Function at 0x40e040
Capabilities:
Get user security identifier
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4167e8]
mov edx, dword [0x416800]
push ebx
push esi
lea ecx, [eax + 0x3a]
push edi
shl edx, cl
mov ecx, dword [0x4167f4]
mov dword [0x416800], edx
mov edx, dword [0x41680c]
add ecx, edx
push ecx
call fcn.0040b520
mov ebx, dword [0x4167d0]
mov edi, dword [0x416818]
xor eax, eax
cmp ebx, 0x20
sete al
push 0
push 2
and edi, eax
push 0x1c
push 0x8f7
mov dword [0x416818], edi
call fcn.0040b600
push 1
call fcn.0040e7d0
push fcn.0040edd0
push 0x738
call fcn.0040a3f0
push 0
push 0x6c
push 0
push 0
push 1
call fcn.0040b730
push dword fs:[0]
push 0
push 0x80
push 0x80
push 0
push 0x3b
call fcn.0040b730
mov dword fs:[0], esp
push 0xffffffffffffffce
push 0
push 0
push 0
push 0x128
call fcn.0040eaf0
push 0
push 0x3c
push 0
push 0
call fcn.0040b600
push 1
push 0
push 1
call fcn.0040e970
push 0
call fcn.0040e7d0
push 0
push 0
push 1
push 0
push 0
call fcn.0040b730
push 0xffffffffffffffe7
push 0xffffffffffffffff
call fcn.0040a1c0
push 0xfffffffffffffff8
push 0x7ec
call fcn.0040a1c0
mov eax, dword [0x416898]
mov edi, 0xffffff86
test eax, eax
mov esi, edi
je 0x40e17a
mov ecx, eax
mov dword [0x416898], 0
sar esi, 0x39
mov edx, esi
xor edi, edi
neg edx
je 0x40e174
lea eax, [esi*8]
sub eax, esi
lea edi, [eax + eax*4]
cmp edi, 0x25
jge 0x40e177
and esi, 1
dec ecx
jne 0x40e158
and esi, 1
mov eax, edi
sub eax, esi
xor esi, eax
lea ecx, [edi + esi]
test ecx, ecx
je 0x40e191
push 0
call fcn.0040e7d0
mov edx, 0x2b
mov ecx, edi
shl edx, cl
mov ecx, edx
sar esi, cl
cmp esi, edi
je 0x40e1a9
mov ecx, edi
imul ecx, esi
sar edi, cl
shl edi, 0x3c
push 0
push edi
push 0xffffffffffffffc7
push 0
push 0
call fcn.0040b730
sar edi, 1
xor eax, eax
test edi, edi
setg al
push eax
call fcn.0040b520
xor ecx, ecx
mov edx, 0xffffffd7
test edi, edi
setne cl
xor esi, esi
sar esi, cl
mov ecx, edi
and ecx, 0x2e
xor esi, ecx
mov ecx, esi
shl edx, cl
test edx, edx
je 0x40e1ee
mov eax, edi
or al, 0x2b
and esi, eax
lea ecx, [ebp - 4]
lea edx, [ebp - 0x24]
push ecx
push 0x8e8
push edx
push 0x40
push 0x2b
dec esi
mov dword [ebp - 4], 0x2b
call dword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
mov eax, esi
xor ecx, ecx
and eax, 0x2f
cmp esi, 0xffffffd4
setg cl
push eax
add edi, 0xffffffd5
push ecx
push edi
call fcn.0040e970
push 0x40
push 0
call sub.SHELL32.dll_SHGetSettings
mov edi, esi
mov ecx, esi
sar edi, cl
push 0
mov edx, edi
sar edx, 0x37
push edx
call fcn.0040ab50
xor ecx, ecx
cmp esi, 0xffffffc7
setne cl
sar esi, cl
