Function at 0x411100
Capabilities:
Get session user name
Impersonate user
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4320fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x37c
push ebx
push ebp
push esi
push edi
xor edi, edi
lea ecx, [esp + 0x148]
mov dword [esp + 0x394], 1
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], edi
call fcn.00423a3d
mov eax, dword [0x441ff4]
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
mov byte [esp + 0x394], 2
je 0x4111f1
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x411184
mov ecx, dword [0x441fdc]
cmp dword [ecx], edi
jne 0x4111f1
cmp eax, 3
jle 0x4111f1
call ebx
mov edi, eax
call esi
mov ebp, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x4111a1
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x4111e3
mov eax, dword [0x436030]
push 3
push eax
push 0xfa3
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
mov ecx, dword [esp + 0x3b0]
mov edx, dword [esp + 0x3ac]
push ecx
push edx
push str.Arr_srvs:_get_value_from_current_user_reg__the_path_is__s__the_key_is__s._n
call fcn.0041c506
add esp, 0x1c
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x148]
call fcn.00423fcf
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x14], ebp
jne 0x411298
mov eax, dword [0x441ff4]
test eax, eax
je 0x411710
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 2
je 0x41123c
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x411710
cmp eax, 2
jle 0x411710
call ebx
mov edi, eax
call esi
mov esi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x411259
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x41128b
mov eax, dword [0x436030]
push 2
push eax
push 0xfa7
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
push str.Arr_srvs:_get_value_from_current_user_reg__failed_to_current_user_token._n
call fcn.0041c506
add esp, 0x14
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push esi
jmp 0x41170a
push ebp
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x411330
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x441ff4]
test eax, eax
je 0x411710
mov ecx, dword [0x441fd4]
mov eax, dword [ecx]
cmp eax, 2
je 0x4112e0
mov edx, dword [0x441fdc]
cmp dword [edx], 0
jne 0x411710
cmp eax, 2
jle 0x411710
call ebx
mov edi, eax
call esi
mov ebp, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x4112fb
mov eax, dword [0x441fa0]
mov dword [0x436030], eax
call fcn.0041c4b1
test eax, eax
je 0x411702
mov ecx, dword [0x436030]
push 2
push ecx
push 0xfad
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call esi
push eax
push str.Arr_srvs:_get_value_from_current_user_reg__failed_to_call_ImpersonateLoggedOnUser:__u_n
jmp 0x4116f5
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0x18]
lea eax, [esp + 0x44]
push edx
push eax
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x41167c
mov eax, dword [0x441ff4]
test eax, eax
je 0x4113f4
mov ecx, dword [0x441fd4]
mov eax, dword [ecx]
cmp eax, 3
je 0x41138f
mov edx, dword [0x441fdc]
cmp dword [edx], 0
jne 0x4113f4
cmp eax, 3
jle 0x4113f4
call ebx
mov edi, eax
call esi
mov ebp, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x4113aa
mov eax, dword [0x441fa0]
mov dword [0x436030], eax
call fcn.0041c4b1
test eax, eax
je 0x4113e2
mov ecx, dword [0x436030]
push 3
push ecx
push 0xfb5
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
lea edx, [esp + 0x54]
push edx
push str.Arr_srvs:_get_value_from_current_user_reg__current_user_name:__s_n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push str.SeRestorePrivilege
call fcn.0041d1f0
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x28]
add esp, 4
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
lea eax, [esp + 0x44]
push ecx
push ebp
mov dword [esp + 0x2c], 0x20
mov dword [esp + 0x34], eax
call dword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
jne 0x4114c2
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x441ff4]
test eax, eax
je 0x411710
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 2
je 0x411471
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x411710
cmp eax, 2
jle 0x411710
call ebx
mov edi, eax
call esi
mov ebp, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x41148e
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x411702
mov eax, dword [0x436030]
push 2
push eax
push 0xfc8
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call esi
push eax
push str.Arr_srvs:_get_value_from_current_user_reg__failed_to_call_LoadUserProfile:_u_n
jmp 0x4116f5
mov edx, dword [esp + 0x39c]
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push ecx
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [esp + 0x14], eax
je 0x411594
mov eax, dword [0x441ff4]
test eax, eax
je 0x41157c
mov ecx, dword [0x441fd4]
mov eax, dword [ecx]
cmp eax, 3
je 0x41151b
mov edx, dword [0x441fdc]
cmp dword [edx], 0
jne 0x41157c
cmp eax, 3
jle 0x41157c
call ebx
mov edi, eax
call esi
mov esi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x411536
mov eax, dword [0x441fa0]
mov dword [0x436030], eax
call fcn.0041c4b1
test eax, eax
je 0x41156e
mov ecx, dword [0x436030]
push 3
push ecx
push 0xfd0
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
mov edx, dword [esp + 0x24]
push edx
push str.Arr_srvs:_get_value_from_current_user_reg__failed_to_call_RegOpenKeyEx:__u_n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x40]
push eax
push ebp
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x411710
mov eax, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x3a4]
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x14], eax
mov eax, dword [0x441ff4]
test eax, eax
je 0x411659
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x4115f2
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x411659
cmp eax, 3
jle 0x411659
call ebx
mov edi, eax
call esi
mov esi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x41160f
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x41164b
mov eax, dword [0x436030]
push 3
push eax
push 0xfd9
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push str.Arr_srvs:_get_value_from_current_user_reg_finished__the_value_is__d__the_ret_is__d._n
call fcn.0041c506
add esp, 0x1c
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x40]
push ecx
push ebp
call dword [sym.imp.USERENV.dll_UnloadUserProfile]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x411710
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x441ff4]
test eax, eax
je 0x411710
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 2
je 0x4116ad
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x411710
cmp eax, 2
jle 0x411710
call ebx
mov edi, eax
call esi
mov ebp, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x4116ca
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x411702
mov eax, dword [0x436030]
push 2
push eax
push 0xfba
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call esi
push eax
push str.Arr_srvs:_get_value_from_current_user_reg__failed_to_get_current_user_name:__u_n
call fcn.0041c506
add esp, 8
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebp
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x148]
mov byte [esp + 0x394], 1
call fcn.00423e34
lea ecx, [esp + 0x39c]
mov byte [esp + 0x394], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3a0]
mov dword [esp + 0x394], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x38c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x388
ret