Function at 0x1000b2d1
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2d0]
sub esp, 0x344
mov eax, dword [0x100271c0]
xor eax, ebp
mov dword [ebp + 0x2cc], eax
push ebx
push esi
push edi
push 0x400
call fcn.1001096c
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
pop ecx
mov dword [ebp - 0x70], eax
lea eax, [ebp + 0xc8]
push eax
push 0x104
call ebx
push 0x9c
mov byte [ebp + 0x1cc], 0x53
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp + 0x1cd], 0x6f
mov byte [ebp + 0x1ce], 0x66
call esi
mov edi, dword [sym.imp.USER32.dll_GetDC]
push 0xc89
mov byte [ebp + 0x1cf], 0x74
mov byte [ebp + 0x1d0], 0x77
call edi
push 0x41e
push 0x2f7a
mov byte [ebp + 0x1d1], 0x61
mov byte [ebp + 0x1d2], 0x72
mov byte [ebp + 0x1d3], 0x65
mov byte [ebp + 0x1d4], 0x5c
mov byte [ebp + 0x1d5], 0x4d
call dword [sym.imp.USER32.dll_GetClassLongA]
push 0xa1b
mov byte [ebp + 0x1d6], 0x69
call dword [sym.imp.USER32.dll_IsWindowVisible]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x5c]
push eax
call esi
push 0x1da8
mov byte [ebp + 0x1d7], 0x63
mov byte [ebp + 0x1d8], 0x72
mov byte [ebp + 0x1d9], 0x6f
mov byte [ebp + 0x1da], 0x73
mov byte [ebp + 0x1db], 0x6f
call edi
push 0x3c5
mov byte [ebp + 0x1dc], 0x66
mov byte [ebp + 0x1dd], 0x74
mov byte [ebp + 0x1de], 0x5c
mov byte [ebp + 0x1df], 0x49
call edi
mov edi, dword [sym.imp.KERNEL32.dll_FindAtomA]
push str.eezapjp
mov byte [ebp + 0x1e0], 0x6e
call edi
mov byte [ebp + 0x1e1], 0x74
call dword [sym.imp.USER32.dll_GetCursor]
mov byte [ebp + 0x1e2], 0x65
call dword [sym.imp.USER32.dll_GetCursor]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp + 0x1e3], 0x72
mov byte [ebp + 0x1e4], 0x6e
mov byte [ebp + 0x1e5], 0x65
call esi
push 0x1bd2
call dword [sym.imp.USER32.dll_GetDC]
lea eax, [ebp - 0x68]
mov byte [ebp + 0x1e6], 0x74
mov byte [ebp + 0x1e7], 0x20
mov byte [ebp + 0x1e8], 0x45
mov byte [ebp + 0x1e9], 0x78
push eax
lea eax, [ebp - 0x64]
push eax
call esi
push 0x860
mov byte [ebp + 0x1ea], 0x70
mov byte [ebp + 0x1eb], 0x6c
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x400
push 0x2741
mov byte [ebp + 0x1ec], 0x6f
call dword [sym.imp.USER32.dll_GetClassLongA]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp + 0x1ed], 0x72
call esi
push 0x40b
push 0xa28
mov byte [ebp + 0x1ee], 0x65
call dword [sym.imp.USER32.dll_GetClassLongA]
push str.qcwdjsimtkxo
call edi
lea eax, [ebp + 0xc8]
push eax
push 0x104
mov byte [ebp + 0x1ef], 0x72
call ebx
mov byte [ebp + 0x1f0], 0x5c
mov byte [ebp + 0x1f1], 0x49
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp + 0x1f2], 0x6e
call esi
lea eax, [ebp + 0xc8]
push eax
push 0x104
mov byte [ebp + 0x1f3], 0x74
mov byte [ebp + 0x1f4], 0x65
mov byte [ebp + 0x1f5], 0x72
call ebx
push str.kqqnlpckdc
mov byte [ebp + 0x1f6], 0x6e
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0x11a
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + 0x1f7], 0x61
call esi
push 0x11c
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + 0x1f8], 0x74
mov byte [ebp + 0x1f9], 0x69
call esi
push str.upqmruvjqvgnq
mov byte [ebp + 0x1fa], 0x6f
call edi
push 0x126
lea eax, [ebp - 0x64]
push eax
mov byte [ebp + 0x1fb], 0x6e
call esi
push 0x100219e0
mov byte [ebp + 0x1fc], 0x61
mov byte [ebp + 0x1fd], 0x6c
call edi
lea eax, [ebp + 0xc8]
push eax
mov edi, 0x104
push edi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov byte [ebp + 0x1fe], 0
call esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1cc]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000b68c
push 0x2e6b
mov dword [ebp - 0x74], 0x400
mov dword [ebp - 0x68], 1
mov byte [ebp + 0xcc], 0x55
mov byte [ebp + 0xcd], 0x73
call dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp + 0xce], 0x65
mov byte [ebp + 0xcf], 0x72
call esi
lea eax, [ebp - 0x40]
push eax
push edi
call ebx
mov byte [ebp + 0xd0], 0x41
mov byte [ebp + 0xd1], 0x67
call esi
mov esi, dword [ebp - 0x70]
lea eax, [ebp - 0x74]
push eax
push esi
lea eax, [ebp - 0x68]
push eax
push 0
lea eax, [ebp + 0xcc]
push eax
push dword [ebp - 0x6c]
mov byte [ebp + 0xd2], 0x65
mov byte [ebp + 0xd3], 0x6e
mov byte [ebp + 0xd4], 0x74
mov byte [ebp + 0xd5], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000b671
push esi
jmp 0x1000b68f
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1000b66e
mov al, byte [esi]
test al, al
je 0x1000b66e
cmp al, 0x20
je 0x1000b66e
mov eax, esi
jmp 0x1000b697
push dword [ebp - 0x70]
call fcn.10011153
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x2cc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010fcb
add ebp, 0x2d0
leave
ret