Function at 0x44f914
Capabilities:
Get session user name
Persist via run registry key

Disassembly:
push 0x18
mov eax, 0x4571c5
call fcn.004537dc
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
cmp edi, ebx
je 0x44ffa7
cmp dword [ebp + 0xc], ebx
je 0x44ffa7
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push ebx
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 0xc]
push edi
call fcn.0044f58d
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x44ffaa
cmp dword [ebp - 0x18], ebx
jne 0x44ffaa
mov esi, 0x3f40
push esi
call sub.mfc100u.dll_new
mov ebx, eax
pop ecx
mov dword [ebp + 8], ebx
test ebx, ebx
je 0x44ffa7
push esi
push 0
push ebx
call sub.MSVCR100.dll_memset
mov ecx, dword [ebp + 0xc]
mov esi, dword [sym.imp.MSVCR100.dll_wcslen]
xor eax, eax
mov word [ecx], ax
mov word [ebx], ax
mov ebx, str._DOCSETTINGS_
push ebx
call esi
push eax
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll__wcsnicmp]
push edi
call ebx
add esp, 0x1c
test eax, eax
jne 0x44fae6
mov ebx, dword [sym.imp.MSVCR100.dll_wcsncpy]
mov dword [ebp - 0x1c], 0x104
cmp dword [ebp + 0x14], eax
jne 0x44fa26
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
push str.Personal
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.0044ead9
add esp, 0x14
test eax, eax
jne 0x44fa26
mov eax, dword [ebp + 0x10]
dec eax
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call ebx
push str._DOCSETTINGS_
call esi
lea eax, [edi + eax*2]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044cd4b
mov eax, dword [ebp + 8]
add esp, 0x1c
cmp word [eax], 0
jne 0x44ff99
call fcn.0044e361
test eax, eax
je 0x44ff99
push 0x10
call sub.mfc100u.dll_new
pop ecx
mov dword [ebp - 0x20], eax
and dword [ebp - 4], 0
test eax, eax
je 0x44fa52
mov ecx, eax
call fcn.0044ec1f
mov dword [ebp - 0x14], eax
jmp 0x44fa56
and dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
test ecx, ecx
jne 0x44fa6d
mov dword [ebp - 0x10], 0xfffffffd
jmp 0x44ff99
push str.avscan.exe
push 0
call fcn.0044ec5d
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x44fa97
call fcn.0044ec2f
push dword [ebp - 0x14]
call sub.mfc100u.dll_delete
pop ecx
or dword [ebp - 0x10], 0xffffffff
jmp 0x44ff99
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.0044edcd
push 0x1f9f
test eax, eax
je 0x44fab5
push eax
push dword [ebp + 0xc]
call ebx
add esp, 0xc
jmp 0x44fad6
push dword [ebp + 8]
push dword [ebp + 0xc]
call ebx
push str._DOCSETTINGS_
call esi
lea eax, [edi + eax*2]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044cd4b
add esp, 0x1c
mov ecx, dword [ebp - 0x14]
call fcn.0044ec2f
push dword [ebp - 0x14]
jmp 0x44fe59
push str._INSTALLDIR_
call esi
push eax
push str._INSTALLDIR_
push edi
call ebx
add esp, 0x10
test eax, eax
jne 0x44fb55
push 0x1fa0
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x44fa8e
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebx - 1]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
push str._INSTALLDIR_
call esi
lea eax, [edi + eax*2]
push eax
push ebx
push dword [ebp + 0xc]
call fcn.0044cd4b
add esp, 0x1c
jmp 0x44ff99
push str._PROGRAMMFILES_
call esi
push eax
push str._PROGRAMMFILES_
push edi
call ebx
add esp, 0x10
test eax, eax
jne 0x44fbb3
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1c], 0x1fa0
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.0044ead9
add esp, 0x14
test eax, eax
jne 0x44fa8e
mov ebx, dword [ebp + 0x10]
lea eax, [ebx - 1]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
push str._PROGRAMMFILES_
jmp 0x44fb3e
push str._PROGRAMFILES_
call esi
push eax
push str._PROGRAMFILES_
push edi
call ebx
add esp, 0x10
test eax, eax
jne 0x44fc14
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1c], 0x1fa0
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.0044ead9
add esp, 0x14
test eax, eax
jne 0x44fa8e
mov ebx, dword [ebp + 0x10]
lea eax, [ebx - 1]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
push str._PROGRAMFILES_
jmp 0x44fb3e
push str._ALLUSERS_
call esi
push eax
push str._ALLUSERS_
push edi
call ebx
add esp, 0x10
test eax, eax
jne 0x44fce9
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
mov edi, str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList
push str.ProfilesDirectory
push edi
mov ebx, 0x80000002
push ebx
