Function at 0x401ab0
Capabilities:
Get session user name
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
call fcn.00413dd0
cmp eax, 3
je 0x401d96
mov eax, dword [edi + 0x6c]
xor esi, esi
xor ebx, ebx
cmp eax, esi
je 0x401bc4
lea ecx, [ebp - 0x18]
push ecx
push 1
push esi
call eax
cmp eax, esi
jne 0x401bc4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 8]
push edx
mov ecx, dword [eax]
push ecx
call fcn.00413a20
mov eax, dword [ebp - 0x18]
add esp, 8
lea edx, [ebp - 4]
mov ecx, dword [eax + 4]
push edx
push ecx
call fcn.00413a20
add esp, 8
cmp eax, esi
jne 0x401bc4
mov edi, dword [ebp - 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [ebp - 4]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 2]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, dword [ebp - 4]
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4163d8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ole32.dll_CoTaskMemFree]
push eax
call esi
mov ecx, dword [ebp - 8]
push ecx
call esi
xor esi, esi
cmp ebx, esi
jne 0x401c17
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [ebp - 8]
push edx
push esi
mov dword [ebp - 8], esi
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x401c0f
mov eax, dword [ebp - 8]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x401d80
lea ecx, [ebp - 8]
push ecx
push ebx
call edi
test eax, eax
jne 0x401c0f
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor ebx, ebx
cmp ebx, esi
je 0x401d80
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x10]
mov eax, 1
push edx
push 0xfac
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], al
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], al
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], al
call fcn.00401940
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, esi
jne 0x401c5a
mov dword [ebp - 0x3c], esi
jmp 0x401c7f
push eax
call edi
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.00414820
mov ecx, dword [ebp - 0x10]
mov eax, esp
push esi
push ecx
push eax
call fcn.0040f850
mov dword [ebp - 0x3c], eax
xor esi, esi
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x14]
push edx
push 0xfad
call fcn.00401940
mov eax, dword [ebp - 0x14]
cmp eax, esi
jne 0x401c9c
mov dword [ebp - 0x30], esi
jmp 0x401cc1
push eax
call edi
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.00414820
mov ecx, dword [ebp - 0x14]
mov eax, esp
push esi
push ecx
push eax
call fcn.0040f850
mov dword [ebp - 0x30], eax
xor esi, esi
lea edx, [ebp - 4]
mov ecx, dword [ebp - 0xc]
push edx
push esi
push esi
lea eax, [ebp - 0x3c]
push 3
push eax
push ebx
push ebx
mov dword [ebp - 0x24], ebx
call fcn.00401db0
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x401d56
push esi
push esi
push esi
push esi
mov esi, dword [ebp + 8]
push str.AccessPermission
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401d19
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
mov edx, dword [ebp - 4]
push eax
push edx
push 3
push 0
push str.AccessPermission
push esi
call edi
push 0
push 0
push 0
push 0
push str.LaunchPermission
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401d4c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 3
push 0
push str.LaunchPermission
push esi
call edi
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push eax
call esi
mov ecx, dword [ebp - 0x14]
push ecx
call esi
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0xc]
add esp, 4
lea esp, [ebp - 0x48]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 0xc], 0x80004005
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 0x48]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea esp, [ebp - 0x48]
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4