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 0xffffffffffffffa7
push 1
call fcn.0040a1c0
mov eax, esi
mov edx, 0x20
or eax, 0xffffffdb
mov ecx, edi
push eax
mov eax, esi
sar edx, cl
shl eax, cl
xor ecx, 0xffffffc6
push edx
push eax
push edi
push ecx
call fcn.00414160
xor edx, edx
cmp edi, 0x3a
setle dl
xor eax, eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1e], eax
push 0x3d
push ecx
mov dword [ebp - 0x1a], eax
push 3
push 0xd7d
mov dword [ebp - 0x16], eax
push str.t243BLP096v9Sl5
push 0xffffffffffffffdb
and edi, edx
mov byte [ebp - 0x20], 0x60
mov byte [ebp - 0x1f], 0
mov word [ebp - 0x12], ax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
cmp edi, esi
setl bl
xor ebx, edi
push 0x953
push 0x3d
sub ebx, esi
call dword [sym.imp.ADVAPI32.dll_AreAnyAccessesGranted]
lea eax, [ebx + esi]
mov edx, esi
mov ecx, ebx
imul edx, esi
push edx
push eax
and ecx, 0x20
push 0xffffffffffffffff
push ecx
push eax
call fcn.0040b730
call dword [sym.imp.USER32.dll_CreateMenu]
xor edx, edx
lea eax, [ebx + 0x3b]
test ebx, ebx
setne dl
push edx
push eax
call fcn.0040ab50
push 0xcb8
push 0x34
push 0x28
call dword [sym.imp.USER32.dll_SetClassWord]
xor ebx, 0xbde
xor ecx, ecx
cmp ebx, 0xfffff889
setle cl
push ecx
call fcn.0040a3f0
lea edx, [ebp - 0x1c]
lea eax, [ebp - 8]
push edx
lea ecx, [ebp - 0x10]
push eax
push ecx
push 0x40
push 0
call sub.ADVAPI32.dll_LsaLookupNames
xor ecx, ecx
cmp ebx, 0x33
setg cl
mov edi, 0xfffff889
mov edx, 0xffffffcd
shl edi, cl
push 0x16a
sub edx, ebx
push 2
push 0x40
and edi, edx
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
push 0x32
push 0
push 0x33
call dword [sym.imp.USER32.dll_OpenInputDesktop]
push 1
push str.T5NM8
push 0x93b
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
xor eax, eax
cmp edi, 0x23
setg al
push eax
call fcn.0040b520
push 0
call fcn.0040a3f0
lea esi, [ebx + ebx]
mov ecx, edi
and esi, ebx
or ecx, 0x2b
sar esi, cl
mov ecx, edi
mov edx, edi
shl ecx, 0x23
or esi, ecx
mov ecx, edi
sar edx, cl
mov ecx, edx
shl esi, cl
xor ecx, ecx
cmp edi, 0xffffffd2
setl cl
shl esi, cl
xor ecx, ecx
push 0
cmp esi, edi
setne cl
sar edi, cl
xor eax, eax
cmp edi, esi
mov edx, edi
setl al
lea ecx, [edi + 0x3f]
push eax
xor edx, 0x37
push ecx
push edx
push 0xffffffffffffffef
call fcn.0040b730
mov eax, edi
mov ecx, edi
sar eax, cl
test eax, eax
je 0x40e3e9
mov edi, esi
mov ecx, edi
push 0
or ecx, 0x28
mov eax, edi
push ecx
mov ecx, edi
mov edx, esi
sar eax, cl
or edx, edi
sub ecx, esi
push edx
push eax
push ecx
call fcn.0040d6b0
mov edx, edi
xor eax, eax
and edx, 0xffffffdd
push 0x3c
or esi, edx
cmp edi, esi
