Function at 0x66c510
Capabilities:
Get session user name
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x692b06
mov eax, dword fs:[0]
push eax
mov eax, 0x146c
call fcn.00673e40
push ebx
push esi
push edi
lea edi, [ebp - 0x1478]
mov ecx, 0x51b
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x6aac14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
push str.ami_sExi
push 0x50
lea ecx, [ebp - 0xb4]
push ecx
call fcn.0067693f
add esp, 0x10
mov dword [ebp - 0x2d0], 0x104
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x2c4]
push ecx
push 2
call sub.Secur32.dll_GetUserNameExW
lea ecx, [ebp - 0x2fc]
call fcn.0066a8d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.0066aa10
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x66c609
mov eax, dword [ebp - 0x308]
push eax
push str.uplS_OSGmqVW6_q5nIVS4eu5nL8JtcynnKxH6sa7irlS4OBmL5Yr8y0l6Nc62i6hSr1mO1d6vj1jaxA5LX13LU5
push 0x75e5
call fcn.00655b80
add esp, 8
push eax
call fcn.00654400
add esp, 8
mov dword [ebp - 0x1474], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0066a930
mov eax, dword [ebp - 0x1474]
jmp 0x66ca5d
lea eax, [ebp - 0x2c4]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.0066af00
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x66c67d
mov eax, dword [ebp - 0x308]
push eax
push 0x1ecb
push 0x52cb
push str.uplS_OSGmqVW6_q5nIVS4eu5nL8JtcynnKxH6sa7irlS4OBmL5Yr8m0kKETD1mKlXr_2wnqRA_20jaRc4a8l6tcta_wgcc
push 0x2b80
call fcn.00655b80
add esp, 0x10
push eax
call fcn.00654400
add esp, 8
mov dword [ebp - 0x1468], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0066a930
mov eax, dword [ebp - 0x1468]
jmp 0x66ca5d
lea ecx, [ebp - 0x2fc]
call fcn.0066b0a0
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x66c6ea
mov eax, dword [ebp - 0x308]
push eax
push 0x9eb
push 0x58c1
push str.uplS_OSGmqVW6_q5nIVS4eu5nL8JtcynnKxH6sa7irlS4OBmL5Yr8m0kKETD1mKlXr_ywmrhB5vus2a5B6uuwl7la7uOmw0W94U
push 0x56d3
call fcn.00655b80
add esp, 0x10
push eax
call fcn.00654400
add esp, 8
mov dword [ebp - 0x145c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0066a930
mov eax, dword [ebp - 0x145c]
jmp 0x66ca5d
lea ecx, [ebp - 0x2fc]
call fcn.0066b250
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x66c757
mov eax, dword [ebp - 0x308]
push eax
push 0x41e2
push 0x71e6
push str.uplS_OSGmqVW6_q5nIVS4eu5nL8JtcynnKxH6sa7irlS4OBmL5Yr8m0kKETD1mKlXr_ywjbla4eimw0W94U
push 0x2170
call fcn.00655b80
add esp, 0x10
push eax
call fcn.00654400
add esp, 8
mov dword [ebp - 0x1450], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0066a930
mov eax, dword [ebp - 0x1450]
jmp 0x66ca5d
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea ecx, [ebp - 0x2fc]
call fcn.0066b510
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x66c7cc
mov eax, dword [ebp - 0x308]
push eax
push 0x6b79
push 0x5a5d
push str.uplS_OSGmqVW6_q5nIVS4eu5nL8JtcynnKxH6sa7irlS4OBmL5Yr8m0kKETD1mKlXr_unkKpU6v3v2ehLhQ
push 0x57d7
call fcn.00655b80
add esp, 0x10
push eax
call fcn.00654400
add esp, 8
mov dword [ebp - 0x1444], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0066a930
mov eax, dword [ebp - 0x1444]
jmp 0x66ca5d
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x2fc]
