Function at 0x41ebf5
Capabilities:
Extract resource via kernel32 functions
Get common file path
Get file size
Get session user name
Get user security identifier
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1144
call fcn.00418ea0
mov eax, dword [0x42b4d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor ecx, ecx
cmp dword [0x466ab8], 0x17c
push esi
push edi
mov edi, dword [ebx]
mov esi, edx
mov dword [ebp - 0x1110], ebx
mov dword [ebp - 0x1128], edi
jne 0x41ec55
push ecx
push ecx
push dword [ebp - 0x1110]
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0x1110]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov eax, dword [ebx + 4]
mov dword [ebp - 0x1108], eax
mov eax, 0xc6ef3720
mov dword [ebp - 0x1114], eax
mov dword [ebp - 0x1104], 0xe3edaf7c
and ebx, 0x51091875
add dword [ebp - 0x1104], 0x1c125084
add dword [ebp - 0x1104], 0x9e3779b9
mov eax, dword [ebp - 0x1104]
xor ebx, ebx
cmp dword [0x466ab8], 0x1335
mov dword [ebp - 0x1130], eax
jne 0x41ece4
push 0x30
lea eax, [ebp - 0x104c]
mov dword [ebp - 0x1050], ebx
push ebx
push eax
call fcn.00409110
add esp, 0xc
lea eax, [ebp - 0x1050]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea eax, [ebp - 0x1100]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp dword [0x466ab8], 0x1176
mov eax, dword [esi]
mov dword [ebp - 0x113c], eax
jne 0x41ed37
lea eax, [ebp - 0x111c]
push eax
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push ebx
push ebx
lea eax, [ebp - 0x1118]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
lea eax, [ebp - 0x112c]
push eax
lea eax, [ebp - 0x1008]
push eax
push ebx
push dword [ebp - 0x1110]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryMultipleValuesW]
cmp dword [0x466ab8], 0x90d
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [ebp - 0x1118], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x110c], ecx
mov dword [ebp - 0x112c], eax
jne 0x41ed78
push ebx
lea eax, [ebp - 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov ecx, dword [ebp - 0x110c]
mov ebx, dword [ebp - 0x1108]
mov eax, 0xc6ef3720
mov dword [ebp - 0x1124], 0x20
mov esi, edi
add eax, edi
shl esi, 4
add esi, ecx
mov dword [ebp - 0x1108], eax
cmp dword [0x466ab8], 0xa38
jne 0x41edc3
push dword [ebp - 0x1110]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
xorps xmm0, xmm0
movlpd qword [0x446570], xmm0
mov eax, edi
shr eax, 5
add eax, dword [ebp - 0x112c]
xor eax, dword [ebp - 0x1108]
xor eax, esi
sub ebx, eax
cmp dword [0x466ab8], 0x39
jne 0x41ee21
lea eax, [ebp - 0x1138]
xor esi, esi
push eax
push dword [ebp - 0x1138]
push esi
call dword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
push esi
lea eax, [ebp - 0x808]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_AddAuditAccessObjectAce]
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0x113c]
cmp dword [0x466ab8], 0x8c4
jne 0x41ee63
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_PrepareTape]
lea eax, [ebp - 0x1134]
push eax
lea eax, [ebp - 0x808]
push eax
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov eax, dword [ebp - 0x1114]
add eax, ebx
mov dword [ebp - 0x111c], eax
mov eax, ebx
shr eax, 5
cmp dword [0x466ab8], 0xa40
mov dword [ebp - 0x1108], eax
jne 0x41eefb
push dword [ebp - 0x1134]
lea eax, [ebp - 0x1140]
push eax
lea eax, [ebp - 0xc08]
push eax
lea eax, [ebp - 0x1120]
push eax
push dword [ebp - 0x1120]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
xor eax, eax
lea edi, [ebp - 0x1016]
mov word [ebp - 0x1018], ax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x408]
xor edi, edi
push edi
push eax
push edi
lea eax, [ebp - 0x1018]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [ebp - 0x1128]
mov eax, dword [ebp - 0x1108]
add eax, dword [ebp - 0x1118]
xor eax, dword [ebp - 0x111c]
xor esi, eax
cmp dword [0x466ab8], 0x759
jne 0x41ef3e
lea eax, [ebp - 0x808]
push eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
push 0
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [ebp - 0x1114]
sub edi, esi
sub eax, dword [ebp - 0x1130]
dec dword [ebp - 0x1124]
mov ecx, dword [ebp - 0x110c]
mov dword [ebp - 0x1128], edi
mov dword [ebp - 0x1114], eax
jne 0x41ed8d
mov ecx, dword [ebp - 0x1110]
xor edx, edx
mov eax, dword [0x44556c]
mov dword [ecx], edi
cmp dword [0x466ab8], 0x91
mov dword [ecx + 4], ebx
cmove eax, edx
cmp dword [0x466ab8], 0x1b1
mov dword [0x44556c], eax
jne 0x41efec
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetAce]
xor eax, eax
mov dword [ebp - 0x101c], ebx
lea edi, [ebp - 0x1018]
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x101c]
push eax
push ebx
lea eax, [ebp - 0x408]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
xor eax, eax
mov dword [ebp - 0x110c], eax
lea eax, [ebp - 0x1120]
push eax
push dword [ebp - 0x110c]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405707
mov esp, ebp
pop ebp
ret