mov dword [ebp - 0x1c], 0x1fa0
call fcn.0044ead9
add esp, 0x14
test eax, eax
jne 0x44fa8e
push 0x800
call dword [sym.imp.MSVCR100.dll_malloc]
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44fa8e
push dword [ebp + 8]
call esi
push dword [ebp + 0x14]
mov esi, eax
push esi
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.0044f914
add esp, 0x14
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x44ff99
dec esi
push esi
push dword [ebp - 0x14]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
push dword [ebp + 0xc]
call fcn.0044cda5
push dword [ebp - 0x14]
call dword [sym.imp.MSVCR100.dll_free]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
push str.AllUsersProfile
push edi
push ebx
call fcn.0044ead9
add esp, 0x28
test eax, eax
jne 0x44fa8e
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044cd4b
jmp 0x44ff96
push str._LOCALUSER_
call esi
push eax
push str._LOCALUSER_
push edi
call ebx
add esp, 0x10
test eax, eax
jne 0x44fe64
xor ebx, ebx
mov dword [ebp - 0x1c], 0x1fa0
cmp dword [ebp + 0x14], ebx
jne 0x44fdc0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
push str.ProfilesDirectory
push str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList
push 0x80000002
call fcn.0044ead9
add esp, 0x14
test eax, eax
jne 0x44fa8e
mov ebx, 0x800
push ebx
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x44fa8e
push dword [ebp + 8]
call esi
push 0
push eax
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
call fcn.0044f914
add esp, 0x14
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x44ff99
mov eax, dword [ebp - 0x14]
dec eax
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
push dword [ebp + 0xc]
call fcn.0044cda5
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x44fa8e
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044cd4b
push edi
call dword [sym.imp.MSVCR100.dll_free]
add esp, 0x10
jmp 0x44ff99
push 0x10
call sub.mfc100u.dll_new
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 1
cmp eax, ebx
je 0x44fddf
mov ecx, eax
call fcn.0044ec1f
mov ebx, eax
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x44fa61
push str.avscan.exe
push 0
mov ecx, ebx
call fcn.0044ec5d
mov ecx, ebx
test eax, eax
je 0x44fe0a
call fcn.0044ec2f
push ebx
jmp 0x44fa88
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.0044edcd
push 0x1f9f
test eax, eax
je 0x44fe2c
push eax
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
jmp 0x44fe51
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
push str._DOCSETTINGS_
call esi
lea eax, [edi + eax*2]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0044cd4b
add esp, 0x1c
mov ecx, ebx
call fcn.0044ec2f
push ebx
call sub.mfc100u.dll_delete
pop ecx
jmp 0x44ff99
push str._MYMUSIC_
call esi
push eax
push str._MYMUSIC_
push edi
call ebx
add esp, 0x10
test eax, eax
jne 0x44fec5
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1c], 0x1fa0
push str.My_Music
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.0044ead9
add esp, 0x14
test eax, eax
jne 0x44fa8e
mov ebx, dword [ebp + 0x10]
lea eax, [ebx - 1]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
push str._MYMUSIC_
jmp 0x44fb3e
push str._MYVIDEOS_
call esi
push eax
push str._MYVIDEOS_
push edi
call ebx
add esp, 0x10
test eax, eax
jne 0x44ff26
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1c], 0x1fa0
push str.My_Video
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.0044ead9
add esp, 0x14
test eax, eax
jne 0x44fa8e
mov ebx, dword [ebp + 0x10]
lea eax, [ebx - 1]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
push str._MYVIDEOS_
jmp 0x44fb3e
push str._MYPICTURES_
call esi
push eax
push str._MYPICTURES_
push edi
call ebx
add esp, 0x10
test eax, eax
jne 0x44ff87
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x20], 0x1fa0
push str.My_Pictures
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.0044ead9
add esp, 0x14
test eax, eax
jne 0x44fa8e
mov ebx, dword [ebp + 0x10]
lea eax, [ebx - 1]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
push str._MYPICTURES_
jmp 0x44fb3e
mov eax, dword [ebp + 0x10]
dec eax
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
push dword [ebp + 8]
call sub.mfc100u.dll_delete
mov eax, dword [ebp - 0x10]
pop ecx
jmp 0x44ffaa
or eax, 0xffffffff
call fcn.004538b4
ret