Function at 0x1003f2f7
Capabilities:
Get session user name
Persist via run registry key

Disassembly:
push 0x288
mov eax, 0x100ee8e3
call fcn.10082248
mov esi, ecx
mov edi, str.InstallLocation
lea eax, [ebp - 0x230]
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall6789Zip
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.1005293b
add esp, 0x10
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [esi + 0x7c], bl
jne 0x1003f36e
cmp dword [ebp - 0x220], ebx
ja 0x1003f66d
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall6789Zip
lea eax, [ebp - 0x260]
push SysReAllocString
push eax
call fcn.1005293b
add esp, 0x10
lea ecx, [ebp - 0x230]
push eax
call fcn.10001fe0
lea ecx, [ebp - 0x260]
call fcn.10001ee0
cmp dword [ebp - 0x220], ebx
ja 0x1003f66d
push str.qN7dnSN
push 0x100f5980
lea eax, [ebp - 0x248]
push str.SOFTWARE_s_s
push eax
call fcn.100350d8
push 8
pop edi
cmp dword [ebp - 0x234], edi
lea eax, [ebp - 0x248]
push str.f371bfe2
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 1
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.1005293b
add esp, 0x20
lea ecx, [ebp - 0x230]
push eax
call fcn.10001fe0
lea ecx, [ebp - 0x260]
call fcn.10001ee0
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], bl
call fcn.10001ee0
cmp dword [ebp - 0x220], 0
ja 0x1003f66d
push str.qN7dnSN
push 0x100f5980
lea eax, [ebp - 0x248]
push str.SOFTWARE_s_s
push eax
call fcn.100350d8
cmp dword [ebp - 0x234], edi
lea eax, [ebp - 0x248]
push str.f371bfe2
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 2
push SysReAllocString
push eax
call fcn.1005293b
add esp, 0x20
lea ecx, [ebp - 0x230]
push eax
call fcn.10001fe0
lea ecx, [ebp - 0x260]
call fcn.10001ee0
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], bl
call fcn.10001ee0
cmp dword [ebp - 0x220], 0
ja 0x1003f66d
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.100a25c0
add esp, 0xc
mov dword [ebp - 0x294], 0x104
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push dword [ebp - 0x294]
xor eax, eax
mov dword [ebp - 0x268], ebx
mov word [ebp - 0x278], ax
lea ecx, [ebp - 0x278]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x264], 7
push eax
call fcn.10003260
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 3
push eax
call fcn.10052f11
pop ecx
cmp byte [esi + 0x7c], 0
mov byte [ebp - 4], 4
jne 0x1003f54b
cmp dword [ebp - 0x24c], edi
lea ecx, [ebp - 0x260]
lea eax, [ebp - 0x278]
cmovae ecx, dword [ebp - 0x260]
cmp dword [ebp - 0x264], edi
push ecx
cmovae eax, dword [ebp - 0x278]
push eax
call fcn.100361f3
pop ecx
pop ecx
test al, al
je 0x1003f54b
push ebx
lea eax, [ebp - 0x248]
push 0x1c
push eax
call fcn.10040ac5
add esp, 0xc
lea ecx, [ebp - 0x230]
push eax
call fcn.10001fe0
jmp 0x1003f5b5
lea eax, [ebp - 0x248]
push eax
call fcn.1005309a
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 5
mov dword [esp], str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders_
call fcn.1003768b
cmp dword [ebp - 0x234], edi
lea eax, [ebp - 0x248]
push str.Local_AppData
cmovae eax, dword [ebp - 0x248]
push eax
lea eax, [ebp - 0x290]
push SysStringLen
push eax
call fcn.1005293b
add esp, 0x10
lea ecx, [ebp - 0x230]
push eax
call fcn.10001fe0
lea ecx, [ebp - 0x290]
call fcn.10001ee0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x248]
call fcn.10001ee0
cmp dword [ebp - 0x220], 0
jbe 0x1003f5fa
lea eax, [ebp - 0x230]
push eax
call fcn.1003565b
pop ecx
test eax, eax
jne 0x1003f5ea
push 0x100f58d0
lea ecx, [ebp - 0x230]
call fcn.1003768b
push 0x100f5980
lea ecx, [ebp - 0x230]
call fcn.1003768b
lea ecx, [ebp - 0x260]
call fcn.10001ee0
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], bl
call fcn.10001ee0
cmp dword [ebp - 0x220], 0
ja 0x1003f66d
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.100a25c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.100a50d6
pop ecx
pop ecx
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.10022050
lea eax, [ebp - 0x230]
push eax
call fcn.1003565b
pop ecx
test eax, eax
jne 0x1003f68e
push 0x100f58d0
lea ecx, [ebp - 0x230]
call fcn.1003768b
lea ecx, [ebp - 0x230]
push ecx
lea ecx, [esi + 4]
call fcn.1003440e
lea ecx, [ebp - 0x230]
call fcn.10001ee0
mov al, 1
call fcn.100821f2
ret