Function at 0x401e30
Capabilities:
Get session user name
Get user security identifier
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fd3c
mov eax, dword fs:[0]
push eax
mov eax, 0x1a44
call fcn.0043a3c0
mov eax, dword [0x450398]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov edi, ecx
push 0x7fe
push eax
lea ecx, [ebp - 0xa0e]
push ecx
mov dword [ebp - 0x1a1c], edi
mov word [ebp - 0xa10], ax
call fcn.00429770
add esp, 0xc
lea edx, [ebp - 0x1a38]
push edx
lea eax, [ebp - 0xa10]
mov esi, 0x800
push eax
mov dword [ebp - 0x1a38], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [ebp - 0x1a18]
push ecx
mov ecx, 0x4498c4
call fcn.00413b80
lea edx, [ebp - 0x1a18]
push edx
mov dword [ebp - 4], 0
call fcn.00401da0
add esp, 4
test al, al
je 0x401ede
mov eax, dword [ebp - 0x1a18]
cmp dword [eax - 0xc], 0
jne 0x401f0b
lea eax, [ebp - 0xa10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401ee7
sub eax, edx
lea ecx, [ebp - 0xa10]
sar eax, 1
push ecx
lea edx, [ebp - 0x1a18]
push edx
mov ebx, eax
call fcn.00416d10
push 0x7fe
xor ebx, ebx
lea ecx, [ebp - 0x1a0e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x1a10], ax
call fcn.00429770
push 0x7fe
lea eax, [ebp - 0x120e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x1210], dx
call fcn.00429770
add esp, 0x18
lea ecx, [ebp - 0x1a4c]
push ecx
lea edx, [ebp - 0x1a30]
push edx
lea eax, [ebp - 0x1210]
push eax
mov eax, dword [ebp - 0x1a18]
lea ecx, [ebp - 0x1a34]
push ecx
lea edx, [ebp - 0x1a10]
push edx
push eax
push ebx
mov dword [ebp - 0x1a34], esi
mov dword [ebp - 0x1a30], esi
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea ecx, [ebp - 0x1a10]
push edi
push ecx
call fcn.00401d00
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 8
lea edx, [ebp - 0x1a2c]
push edx
push 0x20019
push ebx
push edi
push 0x80000003
call esi
cmp eax, ebx
jne 0x401fc4
mov eax, dword [ebp - 0x1a2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4022b0
lea ecx, [ebp - 0x1a28]
push ecx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push 0x80000002
call esi
cmp eax, ebx
jne 0x4022b0
mov dword [ebp - 0x1a48], ebx
mov dword [ebp - 0x1a44], ebx
mov dword [ebp - 0x1a40], ebx
mov byte [ebp - 4], 1
xor esi, esi
xor edx, edx
push 0x1fe
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.00429770
mov eax, dword [ebp - 0x1a28]
add esp, 0xc
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x1a24]
push ecx
lea edx, [ebp - 0x210]
push edx
push esi
push eax
mov dword [ebp - 0x1a24], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4021d3
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x1a14], ebx
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 2
test ecx, 0xffff0000
jne 0x4020da
mov edx, ecx
movzx edi, dx
call fcn.004196c0
test eax, eax
je 0x40209e
push eax
mov eax, edi
lea edi, [ebp - 0x1a14]
call fcn.00417fa0
mov ebx, dword [ebp - 0x1a14]
mov edi, dword [ebp - 0x1a1c]
mov byte [ebp - 4], 3
mov eax, dword [ebx - 0xc]
cmp eax, 0xa
jge 0x40210f
lea eax, [ebx - 0x10]
inc esi
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401ffd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x401ffd
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4020e3
sub eax, edx
lea ecx, [ebp - 0x210]
sar eax, 1
push ecx
lea edx, [ebp - 0x1a14]
push edx
mov ebx, eax
call fcn.00416d10
mov ebx, dword [ebp - 0x1a14]
jmp 0x4020a4
test edi, edi
je 0x402190
test eax, eax
js 0x402190
push edi
push ebx
call fcn.004282c3
add esp, 8
test eax, eax
je 0x402190
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
je 0x402190
lea ecx, [ebp - 0x1a20]
push ecx
push 0x20019
push 0
push ebx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4021ad
mov edx, edi
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x402152
mov ecx, dword [ebp - 0x1a20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 0xfffffff0
mov byte [ebp - 4], 1
lea edx, [ebx + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x402298
mov ecx, dword [ebx]
push ebx
jmp 0x402291
lea ecx, [ebp - 0x1a14]
lea edi, [ebp - 0x1a48]
call fcn.00414ab0
mov ebx, dword [ebp - 0x1a14]
mov edi, dword [ebp - 0x1a1c]
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4021da
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc esi
jmp 0x401ffd
cmp eax, 0x103
je 0x4021e0
inc esi
jmp 0x401ffd
mov eax, dword [ebp - 0x1a44]
mov esi, dword [ebp - 0x1a48]
sub eax, esi
sar eax, 2
xor ebx, ebx
mov dword [ebp - 0x1a20], eax
test eax, eax
je 0x402298
mov eax, dword [esi + ebx*4]
sub eax, 0x10
call fcn.00416dc0
lea ecx, [ebp - 0x1a24]
push ecx
push 0x20019
push 0
lea edi, [eax + 0x10]
push edi
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402254
lea eax, [edi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402249
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc ebx
cmp ebx, dword [ebp - 0x1a20]
jb 0x402201
jmp 0x402298
mov edx, dword [ebp - 0x1a1c]
mov eax, edi
sub edx, edi
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x402260
mov ecx, dword [ebp - 0x1a24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402298
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x1a28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ebx, [ebp - 0x1a48]
call fcn.00416700
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1a18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4022d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004267a3
mov esp, ebp
pop ebp
ret