Function at 0x414ea0
Capabilities:
Get common file path
Get session user name
Link many functions at runtime
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.C:Program_FilesWW2017CFwmcMemmgr.dll
call esi
xor ebx, ebx
mov dword [0x458238], eax
cmp dword [0x455b20], ebx
jne 0x414ed2
call fcn.00401ad0
lea eax, [ebx + 6]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.C:Program_FilesWW2017CFwmcHook7.dll
call esi
mov ecx, dword [0x458238]
mov dword [0x45823c], eax
cmp ecx, ebx
je 0x415503
cmp eax, ebx
je 0x41551f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.fnSetThreadLocale
push ecx
call esi
mov dword [0x45763c], eax
mov eax, dword [0x458238]
push str.fnGetStringTable
push eax
call esi
mov ecx, dword [0x458238]
push str.fnIRPAlloc
push ecx
mov dword [0x457640], eax
call esi
mov edx, dword [0x458238]
push str.fnIRPFree
push edx
mov dword [0x457560], eax
call esi
mov dword [0x457564], eax
mov eax, dword [0x458238]
push str.fnIRPAllocSourNet
push eax
call esi
mov ecx, dword [0x458238]
push str.fnIRPFreeSourNet
push ecx
mov dword [0x457568], eax
call esi
mov edx, dword [0x458238]
push str.fnIRPSetSourNet
push edx
mov dword [0x45756c], eax
call esi
mov dword [0x457570], eax
mov eax, dword [0x458238]
push str.fnIRPAllocDestNet
push eax
call esi
mov ecx, dword [0x458238]
push str.fnIRPFreeDestNet
push ecx
mov dword [0x457574], eax
call esi
mov edx, dword [0x458238]
push str.fnIRPSetDestNet
push edx
mov dword [0x457578], eax
call esi
mov dword [0x45757c], eax
mov eax, dword [0x458238]
push str.fnIRPAllocPipe
push eax
call esi
mov ecx, dword [0x458238]
push str.fnIRPFreePipe
push ecx
mov dword [0x457584], eax
call esi
mov edx, dword [0x458238]
push str.fnIRPAllocBuf
push edx
mov dword [0x457588], eax
call esi
mov dword [0x45758c], eax
mov eax, dword [0x458238]
push str.fnIRPFreeBuf
push eax
call esi
mov ecx, dword [0x458238]
push str.fnIRPSetBuf
push ecx
mov dword [0x457590], eax
call esi
mov edx, dword [0x458238]
push str.fnIRPAppendBuf
push edx
mov dword [0x457594], eax
call esi
mov dword [0x457598], eax
push str.fnIRPCopyTo
mov eax, dword [0x458238]
push eax
call esi
mov ecx, dword [0x458238]
push str.fnObjectAlloc
push ecx
mov dword [0x4575bc], eax
call esi
mov edx, dword [0x458238]
push str.fnObjectReset
push edx
mov dword [0x4575c0], eax
call esi
mov dword [0x4575c4], eax
mov eax, dword [0x458238]
push str.fnObjectFree
push eax
call esi
mov ecx, dword [0x458238]
push str.fnObjectCopyTo
push ecx
mov dword [0x4575c8], eax
call esi
mov edx, dword [0x458238]
push str.fnObjectSetValueByInt
push edx
mov dword [0x4575cc], eax
call esi
mov dword [0x4575d0], eax
mov eax, dword [0x458238]
push str.fnObjectGetValueByInt
push eax
call esi
mov ecx, dword [0x458238]
push str.fnObjectModifyValueByInt
push ecx
mov dword [0x4575d4], eax
call esi
mov edx, dword [0x458238]
push str.fnObjectSetValueByStringW
push edx
mov dword [0x4575d8], eax
call esi
mov dword [0x4575dc], eax
mov eax, dword [0x458238]
push str.fnObjectAppendValueByStringW
push eax
call esi
mov ecx, dword [0x458238]
push str.fnObjectGetValueSizeByStringW
push ecx
mov dword [0x4575e0], eax
call esi
mov edx, dword [0x458238]
push str.fnObjectGetValueByStringW
push edx
mov dword [0x4575e4], eax
call esi
mov dword [0x4575e8], eax
mov eax, dword [0x458238]
push str.fnObjectSetValueByStringA
push eax
call esi
mov ecx, dword [0x458238]
push str.fnObjectAppendValueByStringA
push ecx
mov dword [0x4575ec], eax
call esi
mov edx, dword [0x458238]
push str.fnObjectGetValueSizeByStringA
push edx
mov dword [0x4575f0], eax
call esi
mov dword [0x4575f4], eax
mov eax, dword [0x458238]
push str.fnObjectGetValueByStringA
push eax
call esi
mov ecx, dword [0x458238]
mov dword [0x4575f8], eax
push str.fnObjectSetValueByByte
push ecx
call esi
mov edx, dword [0x458238]
push str.fnObjectAppendValueByByte
push edx
mov dword [0x4575fc], eax
call esi
mov dword [0x457600], eax
mov eax, dword [0x458238]
push str.fnObjectGetValueSizeByByte
push eax
call esi
mov ecx, dword [0x458238]
push str.fnObjectGetValueByByte
push ecx
mov dword [0x457604], eax
call esi
mov edx, dword [0x458238]
push str.fnObjectSetValueByEmpty
push edx
mov dword [0x457608], eax
call esi