setl al
push eax
push 0
push 0
push eax
call fcn.0040d6b0
xor ecx, ecx
cmp esi, 0xffffffde
setg cl
sar esi, cl
mov eax, 0xffffffd4
mov ecx, esi
sar eax, cl
mov ecx, eax
sar esi, cl
mov edx, esi
mov ecx, esi
sar edx, cl
xor ecx, ecx
sub esi, edx
cmp esi, 0x2e
setle cl
shl edi, cl
xor eax, eax
or edi, 1
cmp edi, 0x32
setl al
mov esi, eax
lea ecx, [esi + esi]
shl edi, cl
cmp edi, 0x3b
je 0x40e469
xor ecx, ecx
cmp esi, edi
setge cl
sar esi, cl
or edi, 0xffffff8f
mov edx, 0xffffffdd
mov ecx, edi
mov eax, esi
sar edx, cl
push 0
sub eax, edi
or ecx, 0x20
push edx
push eax
push 1
push ecx
call fcn.0040b730
mov ecx, edi
xor edx, edx
or ecx, 0xffffffd2
shl esi, cl
cmp esi, 0xffffffc3
sete dl
xor edx, esi
xor eax, eax
mov edi, edx
cmp esi, 0xffffffd3
mov edx, esi
mov ecx, edi
setle al
shl edx, cl
push eax
xor eax, eax
cmp edi, 0x24
push 0
setg al
push edx
push 0
push eax
call fcn.0040b730
xor ecx, ecx
cmp esi, 0x2b
setl cl
sub esi, ecx
xor ecx, ecx
cmp esi, edi
mov eax, dword [0x41689c]
setne cl
shl esi, cl
xor edx, edx
cmp edi, 0xffffffdb
sete dl
xor edi, edx
test eax, eax
je 0x40e59f
cmp edi, esi
jl 0x40e4f5
xor eax, eax
cmp edi, 0xffffffce
setl al
xor edi, eax
xor ecx, ecx
cmp edi, 0xffffffc3
sete cl
push ecx
push edi
call fcn.0040a1c0
mov edx, 0x27
mov ecx, edi
shl edx, cl
push 0x31
push 0x2d
push 0x24
xor edi, edx
call sub.USER32.dll_DdePostAdvise
cmp edi, 0xffffffd9
jl 0x40e528
mov eax, 0xffffffc6
sub eax, esi
and edi, eax
push 0x23
push 0x3f
push 0x30
xor esi, esi
call sub.USER32.dll_PackDDElParam
inc edi
xor ecx, ecx
cmp esi, 0x3e
push esi
sete cl
xor edx, edx
cmp edi, 0x25
push ecx
mov eax, edi
setge dl
mov ecx, esi
and eax, esi
push edx
sub ecx, edi
push eax
push ecx
call fcn.00414160
xor edx, edx
cmp edi, esi
setge dl
push 0x3b
push esi
xor edi, edx
call sub.SHELL32.dll_SHGetSettings
push edi
call fcn.0040e7d0
xor ecx, ecx
cmp esi, edi
sete cl
shl edi, cl
mov eax, edi
imul eax, esi
push eax
push esi
call fcn.0040a1c0
mov eax, dword [0x41689c]
lea ecx, [esi + 0x22]
shl edi, cl
dec eax
sar esi, 0xf9
test eax, eax
mov dword [0x41689c], eax
jne 0x40e4e7
mov edx, esi
mov ecx, esi
sar edx, cl
test edx, edx
je 0x40e5b4
mov eax, esi
shl eax, 0x24
push eax
call fcn.0040b520
mov eax, dword [0x4168a0]
lea ecx, [edi + esi]
shl edi, cl
test eax, eax
je 0x40e63a
mov ecx, 0x30
xor edx, edx
sub ecx, esi
mov eax, edi
and esi, ecx
cmp esi, 0x32
setne dl
xor eax, esi
push edx
push eax
call fcn.0040a1c0
xor ecx, ecx
cmp edi, 0x3b
setl cl
sub esi, ecx
mov ecx, dword [0x4168a0]
dec ecx
cmp esi, 0x20
mov dword [0x4168a0], ecx
jge 0x40e623
