Function at 0x41098c
Capabilities:
Delete registry key
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x268], eax
xor ebx, ebx
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x26c], ebx
push eax
push 0x20
mov byte [ebp - 0x239], bl
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x214], 0x500
call dword [0x52b124]
push eax
call dword [0x52b020]
test eax, eax
je 0x410e6d
mov edi, dword [ebp - 0x24c]
lea eax, [ebp - 0x25c]
push eax
push str.SeTakeOwnershipPrivilege
push ebx
call dword [0x52b028]
test eax, eax
je 0x410e6d
mov eax, dword [ebp - 0x25c]
push 2
pop esi
push ebx
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x258]
push ebx
push 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x22c]
push eax
push ebx
push edi
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x220], esi
call dword [0x52b030]
test eax, eax
je 0x410e6d
call dword [0x52b28c]
cmp eax, 0x514
je 0x410e6d
lea eax, [ebp - 0x254]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push esi
lea eax, [ebp - 0x218]
push eax
call dword [0x52b038]
test eax, eax
je 0x410e6d
lea eax, [ebp + 0x44]
push eax
lea esi, [ebp - 0x2d0]
call fcn.0040202c
lea eax, [ebp + 0x28]
push eax
lea esi, [ebp - 0x2b0]
call fcn.0040202c
lea eax, [ebp + 0xc]
push eax
lea esi, [ebp - 0x238]
call fcn.0040202c
mov esi, dword [ebp - 0x254]
cmp esi, ebx
jne 0x410aff
push 1
xor edi, edi
lea esi, [ebp - 0x238]
call fcn.004021a4
push 1
lea esi, [ebp - 0x2b0]
call fcn.004021a4
push 1
lea esi, [ebp - 0x2d0]
call fcn.004021a4
mov byte [ebp - 0x239], bl
jmp 0x410e6d
mov byte [ebp - 0x239], bl
mov dword [ebp - 0x240], ebx
mov ecx, 0x20019
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x248], ebx
cmp byte [ebp + 0x60], bl
je 0x410b38
mov ecx, 0x20119
cmp dword [ebp - 0x224], 8
mov eax, dword [ebp - 0x238]
jae 0x410b4d
lea eax, [ebp - 0x238]
lea edx, [ebp - 0x240]
push edx
push ecx
push ebx
push eax
push dword [ebp - 0x268]
call dword [0x52b010]
test eax, eax
jne 0x410dad
mov edi, dword [0x52b034]
lea eax, [ebp - 0x264]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x244]
push eax
push 1
push 4
push dword [ebp - 0x240]
call edi
test eax, eax
jne 0x410dad
push ebx
push ebx
push ebx
push esi
push 1
push 4
push dword [ebp - 0x240]
call dword [0x52b03c]
test eax, eax
jne 0x410dad
lea eax, [ebp - 0x260]
push eax
push ebx
lea eax, [ebp - 0x248]
push eax
push ebx
push ebx
push 4
push 4
push dword [ebp - 0x240]
call edi
test eax, eax
jne 0x410dad
push 8
pop ecx
push 2
lea edi, [ebp - 0x28c]
rep stosd dword es:[edi], eax
pop edi
push 0x206
mov word [ebp - 0x210], ax
xor esi, esi
lea eax, [ebp - 0x20e]
push ebx
inc esi
push eax
mov dword [ebp - 0x28c], 0xf003f
mov dword [ebp - 0x288], edi
mov dword [ebp - 0x284], 3
mov dword [ebp - 0x278], esi
call fcn.00506540
add esp, 0xc
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
mov dword [ebp - 0x26c], 0x104
call dword [0x52b4a8]
test al, al
