Function at 0x415410
Capabilities:
Compare security identifiers
Get thread local storage value
Get user security identifier
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44dea8
mov eax, dword fs:[0]
push eax
mov eax, 0x1454
call fcn.00438db0
mov eax, dword [0x46d45c]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.00402160
mov dword [ebp - 4], 0
lea eax, [ebp - 0x123c]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x41549a
cmp dword [ebp + 8], 0
je 0x415486
push 0x400
push 3
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004021c0
jmp 0x415988
mov dword [ebp - 0x1230], 0x1000
lea edx, [ebp - 0x1230]
push edx
mov eax, dword [ebp - 0x1230]
push eax
lea ecx, [ebp - 0x122c]
push ecx
push 1
mov edx, dword [ebp - 0x123c]
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x41550b
mov eax, dword [ebp - 0x123c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], 0
je 0x4154f7
push 0x400
push 3
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004021c0
jmp 0x415988
lea edx, [ebp - 0x122c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x123c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x145c]
push ecx
lea edx, [ebp - 0x1240]
push edx
lea eax, [ebp - 0x1454]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0x457b3c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00437999
add esp, 4
mov dword [ebp - 0x1248], eax
lea eax, [ebp - 0x145c]
push eax
lea ecx, [ebp - 0x1240]
push ecx
lea edx, [ebp - 0x1454]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1248]
push ecx
push str.System
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push 0x620
call fcn.00437999
add esp, 4
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x10]
call fcn.00402270
push eax
mov edx, dword [ebp - 0x18]
add edx, 8
push edx
call fcn.004387e0
add esp, 8
push str..Default
mov eax, dword [ebp - 0x18]
add eax, 8
push eax
call fcn.004387e0
add esp, 8
mov ecx, 0x46f858
call fcn.00418a00
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], eax
push str.SYSTEM
push str.NT_AUTHORITY
push 0x457d5c
mov edx, dword [ebp - 0x18]
add edx, 0x210
push edx
call fcn.00438ac1
add esp, 0x10
cmp dword [ebp + 8], 0
je 0x415633
mov eax, dword [ebp - 0x18]
add eax, 0x210
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
push 0x400
push 0xffffffffffffffff
push 3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_InsertMenuW]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x1248]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x41565b
mov ecx, dword [ebp - 0x18]
mov byte [ecx], 1
mov edx, dword [ebp - 0x18]
mov dword [0x46f6ac], edx
jmp 0x415661
mov eax, dword [ebp - 0x18]
mov byte [eax], 0
push str.Config
push 0x46ee10
push 0x457e44
mov ecx, dword [ebp - 0x18]
add ecx, 0x418
push ecx
call fcn.00438ac1
add esp, 0x10
lea edx, [ebp - 0x18]
push edx
mov ecx, 0x46f858
call fcn.00418b30
lea eax, [ebp - 0x1238]
push eax
mov ecx, dword [0x46f464]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
push eax
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList
mov edx, dword [reloc.OLEAUT32.dll_SysReAllocString]
push edx
call fcn.004047c0
add esp, 0x14
test eax, eax
jne 0x415939
mov dword [ebp - 0x1244], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1244]
push ecx
mov edx, dword [ebp - 0x1238]
push edx
call fcn.0041d570
add esp, 0xc
test eax, eax
jne 0x41592c
lea eax, [ebp - 0x1458]
push eax
mov ecx, dword [0x46f464]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
push eax
push 0
lea ecx, [ebp - 0x10]
call fcn.00402270
push eax
mov edx, dword [ebp - 0x1238]
push edx
call fcn.004047c0
add esp, 0x14
test eax, eax
jne 0x415918
mov dword [ebp - 0x1460], 4
lea eax, [ebp - 0x1460]
push eax
lea ecx, [ebp - 0x124c]
push ecx
push 0
push 0
push str.Flags
mov edx, dword [ebp - 0x1458]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41590b
mov eax, dword [ebp - 0x124c]
and eax, 8
jne 0x41590b
lea ecx, [ebp - 0x10]
call fcn.00402270
push eax
call fcn.00415180
add esp, 4
mov dword [ebp - 0x1248], eax
cmp dword [ebp - 0x1248], 0
je 0x41590b
mov dword [ebp - 0x1234], 0x104
mov dword [ebp - 0x1240], 0x104
lea ecx, [ebp - 0x145c]
push ecx
lea edx, [ebp - 0x1240]
push edx
lea eax, [ebp - 0x1454]
push eax
lea ecx, [ebp - 0x1234]
push ecx
lea edx, [ebp - 0x22c]
push edx
mov eax, dword [ebp - 0x1248]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x4158fe
push 0x620
call fcn.00437999
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1460], 0x208
lea ecx, [ebp - 0x1460]
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x418
push edx
push 0
push 0
push str.ProfileImagePath
mov eax, dword [ebp - 0x1458]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4158f2
lea ecx, [ebp - 0x10]
call fcn.00402270
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 8
push ecx
call fcn.004387e0
add esp, 8
mov ecx, 0x46f858
call fcn.00418a00
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], eax
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x1454]
push ecx
push 0x45841c
mov edx, dword [ebp - 0x18]
add edx, 0x210
push edx
call fcn.00438ac1
add esp, 0x10
cmp dword [ebp + 8], 0
je 0x4158b4
mov eax, dword [ebp - 0x18]
add eax, 0x210
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
push 0x400
push 0xffffffffffffffff
push 3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_InsertMenuW]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 0x1248]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4158dc
mov ecx, dword [ebp - 0x18]
mov byte [ecx], 1
mov edx, dword [ebp - 0x18]
mov dword [0x46f6ac], edx
jmp 0x4158e2
mov eax, dword [ebp - 0x18]
mov byte [eax], 0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x46f858
call fcn.00418b30
jmp 0x4158fe
mov edx, dword [ebp - 0x18]
push edx
call fcn.00437abb
add esp, 4
mov eax, dword [ebp - 0x1248]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 0x1458]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x1244]
add edx, 1
mov dword [ebp - 0x1244], edx
jmp 0x4156d2
mov eax, dword [ebp - 0x1238]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SeRestorePrivilege
call fcn.00404280
add esp, 4
test eax, eax
jne 0x415979
cmp dword [ebp + 8], 0
je 0x415968
push 0x400
push 3
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004021c0
jmp 0x415988
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004021c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004376f1
mov esp, ebp
pop ebp
ret