Function at 0x103f37e
Capabilities:
Create directory
Get session information
Get session user name
Persist via run registry key

Disassembly:
push 0x4c
mov eax, 0x105fd27
call fcn.0104f320
xor ebx, ebx
mov esi, 0x1068adc
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
call fcn.010309e3
mov dword [ebp - 4], ebx
push esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.010309e3
push esi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.010309e3
push esi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.010309e3
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.010309e3
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 5
call fcn.010309e3
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call fcn.010309e3
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
call fcn.010309e3
push esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 8
call fcn.010309e3
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
call fcn.01046775
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x103f49e
push 0x1004868
push 0x100e1e0
push eax
call fcn.0104a504
add esp, 0xc
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.010303ce
mov byte [ebp - 4], bl
jmp 0x103fa03
push 0x5c
lea ecx, [ebp - 0x30]
call fcn.0103145e
push 0x100e1b8
lea ecx, [ebp - 0x30]
call fcn.01031508
mov esi, 0x1068888
push 0x5c
mov ecx, esi
call fcn.01038b4a
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
call fcn.01034aa7
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xa
call fcn.01031394
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 9
call fcn.010303ce
lea eax, [ebp - 0x30]
push eax
call fcn.01041666
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, ebx
jne 0x103f53d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, ebx
jle 0x103f518
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x103f526
mov dword [ebp - 0x14], 0x80004005
push 0x100e158
push 0x100e134
call esi
push eax
call fcn.0104a5f6
jmp 0x103f43b
push 0x1001b40
lea eax, [ebp - 0x1c]
push eax
call fcn.01046248
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x103f561
push 0x1001af0
push 0x100e114
jmp 0x103f435
push 0x5c
lea ecx, [ebp - 0x1c]
call fcn.01038b4a
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.01034aa7
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xb
call fcn.01031394
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 9
call fcn.010303ce
mov edi, 0x100e0f8
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.01046248
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x103f5b9
push 0x100e0a8
push 0x100e084
jmp 0x103f435
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.010414a3
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x103f5eb
push dword [ebp - 0x30]
push dword [ebp - 0x1c]
push 0x100e030
push 0x100e00c
push eax
call fcn.0104a504
add esp, 0x14
jmp 0x103f43e
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.010414a3
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x103f611
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
push 0x100dfb8
push 0x100df94
jmp 0x103f5dd
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.010414a3
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x103f637
push dword [ebp - 0x30]
push dword [0x1068888]
push 0x100df40
push 0x100df20
jmp 0x103f5dd
push 0x1001b40
lea ecx, [ebp - 0x4c]
call fcn.01031665
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 0xc
call fcn.01042c59
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 9
call fcn.010303ce
cmp dword [ebp - 0x14], ebx
jge 0x103f688
push dword [ebp - 0x30]
push dword [ebp - 0x24]
push 0x100deb8
push 0x100de98
push dword [ebp - 0x14]
jmp 0x103f5de
push 0x100de80
lea ecx, [ebp - 0x4c]
call fcn.01031665
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 0xd
call fcn.01042c59
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 9
call fcn.010303ce
cmp dword [ebp - 0x14], ebx
jge 0x103f6d3
push dword [ebp - 0x30]
push dword [ebp - 0x28]
push 0x100de18
push 0x100ddf8
jmp 0x103f680
push edi
push dword [ebp - 0x30]
mov edi, 0x1003e48