mov dword [0x45760c], eax
mov eax, dword [0x458238]
push str.fnMemoryAllocByStringW
push eax
call esi
mov ecx, dword [0x458238]
push str.fnMemoryResetByStringW
push ecx
mov dword [0x457610], eax
call esi
mov edx, dword [0x458238]
push str.fnMemoryFreeByStringW
push edx
mov dword [0x457614], eax
call esi
mov dword [0x457618], eax
mov eax, dword [0x458238]
push str.fnMemoryAllocByStringA
push eax
call esi
mov ecx, dword [0x458238]
push str.fnMemoryResetByStringA
push ecx
mov dword [0x45761c], eax
call esi
mov edx, dword [0x458238]
push str.fnMemoryFreeByStringA
push edx
mov dword [0x457620], eax
call esi
mov dword [0x457624], eax
mov eax, dword [0x458238]
push str.fnMemoryAllocByByte
push eax
call esi
mov ecx, dword [0x458238]
push str.fnMemoryResetByByte
push ecx
mov dword [0x457628], eax
call esi
mov edx, dword [0x458238]
push str.fnMemoryFreeByByte
push edx
mov dword [0x45762c], eax
call esi
mov dword [0x457630], eax
call fcn.00419350
push eax
mov dword [0x455a8c], eax
call dword [0x45763c]
add esp, 4
call fcn.00418630
call fcn.00418bf0
lea eax, [ebp - 4]
push 0x104
push eax
mov dword [ebp - 4], ebx
call dword [0x457610]
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
push ebx
push ebx
push 0x28
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x4152dd
mov edx, dword [ebp - 4]
mov ecx, str.C:Users_
lea ecx, [ecx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
cmp ax, bx
jne 0x4152a0
mov edx, dword [ebp - 4]
mov eax, edx
mov dword [ebp - 0x14], 0x104
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4152c0
sub eax, esi
sar eax, 1
lea ecx, [ebp - 0x14]
push ecx
lea edx, [edx + eax*2]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [ebp - 4]
push eax
push str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [ebp - 4]
push 0x104
push ecx
call dword [0x457618]
add esp, 8
xor eax, eax
movzx ecx, word [eax + str.User]
mov word [eax + 0x45829c], cx
add eax, 2
cmp cx, bx
jne 0x415300
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0x400
push 0x457648
call esi
push 0x400
push 0x457678
call esi
push 0x400
push 0x4576c0
call esi
push 0x400
push 0x4576d8
call esi
push 0x400
push 0x4576f0
call esi
push 0x400
push 0x457708
call esi
push 0x400
push 0x457720
call esi
push 0x400
push 0x4574e8
call esi
push 0x400
push 0x457500
call esi
push 0x400
push 0x457518
call esi
push 0x400
push 0x457530
call esi
push 0x400
push 0x4574b4
call esi
push 0x400
push 0x457548
call esi
push 0x400
push 0x4574cc
call esi
mov eax, 0x414e60
mov dword [0x4574e4], eax
mov dword [0x457644], eax
xor eax, eax
jmp 0x4153e0
mov cl, byte [eax + str.wmcPipeUser7]
mov byte [eax + 0x458240], cl
inc eax
cmp cl, bl
jne 0x4153e0
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, 0x458240
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x415410
mov ecx, dword [ebp - 0x10]
sub eax, edx
push 0xa
lea eax, [eax + 0x458240]
push eax
push ecx
call fcn.00437063
add esp, 0xc
call fcn.00415540
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], fcn.00401c90
call fcn.00417870
add esp, 4
lea eax, [ebp - 0xc]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktop
push SysReAllocString
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4154b8
mov eax, 4
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push str.LogPixels
push ecx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4154b8
mov eax, dword [ebp - 0x14]
cmp eax, 0x78
jne 0x4154a5
fld qword [0x44f2f0]
jmp 0x4154b2
cmp eax, 0x90
jne 0x4154b8
fld qword [0x44f2e8]
fstp qword [0x455af8]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
call dword [0x457560]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x30], ebx
mov edx, dword [ebp - 8]
lea eax, [ebp - 8]
add esp, 4
push eax
mov dword [edx + 0x34], 0x108
call fcn.00417950
lea ecx, [ebp - 8]
add esp, 4
push ecx
call dword [0x457564]
add esp, 4
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push str.Load_wmcMemmgr_dll_is_failed.
push 6
xor edx, edx
xor ecx, ecx
call fcn.004167d0
add esp, 0xc
cmp dword [0x45823c], ebx
jne 0x415533
push ebx
push str.Load_wmcHook7_dll_is_failed.
push 6
xor edx, edx
xor ecx, ecx
call fcn.004167d0
add esp, 0xc
pop esi
mov eax, 0x100
pop ebx
mov esp, ebp
pop ebp
ret