call fcn.0066bbc0
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x66c841
mov eax, dword [ebp - 0x308]
push eax
push 0x776c
push 0x2215
push str.uplS_OSGmqVW6_q5nIVS4eu5nL8JtcynnKxH6sa7irlS4OBmL5Yr8y0l6Nc62i6hSr1jaVWrqtnK5Gr1mK5H5uC7w0W94U
push 0x2446
call fcn.00655b80
add esp, 0x10
push eax
call fcn.00654400
add esp, 8
mov dword [ebp - 0x1438], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0066a930
mov eax, dword [ebp - 0x1438]
jmp 0x66ca5d
mov eax, dword [ebp + 0xc]
push eax
push str._c_del___s_
push 0x400
lea ecx, [ebp - 0xb10]
push ecx
call fcn.0067693f
add esp, 0x10
lea eax, [ebp - 0xb10]
push eax
push str.cmd.exe
lea ecx, [ebp - 0x2fc]
call fcn.0066bbc0
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x66c8d2
mov eax, dword [ebp - 0x308]
push eax
push 0xcfa
push str.uplS_OSGmqVW6_q5nIVS4eu5nL8JtcynnKxH6sa7irlS4OBmL5Yr8y0l6Nc62i6hSr1jaVWruwlahH6q0mrla4OHv2ehLhQ
push 0x4116
call fcn.00655b80
add esp, 0xc
push eax
call fcn.00654400
add esp, 8
mov dword [ebp - 0x142c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0066a930
mov eax, dword [ebp - 0x142c]
jmp 0x66ca5d
push str._TEMP__task.vbs
lea ecx, [ebp - 0xb34]
call fcn.00603810
mov byte [ebp - 4], 1
lea eax, [ebp - 0xb34]
push eax
call fcn.00669960
add esp, 4
lea ecx, [ebp - 0xb34]
call fcn.00603950
push eax
push str._c_del___s_
push 0x400
lea eax, [ebp - 0x133c]
push eax
call fcn.0067693f
add esp, 0x10
lea eax, [ebp - 0x133c]
push eax
push str.cmd.exe
lea ecx, [ebp - 0x2fc]
call fcn.0066bbc0
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x66c998
mov eax, dword [ebp - 0x308]
push eax
push str.uplS_OSGmqVW6_q5nIVS4eu5nL8JtcynnKxH6sa7irlS4OBmL5Yr8y0l6Nc62i6hSr1jaVWruwlahH6q0mrla4OHv2ehLhQ
push 0x6c28
call fcn.00655b80
add esp, 8
push eax
call fcn.00654400
add esp, 8
mov dword [ebp - 0x1420], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb34]
call fcn.006038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0066a930
mov eax, dword [ebp - 0x1420]
jmp 0x66ca5d
lea ecx, [ebp - 0x2fc]
call fcn.0066b8e0
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jne 0x66ca11
mov eax, dword [ebp - 0x308]
push eax
push 0x1f6d
push 0x2bd1
push str.uplS_OSGmqVW6_q5nIVS4eu5nL8JtcynnKxH6sa7irlS4OBmL5Yr8m0kKETD1iqxF6qhkagT6mkvcTqvff
push 0x25b2
call fcn.00655b80
add esp, 0x10
push eax
call fcn.00654400
add esp, 8
mov dword [ebp - 0x1414], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb34]
call fcn.006038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0066a930
mov eax, dword [ebp - 0x1414]
jmp 0x66ca5d
push str.uplS_OSGmqVW6_q5nIVS4eu5nL8JtcynnKxH6sa7irlS4OBmL5Yr9ygmq5W_Pz02ZlS_OT1irhQ7OqmiqtG4Os2b9W6OamjahB6uv78w
push 0x79ac
call fcn.00655b80
add esp, 8
push eax
call fcn.00654400
add esp, 4
mov dword [ebp - 0x1408], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb34]
call fcn.006038c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.0066a930
mov eax, dword [ebp - 0x1408]
push edx
mov ecx, ebp
push eax
lea edx, [0x66ca98]
call fcn.00673be5
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00673bb3
add esp, 0x1478
cmp ebp, esp
call fcn.00673bc2
mov esp, ebp
pop ebp
ret