Function at 0x40f819
Capabilities:
Get session user name

Disassembly:
push 0x25c
mov eax, 0x5b4b41
call fcn.0056fe77
mov byte [ebp - 0x21d], dl
mov edi, ecx
mov dword [ebp - 0x22c], edi
mov ebx, dword [ebp + 0x5c]
mov dword [ebp - 0x23c], ebx
push str.begin_HigherSecurityRepairReg__r_n
mov dword [ebp - 4], 3
call fcn.00408e0e
pop ecx
test ebx, ebx
jne 0x40f85c
xor bl, bl
jmp 0x40fc4f
mov esi, dword [ebp + 0x60]
xor eax, eax
mov bl, al
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0x58]
movzx ecx, al
shl ecx, 8
add ecx, 0x20019
cmp esi, 2
jne 0x40f8ae
cmp dword [ebp + 0x74], 0
je 0x40f8ae
cmp dword [ebp + 0x78], 8
lea eax, [ebp + 0x64]
cmovae eax, dword [ebp + 0x64]
jmp 0x40f8b9
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
lea edx, [ebp - 0x21c]
push edx
push ecx
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
je 0x40f8e5
push str.RegOpenKeyEx_Read_error_r_n
call fcn.00408e0e
pop ecx
jmp 0x40fbc6
lea eax, [ebp - 0x234]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x238]
push eax
push 1
push 4
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
je 0x40f913
push str.GetSecurityInfo_OWNER_SECURITY_INFORMATION_error_
jmp 0x40f8da
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x23c]
push 1
push 4
push dword [ebp - 0x21c]
call edi
test eax, eax
je 0x40f935
push str.SetSecurityInfo_OWNER_SECURITY_INFORMATION_error_
jmp 0x40f8da
lea eax, [ebp - 0x230]
xor ecx, ecx
push eax
push ecx
lea eax, [ebp - 0x224]
push eax
push ecx
push ecx
push 4
push 4
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
je 0x40f966
push str.GetSecurityInfo_DACL_SECURITY_INFORMATION_error_
jmp 0x40f8da
push 0x20
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.00586790
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x268], 0xf003f
push 0
push eax
mov dword [ebp - 0x264], 2
mov dword [ebp - 0x260], 3
mov dword [ebp - 0x254], 1
call fcn.00586790
add esp, 0x18
mov dword [ebp - 0x244], 0x104
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x218]
push eax
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
movzx eax, al
test eax, eax
je 0x40f9fd
cmp word [ebp - 0x218], 0
je 0x40f9fd
lea eax, [ebp - 0x218]
mov dword [ebp - 0x250], 1
mov dword [ebp - 0x24c], eax
jmp 0x40fa1c
push str.Cannot_acquire_current_user_name
call fcn.00408e0e
pop ecx
mov dword [ebp - 0x250], 2
mov dword [ebp - 0x24c], str.Authenticated_Users
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x224]
lea eax, [ebp - 0x268]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
je 0x40fa46
push str.SetEntriesInAcl_error
jmp 0x40f8da
xor eax, eax
push eax
push dword [ebp - 0x228]
push eax
push eax
push 4
push 4
push dword [ebp - 0x21c]
call edi
test eax, eax
jne 0x40fbae
test esi, esi
jne 0x40fb0c
push esi
push dword [ebp + 0x58]
lea eax, [ebp + 0x38]
push dword [ebp + 0x54]
push dword [ebp + 0x50]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x23c], esp
push eax
and dword [ecx + 0x10], esi
and dword [ecx + 0x14], esi
call fcn.004098c0
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x248], esp
lea eax, [ebp + 0x20]
push eax
and dword [ecx + 0x10], esi
and dword [ecx + 0x14], esi
call fcn.004098c0
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
lea eax, [ebp + 8]
push eax
and dword [ecx + 0x10], esi
and dword [ecx + 0x14], esi
call fcn.004098c0
mov dl, byte [ebp - 0x21d]
mov ecx, dword [ebp - 0x22c]
mov byte [ebp - 4], 3
call fcn.0040f4f4
cmp dword [ebp + 0x4c], 8
lea edx, [ebp + 0x38]
mov bl, al
lea ecx, [ebp + 8]
cmovae edx, dword [ebp + 0x38]
cmp dword [ebp + 0x1c], 8
movzx eax, bl
cmovae ecx, dword [ebp + 8]
push eax
push edx
push ecx
push str.begin_SetRegValueWorkItemWork_key___ws__value___ws__re___d__r_n
call fcn.00408e0e
add esp, 0x68
jmp 0x40fbae
cmp esi, 1
jne 0x40fb60
sub esp, 0x18
lea eax, [ebp + 0x20]
mov ecx, esp
mov dword [ebp - 0x240], esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.004098c0
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
lea eax, [ebp + 8]
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.004098c0
mov dl, byte [ebp + 0x58]
mov ecx, dword [ebp - 0x22c]
mov byte [ebp - 4], 3
call fcn.0040f6ac
add esp, 0x30
mov bl, al
jmp 0x40fbae
cmp esi, 2
jne 0x40fbae
push 0
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.004098c0
mov dl, byte [ebp + 0x58]
mov ecx, dword [ebp - 0x22c]
call fcn.0040f478
cmp dword [ebp + 0x1c], 8
lea ecx, [ebp + 8]
mov bl, al
cmovae ecx, dword [ebp + 8]
xor eax, eax
test bl, bl
setne al
push eax
push ecx
push str.begin_CreateRegKeyWorkItemWork_key___ws_re___d__r_n
call fcn.00408e0e
add esp, 0x28
push 0
push dword [ebp - 0x224]
push 0
push 0
push 4
push 4
push dword [ebp - 0x21c]
call edi
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x40fbe3
push 0
push 0
push 0
push eax
push 1
push 4
push dword [ebp - 0x21c]
call edi
cmp dword [ebp - 0x230], 0
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x40fbfa
push dword [ebp - 0x230]
call esi
cmp dword [ebp - 0x234], 0
je 0x40fc0b
push dword [ebp - 0x234]
call esi
cmp dword [ebp - 0x228], 0
je 0x40fc1c
push dword [ebp - 0x228]
call esi
cmp dword [ebp - 0x224], 0
je 0x40fc2d
push dword [ebp - 0x224]
call esi
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x40fc3a
push eax
call esi
cmp dword [ebp - 0x21c], 0
je 0x40fc4f
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call fcn.00409db5
lea ecx, [ebp + 0x20]
call fcn.00409db5
lea ecx, [ebp + 0x38]
call fcn.00409db5
lea ecx, [ebp + 0x64]
call fcn.00409db5
mov al, bl
call fcn.0056fe21
ret