Function at 0x1000ae8f
Capabilities:
Contain obfuscated stackstrings
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2e0]
sub esp, 0x34c
mov eax, dword [0x100271c0]
xor eax, ebp
mov dword [ebp + 0x2dc], eax
push ebx
push esi
push edi
push 0x200
call fcn.1001096c
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x44]
mov dword [esp], 0x115
push eax
mov byte [ebp + 0x1dc], 0x53
mov byte [ebp + 0x1dd], 0x6f
call edi
push 0x12c
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + 0x1de], 0x66
mov byte [ebp + 0x1df], 0x74
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x3c]
push eax
call esi
push str.ltmlvwhtpupuou
mov byte [ebp + 0x1e0], 0x77
call dword [sym.imp.KERNEL32.dll_FindAtomA]
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push 0x1e1c
mov byte [ebp + 0x1e1], 0x61
mov byte [ebp + 0x1e2], 0x72
mov byte [ebp + 0x1e3], 0x65
mov byte [ebp + 0x1e4], 0x5c
mov byte [ebp + 0x1e5], 0x4d
call ebx
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0xd8]
push eax
mov byte [ebp + 0x1e6], 0x69
mov byte [ebp + 0x1e7], 0x63
call esi
push 0x1ccb
call dword [sym.imp.USER32.dll_IsWindowVisible]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp + 0x1e8], 0x72
mov byte [ebp + 0x1e9], 0x6f
mov byte [ebp + 0x1ea], 0x73
call esi
push 0x2bc
mov byte [ebp + 0x1eb], 0x6f
call ebx
push str.lkvsvnqxrjzci
mov byte [ebp + 0x1ec], 0x66
mov byte [ebp + 0x1ed], 0x74
mov byte [ebp + 0x1ee], 0x5c
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0x122
lea eax, [ebp - 0x50]
push eax
mov byte [ebp + 0x1ef], 0x49
mov byte [ebp + 0x1f0], 0x6e
mov byte [ebp + 0x1f1], 0x74
call edi
call dword [sym.imp.USER32.dll_GetCursor]
push 0x421
push 0x24d1
mov byte [ebp + 0x1f2], 0x65
mov byte [ebp + 0x1f3], 0x72
mov byte [ebp + 0x1f4], 0x6e
mov byte [ebp + 0x1f5], 0x65
mov byte [ebp + 0x1f6], 0x74
call dword [sym.imp.USER32.dll_GetClassLongA]
push str.anxvhxh
mov byte [ebp + 0x1f7], 0x20
call dword [sym.imp.KERNEL32.dll_FindAtomA]
mov byte [ebp + 0x1f8], 0x45
call dword [sym.imp.USER32.dll_GetCursor]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp + 0x1f9], 0x78
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x416
push 0x2340
mov byte [ebp + 0x1fa], 0x70
mov byte [ebp + 0x1fb], 0x6c
mov byte [ebp + 0x1fc], 0x6f
mov byte [ebp + 0x1fd], 0x72
mov byte [ebp + 0x1fe], 0x65
call dword [sym.imp.USER32.dll_GetClassLongA]
mov byte [ebp + 0x1ff], 0x72
mov byte [ebp + 0x200], 0x5c
call dword [sym.imp.USER32.dll_GetCursor]
push str.spdmwql
mov byte [ebp + 0x201], 0x49
mov byte [ebp + 0x202], 0x6e
mov byte [ebp + 0x203], 0x74
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0x5b3
mov byte [ebp + 0x204], 0x65
mov byte [ebp + 0x205], 0x72
mov byte [ebp + 0x206], 0x6e
mov byte [ebp + 0x207], 0x61
call ebx
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp + 0x208], 0x74
mov byte [ebp + 0x209], 0x69
call esi
push 0xcd9
mov byte [ebp + 0x20a], 0x6f
call ebx
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x44]
push eax
call esi
push 0x108
lea eax, [ebp + 0xd4]
push eax
mov byte [ebp + 0x20b], 0x6e
call edi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x1dc]
push eax
push closesocket
mov byte [ebp + 0x20c], 0x61
mov byte [ebp + 0x20d], 0x6c
mov byte [ebp + 0x20e], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000b269
push 0x109
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x68], 0x200
mov dword [ebp - 0x5c], 1
call edi
mov byte [ebp + 0xdc], 0x41
mov byte [ebp + 0xdd], 0x63
mov byte [ebp + 0xde], 0x63
mov byte [ebp + 0xdf], 0x65
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov byte [ebp + 0xe0], 0x70
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push str.ljdmhwkhqsjte
mov byte [ebp + 0xe1], 0x74
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0x11d
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp + 0xe2], 0x4c
mov byte [ebp + 0xe3], 0x61
mov byte [ebp + 0xe4], 0x6e
call edi
push 0x23de
mov byte [ebp + 0xe5], 0x67
call ebx
push 0x11b
lea eax, [ebp - 0x48]
push eax
mov byte [ebp + 0xe6], 0x75
mov byte [ebp + 0xe7], 0x61
call edi
mov byte [ebp + 0xe8], 0x67
mov byte [ebp + 0xe9], 0x65
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x1900
mov byte [ebp + 0xea], 0x32
call ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x54]
push eax
call esi
push 0x12c
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + 0xeb], 0
call edi
mov esi, dword [ebp - 0x60]
lea eax, [ebp - 0x68]
push eax
push esi
lea eax, [ebp - 0x5c]
push eax
push 0
lea eax, [ebp + 0xdc]
push eax
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000b24e
push esi
jmp 0x1000b26c
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1000b24b
mov al, byte [esi]
test al, al
je 0x1000b24b
cmp al, 0x20
je 0x1000b24b
mov eax, esi
jmp 0x1000b274
push dword [ebp - 0x60]
call fcn.10011153
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x2dc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010fcb
add ebp, 0x2e0
leave
ret