Function at 0x100288c0
Capabilities:
Acquire debug privileges
Check os version
Contain obfuscated stackstrings
Enumerate processes
Get common file path
Get cpu information
Get disk information
Get disk size
Get graphical window text
Query or enumerate registry value
Query service status

Disassembly:
sub esp, 0x67c
push ebx
mov ebx, dword [esp + 0x684]
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x124
xor eax, eax
mov edi, ebx
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0xb8]
mov dword [esp + 0xb8], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0xbc]
cmp eax, 4
ja 0x1002890a
mov esi, 0x10120134
cmp eax, 5
jne 0x10028939
mov eax, dword [esp + 0xc0]
test eax, eax
jne 0x10028921
mov esi, str.2000
jmp 0x10028998
cmp eax, 1
jne 0x1002892d
mov esi, 0x10120128
jmp 0x10028998
cmp eax, 2
jne 0x10028998
mov esi, str.2003
jmp 0x10028998
cmp eax, 6
jne 0x10028998
mov eax, dword [esp + 0xc0]
test eax, eax
jne 0x10028961
cmp byte [esp + 0x152], 1
jne 0x1002895a
mov esi, str.Vista
jmp 0x10028998
mov esi, str.2008
jmp 0x10028998
cmp eax, 1
jne 0x1002897e
cmp byte [esp + 0x152], 1
jne 0x10028977
mov esi, 0x100faef0
jmp 0x10028998
mov esi, str.2008R2
jmp 0x10028998
cmp eax, 2
jne 0x10028998
mov al, byte [esp + 0x152]
mov esi, 0x100faeec
cmp al, 1
je 0x10028998
mov esi, str.2012
mov ecx, dword [esp + 0x14c]
and ecx, 0xffff
push ecx
push esi
push str.Windows__s_SP_d
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, 0xc
mov esi, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
lea edi, [esp + 0x494]
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x4c]
mov ecx, 0x35
xor eax, eax
lea edi, [esp + 0x4b4]
push edx
push 1
rep stosd dword es:[edi], eax
mov dword [esp + 0x54], eax
push eax
lea eax, [esp + 0x490]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10028a89
mov ecx, 0x40
lea edi, [esp + 0x155]
mov byte [esp + 0x154], al
lea edx, [esp + 0x154]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x5c]
mov dword [esp + 0x5c], 0x80
stosb byte es:[edi], al
push ecx
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x74]
push edx
push eax
push 0
push str.ProcessorNameString
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10028a7c
lea edx, [esp + 0x154]
mov ecx, ebp
push edx
call fcn.10028830
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x80]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10028ab1
mov edi, 0x10120098
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x80]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 5
mov esi, str.CTXOPConntion_Class
lea edi, [esp + 0x258]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3c
lea edi, [esp + 0x26c]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x155]
mov byte [esp + 0x154], al
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x25c]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_FindWindowA]
mov ebp, eax
test ebp, ebp
je 0x10028c4e
mov esi, str.CTXOPConntion_Class
lea eax, [esp + 0x258]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x10028b36
test cl, cl
je 0x10028b32
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x10028b36
add eax, 2
add esi, 2
test cl, cl
jne 0x10028b12
xor eax, eax
jmp 0x10028b3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10028c27
lea eax, [esp + 0x258]
push 0x104
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edi, [esp + 0x258]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [esp + ecx + 0x257]
dec ecx
cmp al, 0x5f
jne 0x10028b68
lea edi, [esp + ecx + 0x259]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x154]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx + 0x390]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x154]
mov esi, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [esi + ecx + 2]
cmp ecx, 0x100
ja 0x10028c27
lea edi, [esp + 0x154]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x100fa644
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [esp + 0x690]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 2
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
lea edx, [esp + 0x258]
mov ebp, eax
push 0x104
push edx
push ebp
call dword [sym.imp.USER32.dll_GetClassNameA]
test ebp, ebp
jne 0x10028b06
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, 0x31b5d43b
mul esi
mov ecx, edx
mov eax, esi
xor edx, edx
mov esi, 0x5265c00
div esi
mov edi, 0x36ee80
shr ecx, 0x18
mov esi, edx
xor edx, edx
mov eax, esi
div edi
mov eax, 0x45e7b273
mul edx
shr edx, 0xe
mov eax, 0x95217cb1
push edx
mul esi
shr edx, 0x15
push edx
push ecx
lea eax, [ebx + 0x100]
push 0x10120088
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [ebx + 0x200]
push ecx
call fcn.1002a290
call fcn.100252c0
mov edi, dword [sym.imp.MSVCRT.dll_atol]
mov esi, eax
push esi
call edi
push esi
mov dword [ebx + 0x300], eax
call sub.MFC42.DLL_operatordelete
call fcn.10025e60
mov esi, eax
push esi
call edi
push esi
mov dword [ebx + 0x304], eax
call sub.MFC42.DLL_operatordelete
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add esp, 0x28
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dl, bl
lea eax, [esp + 0x50]
add dl, 0x42
push eax
mov byte [esp + 0x54], dl
mov byte [esp + 0x55], 0x3a
mov byte [esp + 0x56], 0x5c
mov byte [esp + 0x57], 0
call ebp
cmp eax, 3
jne 0x10028d56
lea ecx, [esp + 0x60]
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0x78]
push edx
lea ecx, [esp + 0x58]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov ecx, 0x1e
call fcn.1002d240
mov edx, dword [esp + 0x64]
add esi, eax
mov eax, dword [esp + 0x60]
mov ecx, 0x1e
call fcn.1002d240
add edi, eax
inc ebx
cmp ebx, 0x1a
jl 0x10028cf0
mov ebp, dword [esp + 0x690]
push 0x80
lea edx, [ebp + 0x280]
mov dword [ebp + 0x308], esi
push edx
push str.RDP_Tcp
mov dword [ebp + 0x30c], edi
call fcn.10025230
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x10028da7
push str.OpenSCManager_Error_
jmp 0x100290b4
push 0xf01ff
push str.TermService
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x10028dc8
push str.OpenService_Error_
jmp 0x100290b4
lea eax, [esp + 0x9c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne case.0x10018b44.4
call edi
push esi
call edi
push str.QueryServiceStatus_Error_
jmp 0x100290b4
invalid