Function at 0x559899
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x70]
push edi
mov edi, dword [ebp + 8]
push str.begin_HigherSecurityRepairReg__r_n
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x234], esi
call fcn.0050d5ea
xor ebx, ebx
pop ecx
cmp esi, ebx
jne 0x559918
mov byte [ebp - 0x20d], bl
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp + 0xc]
call fcn.004053e5
push ebx
push esi
lea ecx, [ebp + 0x2c]
call fcn.004053e5
push ebx
push esi
lea ecx, [ebp + 0x48]
call fcn.004053e5
push ebx
push esi
lea ecx, [ebp + 0x78]
call fcn.004053e5
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x20d]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret
mov byte [ebp - 0x20d], bl
mov dword [ebp - 0x214], ebx
mov ecx, 0x20019
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x218], ebx
cmp byte [ebp + 0x6c], bl
je 0x559951
mov ecx, 0x20119
cmp dword [ebp + 0x74], 2
jne 0x559970
cmp dword [ebp + 0x8c], ebx
je 0x559970
cmp dword [ebp + 0x90], 8
mov eax, dword [ebp + 0x7c]
jae 0x55997c
lea eax, [ebp + 0x7c]
jmp 0x55997c
cmp dword [ebp + 0x24], 8
mov eax, dword [ebp + 0x10]
jae 0x55997c
lea eax, [ebp + 0x10]
lea edx, [ebp - 0x214]
push edx
push ecx
push ebx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
cmp eax, ebx
je 0x5599a7
push str.RegOpenKeyEx_Read_error_r_n
call fcn.0050d5ea
pop ecx
jmp 0x559c36
mov edi, dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
lea eax, [ebp - 0x22c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x21c]
push eax
push 1
push 4
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x5599d5
push str.GetSecurityInfo_OWNER_SECURITY_INFORMATION_error_
jmp 0x55999c
push ebx
push ebx
push ebx
push dword [ebp - 0x234]
push 1
push 4
push dword [ebp - 0x214]
call esi
test eax, eax
je 0x5599f5
push str.SetSecurityInfo_OWNER_SECURITY_INFORMATION_error_
jmp 0x55999c
lea eax, [ebp - 0x228]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 4
push 4
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x559a20
push str.GetSecurityInfo_DACL_SECURITY_INFORMATION_error_
jmp 0x55999c
push 8
pop ecx
xor eax, eax
push 2
lea edi, [ebp - 0x254]
rep stosd dword es:[edi], eax
pop edi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 0x254], 0xf003f
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x24c], 3
mov dword [ebp - 0x240], 1
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
mov dword [ebp - 0x230], 0x104
call sub.Secur32.dll_GetUserNameExW
test al, al
jbe 0x559ab3
cmp word [ebp - 0x20c], bx
je 0x559ab3
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x238], eax
jmp 0x559ace
push str.Cannot_acquire_current_user_name
call fcn.0050d5ea
pop ecx
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], str.Authenticated_Users
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x218]
lea eax, [ebp - 0x254]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
je 0x559af8
push str.SetEntriesInAcl_error
jmp 0x55999c
push ebx
push dword [ebp - 0x220]
push ebx
push ebx
push 4
push 4
push dword [ebp - 0x214]
call esi
test eax, eax
jne 0x559c21
cmp dword [ebp + 0x74], ebx
jne 0x559b99
push ebx
push dword [ebp + 0x6c]
lea eax, [ebp + 0x48]
push dword [ebp + 0x68]
push dword [ebp + 0x64]
sub esp, 0x1c
mov ecx, esp
push eax
call fcn.004051c1
sub esp, 0x1c
lea eax, [ebp + 0x2c]
mov ecx, esp
push eax
call fcn.004051c1
push dword [ebp + 0x28]
lea eax, [ebp + 0xc]
sub esp, 0x1c
mov ecx, esp
push eax
call fcn.004051c1
push dword [ebp - 0x224]
call fcn.005596cc
mov edi, dword [ebp + 0x4c]
add esp, 0x6c
cmp dword [ebp + 0x60], 8
mov byte [ebp - 0x20d], al
jae 0x559b71
lea edi, [ebp + 0x4c]
cmp dword [ebp + 0x24], 8
mov eax, dword [ebp + 0x10]
jae 0x559b7d
lea eax, [ebp + 0x10]
movzx ecx, byte [ebp - 0x20d]
push ecx
push edi
push eax
push str.begin_SetRegValueWorkItemWork_key___ws__value___ws__re___d__r_n
call fcn.0050d5ea
add esp, 0x10
jmp 0x559c21
cmp dword [ebp + 0x74], 1
jne 0x559bd4
push dword [ebp + 0x6c]
lea eax, [ebp + 0x2c]
sub esp, 0x1c
mov ecx, esp
push eax
call fcn.004051c1
sub esp, 0x1c
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.004051c1
push dword [ebp - 0x224]
call fcn.005595df
add esp, 0x40
mov byte [ebp - 0x20d], al
jmp 0x559c21
cmp dword [ebp + 0x74], edi
jne 0x559c21
push ebx
push dword [ebp + 0x6c]
lea eax, [ebp + 0xc]
sub esp, 0x1c
mov ecx, esp
push eax
call fcn.004051c1
push dword [ebp - 0x224]
call fcn.00559566
mov edi, dword [ebp + 0x10]
add esp, 0x28
cmp dword [ebp + 0x24], 8
mov byte [ebp - 0x20d], al
jae 0x559c0b
lea edi, [ebp + 0x10]
xor ecx, ecx
cmp al, bl
setne cl
push ecx
push edi
push str.begin_CreateRegKeyWorkItemWork_key___ws_re___d__r_n
call fcn.0050d5ea
add esp, 0xc
push ebx
push dword [ebp - 0x218]
push ebx
push ebx
push 4
push 4
push dword [ebp - 0x214]
call esi
cmp dword [ebp - 0x21c], ebx
je 0x559c53
push ebx
push ebx
push ebx
push dword [ebp - 0x21c]
push 1
push 4
push dword [ebp - 0x214]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x228], ebx
je 0x559c69
push dword [ebp - 0x228]
call edi
cmp dword [ebp - 0x22c], ebx
je 0x559c79
push dword [ebp - 0x22c]
call edi
cmp dword [ebp - 0x220], ebx
je 0x559c89
push dword [ebp - 0x220]
call edi
cmp dword [ebp - 0x218], ebx
je 0x559c99
push dword [ebp - 0x218]
call edi
cmp dword [ebp - 0x21c], ebx
je 0x559ca9
push dword [ebp - 0x21c]
call edi
cmp dword [ebp - 0x214], ebx
je 0x559cbd
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x20d]
mov byte [ebp - 0x20d], al
jmp 0x5598d8