Function at 0x10006370
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004124d
mov eax, dword fs:[0]
push eax
sub esp, 0xb74
mov eax, dword [0x1005400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xb24], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0xb80], edi
mov dword [ebp - 0xb7c], 0
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x100067bf
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xb20], esi
mov dword [ebp - 4], 1
xor ecx, ecx
mov dword [edi], 0
mov dword [ebp - 0xb3c], 7
mov dword [ebp - 0xb38], 0x7f006f
mov dword [ebp - 0xb34], 0x750060
mov dword [ebp - 0xb30], 0x670073
mov dword [ebp - 0xb2c], 0x350075
nop dword [eax + eax]
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0xb38], ax
inc ecx
mov eax, dword [ebp - 0xb3c]
cmp ecx, eax
jb 0x10006420
xor ecx, ecx
mov word [ebp + eax*2 - 0xb38], cx
lea eax, [ebp - 0xb38]
push eax
call fcn.100278ef
add esp, 4
mov ebx, eax
call fcn.10011a50
mov ecx, eax
test ecx, ecx
je 0x100067c9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 2
test ebx, ebx
je 0x100064a1
test ebx, 0xffff0000
jne 0x10006487
movzx eax, bx
mov ecx, edi
push eax
call fcn.1000da30
jmp 0x100064ac
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006490
sub ecx, edx
sar ecx, 1
jmp 0x100064a3
xor ecx, ecx
push ecx
push ebx
mov ecx, edi
call fcn.1000dcb0
mov byte [ebp - 4], 1
mov ecx, edi
mov dword [ebp - 0xb7c], 1
call fcn.1000b2a0
test al, al
je 0x10006785
lea eax, [ebp - 0xb24]
mov dword [ebp - 0xb24], 0x400
push eax
lea eax, [ebp - 0xb1c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [ebp - 0xb78], 0x1b
xor ecx, ecx
mov dword [ebp - 0xb74], 0x15006d
mov dword [ebp - 0xb70], 0x64006c
mov dword [ebp - 0xb6c], 0x560041
mov dword [ebp - 0xb68], 0x460046
mov dword [ebp - 0xb64], 0x12006a
mov dword [ebp - 0xb60], 0x65004b
mov dword [ebp - 0xb5c], 0x4b007b
mov dword [ebp - 0xb58], 0x79004c
mov dword [ebp - 0xb54], 0x4b005f
mov dword [ebp - 0xb50], 0x1d0021
mov dword [ebp - 0xb4c], 0x2c0010
mov dword [ebp - 0xb48], 0x280025
mov dword [ebp - 0xb44], 0x29002f
mov dword [ebp - 0xb40], 0x49002f
nop
lea eax, [ecx + 0x2e]
xor word [ebp + ecx*2 - 0xb74], ax
inc ecx
mov eax, dword [ebp - 0xb78]
cmp ecx, eax
jb 0x10006580
xor ecx, ecx
mov word [ebp + eax*2 - 0xb74], cx
lea eax, [ebp - 0xb1c]
push eax
lea eax, [ebp - 0xb74]
push eax
lea eax, [ebp - 0xb20]
push eax
call fcn.1000dfc0
mov esi, dword [ebp - 0xb20]
push 0
push esi
call fcn.10027378
add esp, 0x14
test eax, eax
jne 0x10006625
mov ebx, dword [edi]
lea ecx, [esi - 0x10]
sub ebx, 0x10
cmp ecx, ebx
je 0x10006785
cmp dword [ebx + 0xc], eax
jl 0x1000661c
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x1000661c
call fcn.1000dbd0
mov dword [ebp - 0xb28], eax
lea edx, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10006612
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0xb28]
add eax, 0x10
mov dword [edi], eax
jmp 0x10006785
push dword [esi - 0xc]
push esi
jmp 0x1000677e
lea eax, [ebp - 0xb28]
mov dword [ebp - 0xb28], 0
push eax
push 0
push 0x8000
push 0x10043280
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jne 0x100066e0
push 0x104
push dword [ebp - 0xb28]
lea eax, [ebp - 0x114]
push eax
call fcn.10027cc8
add esp, 0xc
lea eax, [ebp - 0x114]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ebx, [eax - 1]
test ebx, ebx
jle 0x100066d4
mov ecx, dword [edi]
mov edx, 1
mov eax, dword [ecx - 8]
sub edx, dword [ecx - 4]
sub eax, ebx
or eax, edx
jge 0x100066a3
push ebx
mov ecx, edi
call fcn.1000de60
push ebx
push dword [edi]
lea eax, [ebp - 0x114]
push 0xffffffffffffffff
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [edi]
cmp ebx, dword [eax - 8]
jg 0x100067d3
mov dword [eax - 0xc], ebx
xor ecx, ecx
mov eax, dword [edi]
mov word [eax + ebx*2], cx
jmp 0x10006785
mov ecx, edi
call fcn.1000c9c0
jmp 0x10006785
push 0
push 0x1a
lea eax, [ebp - 0x31c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x1000675e
push eax
push eax
push 0xffffffffffffffff
push 0x1004ed3c
push eax
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ebx, [eax - 1]
test ebx, ebx
jle 0x10006757
mov ecx, dword [edi]
mov edx, 1
mov eax, dword [ecx - 8]
sub edx, dword [ecx - 4]
sub eax, ebx
or eax, edx
jge 0x1000672b
push ebx
mov ecx, edi
call fcn.1000de60
push ebx
push dword [edi]
push 0xffffffffffffffff
push 0x1004ed3c
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [edi]
cmp ebx, dword [eax - 8]
jg 0x100067d3
mov dword [eax - 0xc], ebx
xor ecx, ecx
mov eax, dword [edi]
mov word [eax + ebx*2], cx
jmp 0x1000675e
mov ecx, edi
call fcn.1000c9c0
lea ecx, [ebp - 0x31c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006767
sub ecx, edx
lea eax, [ebp - 0x31c]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.1000dcb0
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100067a1
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100154d9
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10011820
push 0x80004005
call fcn.10011820
push 0x80070057
call fcn.10011820
int3