Function at 0x509d10
Capabilities:
Check if file exists
Enumerate processes
Get session user name
Impersonate user
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566ae7
mov eax, dword fs:[0]
push eax
sub esp, 0xe94
mov eax, dword [0x5df7e4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xe70], ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xe6c], edi
cmp dword [0x5e5010], 0
jne 0x50a041
mov dword [ebp - 0xe50], 0x22c
push 0x228
push 0
lea eax, [ebp - 0xe4c]
push eax
call fcn.0052a280
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0xe50]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x509de3
nop dword [eax]
lea eax, [ebp - 0xe2c]
push eax
push 0x56ee34
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push str.explorer.exe
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x509dfe
lea eax, [ebp - 0xe50]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x509da0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.FindProcessByName_explorer.exe_fail
call fcn.004c1030
add esp, 4
mov al, 1
jmp 0x50a2f0
mov esi, dword [ebp - 0xe48]
test esi, esi
je 0x509dea
push str.FindProcessByName_explorer.exe_ok
call fcn.004c1030
add esp, 4
push esi
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x509e3d
push str.OpenProcess_fail
call fcn.004c1030
add esp, 4
mov al, 1
jmp 0x50a2f0
push str.OpenProcess_ok
call fcn.004c1030
add esp, 4
lea eax, [ebp - 0xe64]
push eax
push 0xa
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x509e72
push str.OpenProcessToken_fail
call fcn.004c1030
add esp, 4
mov al, 1
jmp 0x50a2f0
push str.OpenProcessToken_ok
call fcn.004c1030
add esp, 4
push dword [ebp - 0xe64]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x509ea3
push str.ImpersonateLoggedOnUser_fail
call fcn.004c1030
add esp, 4
mov al, 1
jmp 0x50a2f0
push str.ImpersonateLoggedOnUser_ok
call fcn.004c1030
add esp, 4
mov dword [ebp - 0xe5c], 0x104
lea eax, [ebp - 0xe5c]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x509ee6
push str.GetUserName_fail
call fcn.004c1030
add esp, 4
mov al, 1
jmp 0x50a2f0
push str.GetUserName_ok
call fcn.004c1030
xorps xmm0, xmm0
movlpd qword [ebp - 0xe94], xmm0
movlpd qword [ebp - 0xe8c], xmm0
mov dword [ebp - 0xe84], 0
mov dword [ebp - 0xea0], 0x20
lea eax, [ebp - 0x424]
mov dword [ebp - 0xe98], eax
mov dword [ebp - 0xe9c], 1
push str.RevertToSelf_start
call fcn.004c1030
add esp, 8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push str.RevertToSelf_ok
call fcn.004c1030
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x424]
push eax
push 0x56ee34
call fcn.004c1030
push str.ssss
call fcn.004c1030
add esp, 0xc
lea eax, [ebp - 0xea0]
push eax
push dword [ebp - 0xe64]
call dword [sym.imp.USERENV.dll_LoadUserProfileW]
test eax, eax
jne 0x509f9d
push str.LoadUserProfile_fail
call fcn.004c1030
add esp, 4
mov al, 1
jmp 0x50a2f0
push str.LoadUserProfile_ok
call fcn.004c1030
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x50a036
mov eax, dword [ebp - 0xe84]
mov dword [0x5e5010], eax
push dword [ebx]
push str.ExistWWCMD__s_
call fcn.004c1030
add esp, 8
mov dword [ebp - 0xe60], 0
lea eax, [ebp - 0xe60]
push eax
push 0x20019
push 0
push str.SoftwareClasses_aliimShellOpenCommand
push dword [0x5e5010]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x50a0bf
push eax
push str.SoftwareClasses_aliimShellOpenCommand
push dword [0x5e5010]
push str.RegOpenKeyEx_0x_08x__s__0x_08x_fail
push edi
call fcn.004c0530
push dword [edi]
call fcn.004c1030
add esp, 0x18
xor al, al
jmp 0x50a2f0
push str.RegOpenKeyEx_ok
call fcn.004c1030
add esp, 4
mov dword [ebp - 0xe74], 0x400
lea eax, [ebp - 0xe74]
push eax
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0xe80]
push eax
push 0
push 0
push dword [ebp - 0xe60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [ebp - 0xe60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x50a121
push str.RegGetValue_fail
call fcn.004c1030
add esp, 4
xor al, al
jmp 0x50a2f0
push str.RegGetValue_ok
call fcn.004c1030
add esp, 4
lea eax, [ebp - 0xc24]
push eax
lea ecx, [ebp - 0xe54]
call fcn.004bae60
mov dword [ebp - 4], 5
lea ecx, [ebp - 0xe54]
call fcn.0050ad40
lea ecx, [ebp - 0xe54]
call fcn.0050b270
push dword [ebp - 0xe54]
push str.RegGetValue__s
call fcn.004c1030
add esp, 8
mov eax, dword [ebp - 0xe54]
mov edx, dword [eax - 0xc]
test edx, edx
jle 0x50a1e6
js 0x50a30e
cmp word [eax], 0x22
jne 0x50a1e6
cmp edx, 1
jle 0x50a28a
push 0x22
add eax, 2
push eax
call fcn.0052a5df
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xe54]
test ecx, ecx
je 0x50a28a
sub ecx, eax
sar ecx, 1
test ecx, ecx
jle 0x50a28a
cmp ecx, dword [eax - 0xc]
jge 0x50a28a
lea eax, [ecx - 1]
push eax
push 1
lea eax, [ebp - 0xe5c]
push eax
lea ecx, [ebp - 0xe54]
call fcn.004c1160
mov byte [ebp - 4], 6
jmp 0x50a269
mov ecx, dword [0x5e500c]
test ecx, ecx
jne 0x50a1f5
or esi, 0xffffffff
jmp 0x50a213
test edx, edx
js 0x50a1f0
push ecx
push eax
call fcn.005290ec
add esp, 8
mov esi, eax
test esi, esi
je 0x50a1f0
sub esi, dword [ebp - 0xe54]
sar esi, 1
jns 0x50a23a
push esi
push str.cant_find_wwcmd.exe.__pos:_d_
call fcn.004c1030
add esp, 8
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe54]
call fcn.004badd0
xor al, al
jmp 0x50a2f0
push esi
push str.find_wwcmd.exe.__pos:_d_
call fcn.004c1030
add esp, 8
mov eax, dword [0x5e500c]
mov eax, dword [eax - 0xc]
add eax, esi
push eax
lea eax, [ebp - 0xe5c]
push eax
lea ecx, [ebp - 0xe54]
call fcn.004babf0
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xe54]
call fcn.004bad70
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xe5c]
call fcn.004badd0
mov eax, dword [ebp - 0xe54]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete byte [ebp - 0xe55]
push dword [ebp - 0xe54]
je 0x50a2bd
push str.file_not_exists__s
push edi
call fcn.004c0530
push dword [edi]
call fcn.004c1030
add esp, 0x10
jmp 0x50a221
push str.File_exists.__s
call fcn.004c1030
add esp, 8
lea eax, [ebp - 0xe54]
push eax
mov ecx, ebx
call fcn.004bad70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe54]
call fcn.004badd0
mov al, byte [ebp - 0xe55]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005121be
mov esp, ebp
pop ebp
ret 8
push 0x80070057
call fcn.004b95c0
int3