp, 0xc
jmp 0x401a77
lea eax, [esp + 0x40]
lea ecx, [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x28]
push edi
push edx
push edi
push ebx
mov dword [esp + 0x30], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
call edi
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x401542
push ebx
lea eax, [esp + 0x4c]
push str.Unable_to_get_SID_for_user:__s
push eax
call fcn.00401120
add esp, 0xc
jmp 0x401a77
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x401564
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x40]
lea edx, [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
push ecx
push edx
push ebx
push 0
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebp
push 0x104
push ebx
push 0x40ce6c
push str.AccessMode
push esi
call edi
test eax, eax
jne 0x4015b8
push esi
lea eax, [esp + 0x4c]
push str.Unable_to_read_AccessMode_in_section:__s
push eax
call fcn.00401120
add esp, 0xc
jmp 0x401a59
push str.SET_ACCESS
push ebx
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x4015d4
mov dword [esp + 0x10], 2
jmp 0x40160e
push str.GRANT_ACCESS
push ebx
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x4015f0
mov dword [esp + 0x10], 1
jmp 0x40160e
push str.DENY_ACCESS
push ebx
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401b2f
mov dword [esp + 0x10], 3
push ebp
push 0x104
push ebx
push 0x40ce6c
push str.AccessMask
push esi
call edi
test eax, eax
jne 0x401631
push esi
push str.Unable_to_read_AccessMask_in_section:__s
jmp 0x401b35
push 0x10
push 0
push ebx
call fcn.00402acf
add esp, 0xc
mov dword [esp + 0x30], eax
push ebp
push 0x104
push ebx
push 0x40ce6c
push str.Inheritance
push esi
call edi
test eax, eax
jne 0x401672
push esi
lea edx, [esp + 0x4c]
push str.Unable_to_read_Inheritance_in_section:__s
push edx
call fcn.00401120
add esp, 0xc
jmp 0x401a59
push 0x10
push 0
push ebx
call fcn.00402acf
add esp, 0xc
mov dword [esp + 0x2c], eax
push ebp
push 0x104
push ebx
push 0x40ce6c
push str.Count
push esi
call edi
test eax, eax
jne 0x4016b3
push esi
lea eax, [esp + 0x4c]
push str.Unable_to_read_Count_in_section:__s
push eax
call fcn.00401120
add esp, 0xc
jmp 0x401a59
push 0xa
push 0
push ebx
call fcn.00402acf
add esp, 0xc
mov edi, eax
mov dword [esp + 0x44], edi
push 0x40
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x3c], ebp
je 0x401a59
mov eax, 1
cmp edi, eax
mov dword [esp + 0x38], eax
jb 0x401a4e
jmp 0x4016f5
mov ebp, dword [esp + 0x3c]
push eax
push str.Object_d
push ebp
call fcn.0040220e
mov ecx, 0x41
xor eax, eax
mov edi, ebx
add esp, 0xc
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x68]
push ecx
push 0x104
push ebx
push 0x40ce6c
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x401a18
push 0x40a2d4
push ebx
call fcn.004022bc
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x24], edi
je 0x401817
push 0x40
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esp + 0x28], eax
je 0x401a26
lea eax, [edi + 1]
push 0x40a2d4
push eax
call fcn.004022bc
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x401a3a
mov edi, 0x40ce70
or ecx, 0xffffffff
xor eax, eax
push 0x40
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x28]
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x2c]
inc eax
push eax
push esi
call fcn.00402a45
mov ecx, dword [esp + 0x74]
push ecx
push esi
call fcn.00401b50
mov esi, eax
add esp, 0x14
test esi, esi
je 0x401a4e
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov edi, esi
or ecx, 0xffffffff
push ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebx
push ecx
call fcn.00402710
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push edx
call fcn.00402710
mov eax, dword [esp + 0x40]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0x18
push eax
call edi
push esi
call edi
mov esi, dword [esp + 0x64]
push ebx
lea ecx, [esp + 0x4c]
push str.Object_to_modify:__s
push ecx
call fcn.00401120
mov eax, dword [esp + 0x6c]
add esp, 0xc
cmp eax, 1
jne 0x4018ca
mov edi, dword [esp + 0x6c]
push 0
test edi, edi
push 0x2000000
jne 0x40184a
push 4
jmp 0x40184c
push 3
push 0
push 0
push 0xe0000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40189d
cmp edi, 1
jne 0x401879
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x401ac0
push 0
push 0x2000000
push 3
push 0
push 0
push 0xe0000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401ad7
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push 0
push edx
push 1
push esi
call fcn.00402020
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4019fd
cmp eax, 4
jne 0x401a01
push 0x40a10c
push ebx
call fcn.004022bc
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x401aee
mov edi, 0x40ce70
or ecx, 0xffffffff
xor eax, eax
push str.HKLM
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401927
mov eax, 0x80000002
jmp 0x4019a6
push str.HKEY_LOCAL_MACHINE
push ebx
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401940
mov eax, 0x80000002
jmp 0x4019a6
push str.HKEY_CLASSES_ROOT
push ebx
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401959
mov eax, 0x80000000
jmp 0x4019a6
push str.HKEY_CURRENT_USER
push ebx
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401972
mov eax, 0x80000001
jmp 0x4019a6
push str.HKEY_USERS
push ebx
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x40198b
mov eax, 0x80000003
jmp 0x4019a6
push str.HKEY_CURRENT_CONFIG
push ebx
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401b17
mov eax, 0x80000005
lea ecx, [esp + 0x34]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0x40ce6c
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401b06
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x3c]
push ecx
push 0
push edx
push 4
push eax
call fcn.00402020
mov ecx, dword [esp + 0x50]
add esp, 0x1c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x64]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x44]
inc eax
cmp eax, ecx
mov dword [esp + 0x38], eax
jbe 0x4016f1
jmp 0x401a4e
push esi
push ebp
lea edx, [esp + 0x50]
push str.Unable_to_read__s_in_section:__s
push edx
jmp 0x401a46
lea eax, [esp + 0x48]
push str.LocalAlloc_returned_NULL
push eax
call fcn.00401120
add esp, 8
jmp 0x401a4e
push esi
push ebx
lea ecx, [esp + 0x50]
push str.Invalid_string_:__s__:_in_section__s
push ecx
call fcn.00401120
add esp, 0x10
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x401a68
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x401a77
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
push 0x40a438
push edi
call fcn.00402e5c
add esp, 8
cmp eax, edi
mov dword [esp + 0x64], eax
jne 0x4014c3
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop ebp
lea ecx, [esp + 0x40]
mov dword [esp + 0x50], 0xffffffff
call fcn.004010a0
mov ecx, dword [esp + 0x48]
pop edi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x50]
push str.Error:__d_when_opening_file__s
push edx
jmp 0x401a46
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x50]
push str.Error:__d_when_opening_file__s
push eax
jmp 0x401a46
push ebx
lea ecx, [esp + 0x4c]
push str.Invalid_Registry_Key_format:__s
push ecx
call fcn.00401120
add esp, 0xc
jmp 0x401a4e
push ebp
push ebx
lea edx, [esp + 0x50]
push str.Error_opening_key:__s_subkey__s
push edx
jmp 0x401a46
push ebx
lea eax, [esp + 0x4c]
push str.Unknown_registry_key:__s
push eax
call fcn.00401120
add esp, 0xc
jmp 0x401a4e
push ebx
push str.Unrecognized_Access_Mode:__s
lea ecx, [esp + 0x50]
push ecx
call fcn.00401120
add esp, 0xc
jmp 0x401a59