lea eax, [esi + esi*2]
mov ecx, esi
imul ecx, esi
lea eax, [eax + eax*8]
lea edx, [esi + 0x24]
shl eax, 1
push 0
sub eax, esi
push edx
xor edx, edx
neg eax
cmp edi, 0x2c
push eax
push 0
push ecx
setne dl
push edx
call fcn.0040a040
mov eax, esi
sar eax, 0x28
or edi, eax
mov eax, dword [0x4168a0]
mov ecx, edi
imul ecx, esi
sar esi, cl
test eax, eax
jne 0x40e5c2
lea ecx, [esi + 0x22]
mov edx, edi
xor esi, ecx
push 0
or edx, esi
lea ecx, [esi + esi*4]
xor edi, edx
shl ecx, 2
sub ecx, esi
lea eax, [esi + 0x37]
neg ecx
mov edx, esi
push eax
shl ecx, 1
sar edx, 0xd6
xor eax, eax
cmp esi, edi
push ecx
push edx
setl al
push eax
call fcn.0040b730
xor ecx, ecx
cmp esi, 0xffffffdf
setge cl
mov edx, esi
or edi, ecx
or edx, 0xffffffde
je 0x40e683
mov eax, edi
xor eax, 0x38
sub edi, eax
mov ecx, esi
shl ecx, 6
sub ecx, esi
je 0x40e68e
mov edi, esi
mov edx, edi
mov ecx, edi
sar edx, cl
test edx, edx
je 0x40e69f
mov eax, edi
xor eax, 0x2a
and edi, eax
mov edx, edi
mov ecx, edi
and edx, 0xffffffcf
or ecx, 0x3b
push 0
push edx
sub esi, ecx
call fcn.0040a1c0
xor eax, eax
cmp esi, edi
setg al
add esi, eax
call fcn.0040edd0
xor ecx, ecx
cmp esi, 0x21
setg cl
sub edi, ecx
xor ecx, ecx
cmp esi, 0x39
lea edx, [esi + 0x24]
sete cl
sar edi, cl
test edx, edx
je 0x40e6f6
mov eax, esi
xor ecx, ecx
shl eax, 4
add eax, esi
shl eax, 1
cmp esi, 0xffffffce
push eax
setl cl
push ecx
push 0
call fcn.0040b930
xor ecx, ecx
cmp esi, 0xffffffd3
setge cl
sar esi, cl
xor edx, edx
cmp edi, 0xffffffcd
setne dl
xor edi, edx
xor eax, eax
lea ecx, [edi + edi]
shl edi, cl
cmp esi, edi
sete al
lea ecx, [edi - 0x21]
and esi, eax
test ecx, ecx
je 0x40e728
push 0
push 0x36
call fcn.0040ab50
xor edx, edx
cmp esi, edi
setge dl
or edi, edx
mov eax, 0x35
mov ecx, edi
shl eax, cl
xor ecx, ecx
cmp edi, 0x31
setg cl
push eax
push ecx
call fcn.0040a1c0
mov edx, edi
xor eax, eax
imul edx, edi
sub esi, edx
cmp edi, 0x37
sete al
or edi, eax
xor ebx, ebx
cmp esi, edi
mov ecx, edi
sete bl
imul ecx, esi
mov edx, edi
mov eax, edi
xor edx, 0x3d
push ecx
and al, 0xc5
push edx
push eax
lea eax, [esi*8]
sub eax, esi
lea ecx, [eax + eax*4]
push ecx
push ebx
call fcn.0040d6b0
xor edx, edx
cmp esi, 0x20
push 0
push ebx
sete dl
push 0
lea eax, [edi + 0x37]
push edx
push eax
push edi
call fcn.0040a040
mov ecx, esi
lea esi, [esi + esi + 0x30]
sar ecx, 0x2d
xor edi, ecx
test esi, edi
je 0x40e7c6
lea edx, [edi + edi*2]
or esi, 0xffffffcf
shl edx, 4
sub edx, edi
xor edi, 0xffffffda
push edx
push esi
push edi
push 0
push 1
call fcn.00414160
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret