Function at 0x100053a5
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get session user name
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2d0]
sub esp, 0x344
mov eax, dword [0x100271c0]
xor eax, ebp
mov dword [ebp + 0x2cc], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_GetClassLongA]
push 0x410
push 0xfee
mov byte [ebp + 0x1cc], 0x53
mov byte [ebp + 0x1cd], 0x6f
mov byte [ebp + 0x1ce], 0x66
call esi
mov byte [ebp + 0x1cf], 0x74
mov byte [ebp + 0x1d0], 0x77
call dword [sym.imp.USER32.dll_GetCursor]
mov byte [ebp + 0x1d1], 0x61
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + 0x1d2], 0x72
call edi
push 0xba7
mov byte [ebp + 0x1d3], 0x65
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp + 0xc8]
push eax
mov ebx, 0x104
push ebx
call edi
push 0x1457
mov byte [ebp + 0x1d4], 0x5c
mov byte [ebp + 0x1d5], 0x4d
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x1d27
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x41f
push 0x1e5e
mov byte [ebp + 0x1d6], 0x69
call esi
mov byte [ebp + 0x1d7], 0x63
mov byte [ebp + 0x1d8], 0x72
mov byte [ebp + 0x1d9], 0x6f
call dword [sym.imp.USER32.dll_GetCursor]
lea eax, [ebp + 0xc8]
push eax
push ebx
mov byte [ebp + 0x1da], 0x73
call edi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x54]
push eax
mov byte [ebp + 0x1db], 0x6f
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp + 0xc8]
push eax
push ebx
call edi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x5c]
push eax
mov byte [ebp + 0x1dc], 0x66
mov byte [ebp + 0x1dd], 0x74
mov byte [ebp + 0x1de], 0x5c
mov byte [ebp + 0x1df], 0x49
mov byte [ebp + 0x1e0], 0x6e
mov byte [ebp + 0x1e1], 0x74
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp + 0xc8]
push eax
push ebx
mov byte [ebp + 0x1e2], 0x65
call edi
push 0x416
push 0xee4
mov byte [ebp + 0x1e3], 0x72
mov byte [ebp + 0x1e4], 0x6e
call esi
push 0x125
lea eax, [ebp - 0x60]
push eax
mov byte [ebp + 0x1e5], 0x65
mov byte [ebp + 0x1e6], 0x74
mov byte [ebp + 0x1e7], 0x20
mov byte [ebp + 0x1e8], 0x45
mov byte [ebp + 0x1e9], 0x78
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0x40d
push 0x1696
mov byte [ebp + 0x1ea], 0x70
mov byte [ebp + 0x1eb], 0x6c
mov byte [ebp + 0x1ec], 0x6f
mov byte [ebp + 0x1ed], 0x72
call esi
push 0x40a
push 0x1aaf
mov byte [ebp + 0x1ee], 0x65
mov byte [ebp + 0x1ef], 0x72
mov byte [ebp + 0x1f0], 0x5c
mov byte [ebp + 0x1f1], 0x49
call esi
push 0x418
push 0x23bd
mov byte [ebp + 0x1f2], 0x6e
call esi
push 0x129
lea eax, [ebp - 0x64]
push eax
mov byte [ebp + 0x1f3], 0x74
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0x418
push 0x184
call esi
push 0x40d
push 0x29c7
mov byte [ebp + 0x1f4], 0x65
mov byte [ebp + 0x1f5], 0x72
mov byte [ebp + 0x1f6], 0x6e
mov byte [ebp + 0x1f7], 0x61
mov byte [ebp + 0x1f8], 0x74
mov byte [ebp + 0x1f9], 0x69
mov byte [ebp + 0x1fa], 0x6f
mov byte [ebp + 0x1fb], 0x6e
mov byte [ebp + 0x1fc], 0x61
mov byte [ebp + 0x1fd], 0x6c
mov byte [ebp + 0x1fe], 0
call esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1cc]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10005729
push 4
pop eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x40]
push eax
push ebx
mov byte [ebp + 0xcc], 0x53
call edi
mov edi, dword [sym.imp.USER32.dll_GetDC]
push 0x1bd4
mov byte [ebp + 0xcd], 0x75
mov byte [ebp + 0xce], 0x62
call edi
push 0x223
mov byte [ebp + 0xcf], 0x76
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov esi, dword [sym.imp.USER32.dll_GetCursor]
call esi
mov byte [ebp + 0xd0], 0x65
mov byte [ebp + 0xd1], 0x72
call esi
push 0x22c3
mov byte [ebp + 0xd2], 0x73
call edi
mov byte [ebp + 0xd3], 0x69
call esi
push 0x10021614
mov byte [ebp + 0xd4], 0x6f
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
lea eax, [ebp + 0xcc]
push eax
push dword [ebp - 0x6c]
mov byte [ebp + 0xd5], 0x6e
mov byte [ebp + 0xd6], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10005729
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x70]
jmp 0x1000572b
xor eax, eax
mov ecx, dword [ebp + 0x2cc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010fcb
add ebp, 0x2d0
leave
ret