je 0x410c64
cmp word [ebp - 0x210], bx
je 0x410c64
lea eax, [ebp - 0x210]
mov dword [ebp - 0x274], esi
mov dword [ebp - 0x270], eax
jmp 0x410c74
mov dword [ebp - 0x274], edi
mov dword [ebp - 0x270], str.Authenticated_Users
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 0x248]
lea eax, [ebp - 0x28c]
push eax
push esi
call dword [0x52b040]
test eax, eax
jne 0x410dad
push ebx
push dword [ebp - 0x250]
push ebx
push ebx
push 4
push 4
push dword [ebp - 0x240]
call dword [0x52b03c]
test eax, eax
jne 0x410d94
cmp dword [ebp + 0x64], ebx
jne 0x410cf2
push dword [ebp + 0x60]
lea eax, [ebp - 0x2b0]
push eax
push dword [ebp - 0x268]
lea ecx, [ebp - 0x2d0]
lea eax, [ebp - 0x238]
call fcn.0041090c
add esp, 0xc
neg eax
sbb al, al
inc al
mov byte [ebp - 0x239], al
jmp 0x410d94
cmp dword [ebp + 0x64], 1
jne 0x410d94
mov eax, dword [ebp - 0x238]
xor ecx, ecx
cmp byte [ebp + 0x60], bl
mov dword [ebp - 0x25c], ebx
sete cl
mov dword [ebp - 0x258], ebx
dec ecx
and ecx, 0x100
add ecx, 0x20006
cmp dword [ebp - 0x224], 8
jae 0x410d32
lea eax, [ebp - 0x238]
push ecx
push eax
push dword [ebp - 0x268]
lea eax, [ebp - 0x25c]
call fcn.0044ef9e
test eax, eax
jne 0x410d7e
cmp dword [ebp - 0x29c], 8
mov eax, dword [ebp - 0x2b0]
jae 0x410d5e
lea eax, [ebp - 0x2b0]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x410d7e
lea esi, [ebp - 0x25c]
call fcn.0044effe
mov al, 1
jmp 0x410d8b
lea esi, [ebp - 0x25c]
call fcn.0044effe
xor al, al
cmp al, bl
sete byte [ebp - 0x239]
push ebx
push dword [ebp - 0x248]
push ebx
push ebx
push 4
push 4
push dword [ebp - 0x240]
call dword [0x52b03c]
cmp dword [ebp - 0x244], ebx
je 0x410dce
push ebx
push ebx
push ebx
push dword [ebp - 0x244]
push 1
push 4
push dword [ebp - 0x240]
call dword [0x52b03c]
mov esi, dword [0x52b198]
cmp dword [ebp - 0x260], ebx
je 0x410de4
push dword [ebp - 0x260]
call esi
cmp dword [ebp - 0x264], ebx
je 0x410df4
push dword [ebp - 0x264]
call esi
cmp dword [ebp - 0x250], ebx
je 0x410e04
push dword [ebp - 0x250]
call esi
cmp dword [ebp - 0x248], ebx
je 0x410e14
push dword [ebp - 0x248]
call esi
cmp dword [ebp - 0x244], ebx
je 0x410e24
push dword [ebp - 0x244]
call esi
cmp dword [ebp - 0x240], ebx
je 0x410e38
push dword [ebp - 0x240]
call dword [0x52b018]
push 1
xor edi, edi
lea esi, [ebp - 0x238]
call fcn.004021a4
push 1
lea esi, [ebp - 0x2b0]
call fcn.004021a4
push 1
lea esi, [ebp - 0x2d0]
call fcn.004021a4
mov al, byte [ebp - 0x239]
mov byte [ebp - 0x239], al
cmp dword [ebp - 0x24c], ebx
je 0x410e81
push dword [ebp - 0x24c]
call dword [0x52b17c]
cmp dword [ebp - 0x254], ebx
je 0x410e95
push dword [ebp - 0x254]
call dword [0x52b044]
push 1
xor edi, edi
lea esi, [ebp + 0xc]
call fcn.004021a4
push 1
lea esi, [ebp + 0x28]
call fcn.004021a4
push 1
lea esi, [ebp + 0x44]
call fcn.004021a4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x239]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
leave
ret