Function at 0x41e060
Capabilities:
Create thread
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xae8
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push 0x9c
mov dword [ebp - 0xad0], eax
lea eax, [ebp - 0xac8]
push 0
push eax
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xadc], 0x410
call fcn.0042bf20
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [ebp - 0xac8], 0x9c
mov dword [ebp - 0xac4], 5
mov dword [ebp - 0xac0], 1
push 3
push 2
push 0
push 0
call esi
push 3
push 1
push edx
push eax
call esi
push edx
push eax
push 3
lea eax, [ebp - 0xac8]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x41e326
push edi
push str.Map_User_Drives_n
push 2
call fcn.0041a380
mov edi, dword [ebp + 0xc]
add esp, 8
test ebx, ebx
je 0x41e146
test edi, edi
jne 0x41e146
push str.Mapping_User_Drives..._n
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00427b16
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41e133
sub ecx, edx
lea eax, [ebp - 0x20c]
push ecx
push eax
call ebx
lea eax, [ebp - 0xadc]
push eax
lea eax, [ebp - 0xa2c]
push eax
push dword [ebp - 0xad0]
call fcn.0041f8a0
add esp, 0xc
test eax, eax
je 0x41e306
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push str._sNetwork
push eax
call fcn.00419670
add esp, 0xc
lea eax, [ebp - 0xacc]
push eax
push 8
push 0
lea eax, [ebp - 0x61c]
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41e1c7
push eax
push str.Unable_to_open_network_key_rc___d_n
push 2
call fcn.0041a380
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xae8]
mov dword [ebp - 0xad4], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xad4]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push dword [ebp - 0xacc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
mov ebx, 1
push esi
push str.rc_for_first_enum___d_n
push 2
mov dword [ebp - 0xad0], ebx
call fcn.0041a380
add esp, 0xc
test esi, esi
jne 0x41e2e9
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test edi, edi
je 0x41e28b
push pe_nt_image_headers32
call fcn.00427138
add esp, 4
mov ebx, eax
push 2
push 0
push 0
push ebx
call esi
push eax
push dword [ebp - 0xacc]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
lea eax, [ebp - 0xae0]
mov ecx, 0x41
push eax
push 0
push ebx
push 0x41dd80
push 0
lea edi, [ebx + 4]
lea esi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [ebp - 0xad0]
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x41e2a6
push dword [ebp - 0xad8]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0xacc]
call fcn.0041dab0
add esp, 0xc
lea ecx, [ebp - 0xae8]
mov dword [ebp - 0xad4], 0x104
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0xad4]
mov eax, ebx
push ecx
lea ecx, [ebp - 0x108]
inc ebx
push ecx
push eax
push dword [ebp - 0xacc]
mov dword [ebp - 0xad0], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x41e225
push dword [ebp - 0xacc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
push str.Unable_to_get_text_SID_n
push 2
call fcn.0041a380
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
push str.Dont_map_drives_in_W2K_or_less_n
push 2
call fcn.0041a380
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
pop ebx
call fcn.004265fb
mov esp, ebp
pop ebp
ret