Function at 0x436045
Capabilities:
Get common file path
Get session user name
Get user security identifier
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0xb2c
lea ebp, [esp - 4]
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp + 0xb2c], eax
push 0x2c
mov eax, 0x4a10fc
call fcn.00481d3a
mov esi, 0x4f0348
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov ecx, esi
mov dword [ebp - 0x38], esi
call fcn.00401607
mov edi, 0x206
push edi
lea eax, [ebp + 0x61a]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x34], 1
mov word [ebp + 0x618], bx
call fcn.0047e7d0
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp + 0x618]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4360cc
lea eax, [ebp + 0x618]
push eax
mov ecx, esi
call fcn.004014c5
jmp 0x436298
push 0x103
lea eax, [ebp + 0xa29]
push ebx
push eax
mov dword [ebp - 0x30], 8
mov byte [ebp + 0xa28], bl
call fcn.0047e7d0
push edi
lea eax, [ebp + 0x822]
push ebx
push eax
mov word [ebp + 0x820], bx
call fcn.0047e7d0
push edi
lea eax, [ebp + 0x412]
push ebx
push eax
mov word [ebp + 0x410], bx
call fcn.0047e7d0
mov eax, 0x104
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], eax
add esp, 0x24
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x820]
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x43628a
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 0x410]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0xa28]
push eax
lea eax, [ebp + 0x820]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x43628a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0xa28]
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x43628a
cmp dword [ebp - 0x10], ebx
je 0x436298
push 0x40e
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x14], ebx
mov word [ebp], bx
call fcn.0047e7d0
add esp, 0xc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList_
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x410
call fcn.00401640
xor edi, edi
inc edi
mov dword [ebp - 4], edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.00401250
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
push dword [ebp - 0x1c]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43626e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
push ebx
push ebx
push str.ProfileImagePath
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43626e
push 0x208
lea eax, [ebp]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
test ax, ax
je 0x43626e
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004014c5
mov eax, dword [0x4f0348]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x43624d
dec eax
push eax
mov ecx, esi
call fcn.00412dc3
cmp ax, 0x5c
je 0x43624d
push 0x5c
mov ecx, esi
call fcn.0041357c
lea edi, [ebp - 0x20]
call fcn.0043ada9
cmp dword [ebp - 0x20], 0xb
mov ecx, esi
jne 0x436264
push str.AppDataRoaming_
jmp 0x436269
push str.Application_Data_
call fcn.00401250
cmp dword [ebp - 0x14], ebx
je 0x43627c
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401325
cmp dword [ebp - 0x10], ebx
je 0x436298
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x4f0348]
mov eax, dword [eax - 0xc]
cmp eax, ebx
je 0x4362be
dec eax
push eax
mov ecx, esi
call fcn.00412dc3
cmp ax, 0x5c
je 0x436301
push 0x5c
mov ecx, esi
call fcn.0041357c
jmp 0x436301
lea edi, [ebp - 0x18]
call fcn.00435fc3
push str.User_
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 4], 2
call fcn.00402dca
add esp, 0xc
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.004015ba
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401325
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401325
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xb2c]
xor ecx, ebp
call fcn.0047b9fe
add ebp, 0xb30
leave
ret