Function at 0x402988
Capabilities:
Get hostname
Impersonate user
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], 0x100
xor esi, esi
call fcn.00401a81
xor ecx, ecx
inc eax
push 2
pop edi
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00402f24
mov dword [0x451e18], eax
call fcn.00401b38
mov dword [0x451e1c], eax
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.0040198b
push dword [0x451e18]
mov dword [0x454744], eax
call fcn.00401ada
call fcn.004020ea
push 0x446994
call fcn.00401ca4
add esp, 0x14
test eax, eax
jne 0x402e02
push 0x446998
call fcn.00401ca4
pop ecx
test eax, eax
jne 0x402e02
push 0x44699c
call fcn.00401ca4
pop ecx
test eax, eax
jne 0x402e02
cmp dword [0x454744], ebx
je 0x402e02
mov eax, dword [0x451e1c]
test eax, eax
je 0x402e02
push eax
push str._s_:_Starting_Connection_to:
mov edi, 0x451e20
push edi
call fcn.004028c7
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 1
push 0x4014ad
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea eax, [ebp - 8]
push eax
push 0x451a18
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x402aa3
push str.GetComputerName___failed._Use_a_valid_name__:__n
push 0x44526c
push 1
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 1
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
push 0xfffffffffffffffd
pop eax
jmp 0x402e0a
push 0
call fcn.00402080
mov edi, dword [sym.imp.ADVAPI32.dll_RevertToSelf]
pop ecx
test eax, eax
jne 0x402abd
push 0xfffffffffffffffe
pop esi
jmp 0x402dca
mov eax, dword [0x45473c]
test eax, eax
je 0x402b25
mov ecx, dword [0x454738]
test ecx, ecx
je 0x402b25
lea edx, [ebp - 4]
push edx
push 3
push 9
push ecx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
mov ebx, eax
test ebx, ebx
je 0x402c47
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x402c15
push str.Impersonation_success_n
push 0x44526c
push 1
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 1
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
push str.Initiating_Connection_to_Remote_Service_._._.
push 0x44526c
push 1
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 1
call fcn.0041022b
push eax
call fcn.004220f2
push 1
push str.ADMIN_
push dword [0x451e1c]
call fcn.0040164c
add esp, 0x20
test eax, eax
jne 0x402c4e
push 0xfffffffffffffffe
pop esi
push str.EstablishConnection_Failed_n_n
push 0x44526c
push 1
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 1
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
push str.Couldnt_connect_to
push 0x44526c
push 2
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 2
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
push dword [0x451e1c]
push 0x44526c
push 2
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 2
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
push str.ADMIN__n
push 0x44526c
push 2
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 2
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
call fcn.004021a0
jmp 0x402dca
push str.Impersonation_failed_n
push 0x44526c
push 1
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 1
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
call fcn.004021a0
jmp 0x402e07
push str.User_Logon_failed_n_n
jmp 0x402c1a
call fcn.004014b2
test eax, eax
jne 0x402ce1
push 0xfffffffffffffffe
pop esi
push str.CopyBinaryToRemoteSystem_Failed_n_n
push 0x44526c
push 1
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 1
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
push str.Couldnt_copy
push 0x44526c
push 2
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 2
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
push dword [0x454744]
push 0x44526c
push 2
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 2
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
push str._to
jmp 0x402b97
push 0
push 1
call fcn.004013bc
pop ecx
pop ecx
test eax, eax
jne 0x402db7
call fcn.00401544
test eax, eax
jne 0x402d32
push 0xfffffffffffffffe
pop esi
push str.CopyServiceToRemoteMachine_Failed_n_n
push 0x44526c
push 1
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 1
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
push str.Couldnt_copy_service_to
jmp 0x402b97
call fcn.00401b9c
test eax, eax
jne 0x402d70
push 0xfffffffffffffffe
pop esi
push str.InstallAndStartRemoteService_Failed_n_n
push 0x44526c
push 1
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 1
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
push str.Couldnt_start_remote_service_n
jmp 0x402be8
push 0x3e8
push 5
call fcn.004013bc
pop ecx
pop ecx
test eax, eax
jne 0x402db7
push 0xfffffffffffffffe
pop esi
push str.ConnectToRemoteService_Failed_n_n
push 0x44526c
push 1
call fcn.0041022b
pop ecx
push eax
call fcn.0040296f
push 1
call fcn.0041022b
push eax
call fcn.004220f2
add esp, 0x14
push str.Couldnt_connect_to_remote_service_n
jmp 0x402be8
call fcn.004017b0
call edi
push dword [0x454748]
call fcn.00402f2d
pop ecx
mov eax, dword [0x451e18]
test eax, eax
je 0x402dda
push eax
call fcn.00402f2d
pop ecx
push 0
push str.ADMIN_
push dword [0x451e1c]
call fcn.0040164c
add esp, 0xc
test ebx, ebx
je 0x402dfe
call edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x402e0a
call fcn.00402222
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret