Function at 0x1004afc0
Capabilities:
Get hostname
Get session user name
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1704
call fcn.10001ba0
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x64
push eax
lea eax, [ebp - 0x2f0]
mov edi, ecx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1004affe
lea eax, [ebp - 0x2f0]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
mov dword [ebp - 0x10], 0x104
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x228]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
test eax, eax
je 0x1004b0ee
cmp dword [0x1005e664], 0
jne 0x1004b071
push 0x105
push dword [0x1005dbf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005e664], eax
test eax, eax
je 0x1004b071
push 0x104
lea ecx, [ebp - 0x4f8]
push ecx
push 0
push 0
call eax
mov ebx, dword [edi + 0x14]
lea eax, [ebp - 4]
push eax
push 0x1004fae0
push 0
lea eax, [ebp - 0x4f8]
mov dword [ebp - 8], 0
push eax
mov dword [ebp - 4], 0
call esi
test eax, eax
jne 0x1004b0d0
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
push edx
push 0x1004f684
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jne 0x1004b0c3
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
push edx
push 8
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x1004b0d0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
test ecx, ecx
je 0x1004b0e0
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
test esi, esi
jne 0x1004b368
mov esi, dword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push dword [ebp - 0x1c]
lea eax, [ebp - 0xf00]
push str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationLogonUISessionData_d
push eax
call fcn.1001b2b0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea eax, [ebp - 0xc]
add esp, 0xc
mov dword [ebp - 0xc], 0x800
push eax
lea eax, [ebp - 0x1700]
push eax
push 0
push 2
push str.LoggedOnUserSID
lea eax, [ebp - 0xf00]
push eax
push reloc.SHELL32.dll_SHChangeNotifyRegister
call ebx
test eax, eax
jne 0x1004b24d
lea eax, [ebp - 0x1700]
push eax
lea eax, [ebp - 0xf00]
push str.SOFTWAREMicrosoftWindowsCurrentVersionAccountPictureUsers_s
push eax
call fcn.1001b2b0
add esp, 0xc
mov dword [ebp - 0xc], 0x800
lea eax, [ebp - 0xe8]
push dword [edi + 0x14]
push str.Image_d
push eax
call fcn.1004c150
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1700]
push eax
push 0
push 2
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0xf00]
push eax
push reloc.SHELL32.dll_SHChangeNotifyRegister
call ebx
test eax, eax
je 0x1004b1d0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1700]
push eax
push 0
push 2
push str.Image192
lea eax, [ebp - 0xf00]
push eax
push reloc.SHELL32.dll_SHChangeNotifyRegister
call ebx
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
push 0x1004fae0
push 0
lea eax, [ebp - 0x1700]
mov dword [ebp - 0x10], 0
push eax
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x1004b235
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
push edx
push 0x1004f684
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jne 0x1004b228
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 0x14]
push 8
mov ecx, dword [eax]
push edx
push edx
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
test eax, eax
je 0x1004b235
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
test ecx, ecx
je 0x1004b245
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
test esi, esi
jne 0x1004b368
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0xc8
push eax
lea eax, [ebp - 0xe8]
push eax
push 0
push 2
push str.SourceId
push str.SOFTWAREMicrosoftWindowsCurrentVersionAccountPicture
push SHChangeNotifyRegister
call ebx
push 0x104
lea eax, [ebp - 0x4f8]
push eax
push str._APPDATA_MicrosoftWindowsAccountPictures_s.accountpicture_ms
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x4f8]
push eax
lea eax, [ebp - 0x700]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [edi + 0x14]
lea eax, [ebp - 4]
add esp, 0xc
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push eax
push 0x1004fae0
push 0
lea eax, [ebp - 0x700]
push eax
call dword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
test eax, eax
jne 0x1004b30c
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
push edx
push 0x1004f684
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jne 0x1004b2ff
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x10]
push edx
push 8
push esi
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x1004b30c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x1004b31c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test esi, esi
jne 0x1004b368
mov eax, dword [0x1005dc18]
mov ecx, 0xffe6e6e6
test eax, eax
mov esi, 0xff666666
cmovne esi, ecx
or edx, 0xffffffff
test eax, eax
mov ecx, 0xff404040
push esi
cmovne edx, ecx
mov ecx, dword [edi + 0x14]
push edx
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
push 0xe13d
push str.Segoe_MDL2_Assets
mov edx, eax
call fcn.100166a0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret