Function at 0x10004ff6
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get session user name
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2d0]
sub esp, 0x340
mov eax, dword [0x100271c0]
xor eax, ebp
mov dword [ebp + 0x2cc], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDC]
push edi
push 0x28f8
mov byte [ebp + 0x1cc], 0x53
call esi
push str.zjqpif
call dword [sym.imp.KERNEL32.dll_FindAtomA]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp + 0xc8]
push eax
mov ebx, 0x104
push ebx
mov byte [ebp + 0x1cd], 0x6f
mov byte [ebp + 0x1ce], 0x66
mov byte [ebp + 0x1cf], 0x74
mov byte [ebp + 0x1d0], 0x77
call edi
push 0x1575
call esi
push 0x426
push 0x1a2e
mov byte [ebp + 0x1d1], 0x61
mov byte [ebp + 0x1d2], 0x72
mov byte [ebp + 0x1d3], 0x65
call dword [sym.imp.USER32.dll_GetClassLongA]
lea eax, [ebp + 0xc8]
push eax
push ebx
mov byte [ebp + 0x1d4], 0x5c
mov byte [ebp + 0x1d5], 0x4d
mov byte [ebp + 0x1d6], 0x69
mov byte [ebp + 0x1d7], 0x63
call edi
push 0x273f
mov byte [ebp + 0x1d8], 0x72
mov byte [ebp + 0x1d9], 0x6f
mov byte [ebp + 0x1da], 0x73
call dword [sym.imp.USER32.dll_IsWindowVisible]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x2eeb
mov byte [ebp + 0x1db], 0x6f
mov byte [ebp + 0x1dc], 0x66
mov byte [ebp + 0x1dd], 0x74
call esi
push 0x13c2
mov byte [ebp + 0x1de], 0x5c
call esi
lea eax, [ebp + 0xc8]
push eax
push ebx
mov byte [ebp + 0x1df], 0x49
mov byte [ebp + 0x1e0], 0x6e
mov byte [ebp + 0x1e1], 0x74
mov byte [ebp + 0x1e2], 0x65
call edi
mov byte [ebp + 0x1e3], 0x72
mov byte [ebp + 0x1e4], 0x6e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [ebp + 0xc8]
push eax
push ebx
mov byte [ebp + 0x1e5], 0x65
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp + 0x1e6], 0x74
call esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x48]
push eax
call esi
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp + 0x1e7], 0x20
lea eax, [ebp - 0x4c]
push eax
call esi
push str.nzuj
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + 0x1e8], 0x45
mov byte [ebp + 0x1e9], 0x78
mov byte [ebp + 0x1ea], 0x70
call esi
push 0x128
lea eax, [ebp - 0x64]
push eax
mov byte [ebp + 0x1eb], 0x6c
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0x124
lea eax, [ebp - 0x60]
push eax
mov byte [ebp + 0x1ec], 0x6f
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0x427
push 0x28d5
mov byte [ebp + 0x1ed], 0x72
call dword [sym.imp.USER32.dll_GetClassLongA]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp + 0x1ee], 0x65
mov byte [ebp + 0x1ef], 0x72
mov byte [ebp + 0x1f0], 0x5c
mov byte [ebp + 0x1f1], 0x49
mov byte [ebp + 0x1f2], 0x6e
mov byte [ebp + 0x1f3], 0x74
mov byte [ebp + 0x1f4], 0x65
call esi
push 0x12d
lea eax, [ebp - 0x68]
push eax
mov byte [ebp + 0x1f5], 0x72
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
mov byte [ebp + 0x1f6], 0x6e
call esi
mov byte [ebp + 0x1f7], 0x61
mov byte [ebp + 0x1f8], 0x74
mov byte [ebp + 0x1f9], 0x69
call dword [sym.imp.USER32.dll_GetCursor]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp + 0x1fa], 0x6f
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x110
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp + 0x1fb], 0x6e
mov byte [ebp + 0x1fc], 0x61
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
lea eax, [ebp + 0xc8]
push eax
push ebx
call edi
push str.lserzafawqne
mov byte [ebp + 0x1fd], 0x6c
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x1cc]
push eax
push closesocket
mov byte [ebp + 0x1fe], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000538d
mov esi, dword [sym.imp.USER32.dll_GetCursor]
call esi
mov byte [ebp + 0xcc], 0x53
call esi
push 0x20fa
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x40c
push 0x12de
mov byte [ebp + 0xcd], 0x75
call dword [sym.imp.USER32.dll_GetClassLongA]
call esi
lea eax, [ebp - 0x40]
push eax
push ebx
mov byte [ebp + 0xce], 0x62
mov byte [ebp + 0xcf], 0x76
mov byte [ebp + 0xd0], 0x65
call edi
mov byte [ebp + 0xd1], 0x72
mov byte [ebp + 0xd2], 0x73
mov byte [ebp + 0xd3], 0x69
call esi
call esi
mov byte [ebp + 0xd4], 0x6f
call esi
push 4
lea eax, [ebp + 0x2d8]
push eax
push 4
push 0
lea eax, [ebp + 0xcc]
push eax
push dword [ebp - 0x70]
mov byte [ebp + 0xd5], 0x6e
mov byte [ebp + 0xd6], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1000538d
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x2cc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010fcb
add ebp, 0x2d0
leave
ret