lea eax, [ebp - 0x38]
push edi
push eax
call fcn.0103152e
mov esi, dword [ebp - 0x38]
add esp, 0x10
push dword [0x10688e8]
lea eax, [ebp - 0x18]
push dword [0x10688b4]
push dword [0x10688d8]
push esi
push 0x100dda8
push eax
call fcn.0103152e
add esp, 0x18
mov ecx, 0x1068968
call fcn.0103a4e8
cmp eax, ebx
je 0x103f72b
push 0x1002ca8
lea ecx, [ebp - 0x18]
call fcn.01031508
cmp dword [0x10688f4], ebx
je 0x103f740
push 0x100dd90
lea ecx, [ebp - 0x18]
call fcn.01031508
cmp dword [0x10688fc], ebx
jne 0x103f93d
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x44]
push eax
push 5
push 0xffffffffffffffff
push ebx
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
cmp eax, ebx
jne 0x103f7da
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, ebx
jle 0x103f778
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x103f786
mov dword [ebp - 0x14], 0x80004005
push 0x100dd5c
push 0x100dd3c
call edi
push eax
call fcn.0104a5f6
mov ecx, dword [ebp - 0x24]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.010303ce
lea ecx, [esi - 0x10]
jmp 0x103f47b
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x48]
push eax
push 7
push 0xffffffffffffffff
push ebx
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
cmp eax, ebx
jne 0x103f823
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, ebx
jle 0x103f806
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x103f814
mov dword [ebp - 0x14], 0x80004005
push 0x100dd04
push 0x100dce4
jmp 0x103f790
push dword [ebp - 0x44]
lea eax, [ebp - 0x34]
push dword [ebp - 0x48]
push edi
push eax
call fcn.0103152e
mov edi, dword [ebp - 0x34]
add esp, 0x10
lea eax, [ebp - 0x3c]
push eax
push edi
push ebx
call fcn.01043fb7
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x103f888
push edi
push 0x100dc98
push 0x100dc78
push eax
call fcn.0104a504
add esp, 0x10
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.010303ce
lea ecx, [edi - 0x10]
jmp 0x103f7c2
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x3c]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp eax, ebx
jne 0x103f8d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x103f8ac
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x14], eax
jl 0x103f8ba
mov dword [ebp - 0x14], 0x80004005
push 0x100dc3c
push 0x100dc1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104a5f6
add esp, 0xc
jmp 0x103f85f
push dword [ebp - 0x40]
lea eax, [ebp - 0x20]
push 0x100dbb0
push eax
call fcn.0103152e
add esp, 0xc
push dword [ebp - 0x18]
push 0x100db98
push dword [ebp - 0x20]
push 0x80000003
call fcn.01044ae9
cmp eax, ebx
jge 0x103f957
push 0x100db30
lea ecx, [ebp - 0x20]
call fcn.010313eb
push dword [ebp - 0x18]
push 0x100db98
push dword [ebp - 0x20]
push 0x80000002
call fcn.01044ae9
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x103f957
push 0x100daf8
push 0x100dad8
push eax
call fcn.0104a504
jmp 0x103f8d0
push dword [ebp - 0x18]
push 0x100dab8
push 0x100ca78
push 0x80000002
call fcn.01044ae9
mov edi, dword [ebp - 0x34]
push 1
push 1
push 0x100dab4
push 0x100da28
push 0x80000002
call fcn.010449fb
cmp eax, ebx
mov dword [ebp - 0x14], eax
jge 0x103f979
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.010303ce
lea ecx, [edi - 0x10]
call fcn.010303ce
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.010303ce
lea ecx, [esi - 0x10]
call fcn.010303ce
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.010303ce
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.010303ce
mov dword [ebp - 4], ebx
jmp 0x103fa03
cmp dword [ebp - 0x14], ebx
jge 0x103fa36
push 0x100dab4
push 0x100da28
mov esi, 0x80000002
push esi
call fcn.01044be0
push 0x100db98
push 0x100db30
push esi
call fcn.01044be0
lea eax, [ebp - 0x30]
push eax
call fcn.01041666
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x40]
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x44]
call sub.WTSAPI32.dll_WTSFreeMemory
push dword [ebp - 0x48]
call sub.WTSAPI32.dll_WTSFreeMemory
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.010303ce
mov eax, dword [ebp - 0x14]
call fcn.0104f3d4
ret