Function at 0x40404a
Capabilities:
Delete file
Get hostname
Set console window title

Disassembly:
push 0xffffffffffffffff
push 0x428949
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x43205c]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43205c]
xor eax, esp
push eax
lea eax, [esp + 0x22c]
mov dword fs:[0], eax
call fcn.0040402b
push 8
call fcn.00405952
pop ecx
mov dword [esp + 0x14], eax
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x234], ebx
je 0x4040b7
push dword [0x435f34]
mov ecx, eax
push str...logsRemcomServer_Logs.log
call fcn.00401289
jmp 0x4040b9
xor eax, eax
or dword [esp + 0x234], 0xffffffff
push str.RemCom_Main_Thread_Starts_n
mov edi, 0x42af1c
push edi
push eax
mov dword [0x4331fc], eax
call fcn.004010f4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x100
call fcn.0040188f
push eax
push str.Client_Machine_::__ws_n
push edi
push dword [0x4331fc]
mov dword [0x433604], eax
call fcn.004010f4
call fcn.0040176e
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00405952
mov dword [0x433600], eax
lea eax, [esp + 0x3c]
push eax
push 2
call fcn.004016fd
push eax
push 0x42cfcc
push edi
push dword [0x4331fc]
mov dword [0x435f2c], eax
call fcn.004010f4
push dword [0x433600]
call fcn.004017dc
call fcn.00402ed7
push 0x42cfc8
call fcn.00401642
add esp, 0x40
test eax, eax
jne 0x404972
push 0x42cfc4
call fcn.00401642
test eax, eax
pop ecx
jne 0x404972
push str.help
call fcn.00401642
test eax, eax
pop ecx
jne 0x404972
cmp dword [0x435f2c], ebx
je 0x404972
mov eax, dword [0x433604]
cmp eax, ebx
je 0x404972
push eax
push str._s_:_Starting_Connection_to:
mov esi, 0x433608
push esi
call fcn.00406585
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 1
push 0x402ed2
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea eax, [esp + 0x18]
push eax
mov esi, 0x433200
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x40422f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetComputerName_Failed_::__d_n
push edi
push dword [0x4331fc]
call fcn.004010f4
add esp, 0x10
push str.GetComputerName___failed._Use_a_valid_name__:__n
push 0x429378
call fcn.00405dc6
push 0x20
pop ebx
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push 0xfffffffffffffffd
pop eax
jmp 0x40497a
push esi
push str.GetComputerName_is_Succeeded_:_ws_n
mov ebp, 0x429310
push ebp
push dword [0x4331fc]
call fcn.004010f4
push ebx
call fcn.00401a20
add esp, 0x14
test eax, eax
jne 0x404260
mov dword [esp + 0x14], 0xfffffffe
jmp 0x404913
push 0x10
push dword [0x432004]
push dword [0x433604]
call fcn.00406453
add esp, 0xc
test eax, eax
je 0x4047b6
push 0x10
push dword [0x432008]
push dword [0x433604]
call fcn.00406453
add esp, 0xc
test eax, eax
je 0x4047b6
push 2
push 0x429568
push dword [0x433604]
call fcn.00406453
add esp, 0xc
test eax, eax
je 0x4047b6
push str.Initiating_Connection_to_Remote_Service_._._.__n
push ebp
push dword [0x4331fc]
call fcn.004010f4
add esp, 0xc
push str.Initiating_Connection_to_Remote_Service_._._.
mov esi, 0x429378
push esi
call fcn.00405dc6
push 0x20
pop ebx
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
push str.Connecting_ADMIN__._._.__n
push ebp
push dword [0x4331fc]
call fcn.004010f4
push 1
push str.ADMIN_
push dword [0x433604]
call fcn.00401a8f
add esp, 0x28
test eax, eax
jne 0x4043e0
push str.Failed_n_n
push esi
mov dword [esp + 0x1c], 0xfffffffe
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.Couldnt_connect_to
push esi
call fcn.00405dc6
push 0x40
pop ebx
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push dword [0x433604]
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.ADMIN__n
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.EstablishConnection_ADMIN___Failed_::__d_n
push ebp
push dword [0x4331fc]
call fcn.004010f4
add esp, 0x10
call fcn.004012a7
jmp 0x404913
push str.Connecting_IPC__._._.__n
push ebp
push dword [0x4331fc]
call fcn.004010f4
push 1
push str.IPC_
push dword [0x433604]
call fcn.00401a8f
add esp, 0x18
test eax, eax
jne 0x4044b7
push str.Failed_n_n
push esi
mov dword [esp + 0x1c], 0xfffffffe
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.Couldnt_connect_to
push esi
call fcn.00405dc6
push 0x40
pop ebx
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push dword [0x433604]
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.IPC__n
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.EstablishConnection_IPC___Failed_::__d_n
jmp 0x4043c7
call fcn.00403ee5
mov dword [0x435f30], eax
call fcn.00401c8f
test eax, eax
jne 0x4045d2
push str.Failed_n_n
push esi
mov dword [esp + 0x1c], 0xfffffffe
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.Couldnt_copy
push esi
call fcn.00405dc6
push 0x40
pop ebx
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push dword [0x435f2c]
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str._to
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push dword [0x433604]
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.ADMIN_System32_n
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
call fcn.004012a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CopyBinaryToRemoteSystem_Failed_::__d_n
push edi
push dword [0x4331fc]
call fcn.004010f4
add esp, 0x10
jmp 0x404913
push 0
push 1
call fcn.00402223
test eax, eax
pop ecx
pop ecx
jne 0x4047a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConnectToRemoteService_Check_for_Installed_service__Failed_::__d_n
push edi
push dword [0x4331fc]
call fcn.004010f4
add esp, 0x10
call fcn.00401e5c
test eax, eax
jne 0x4046bb
push str.Failed_n_n
push esi
mov dword [esp + 0x1c], 0xfffffffe
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.Couldnt_copy_service_to
push esi
call fcn.00405dc6
push 0x40
pop ebx
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push dword [0x433604]
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.ADMIN_System32_n
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
call fcn.004012a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CopyServiceToRemoteMachine_Failed_:__d_n
jmp 0x4045be
call fcn.0040203b
test eax, eax
jne 0x40472b
push str.Failed_n_n
push esi
mov dword [esp + 0x1c], 0xfffffffe
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.Couldnt_start_remote_service_n
push esi
call fcn.00405dc6
push 0x40
pop ebx
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
call fcn.004012a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InstallAndStartRemoteService_Failed_::__d_n
jmp 0x4045be
push 0x3e8
push 5
call fcn.00402223
test eax, eax
pop ecx
pop ecx
jne 0x4047a0
push str.Failed_n_n
push esi
mov dword [esp + 0x1c], 0xfffffffe
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.Couldnt_connect_to_remote_service_n
push esi
call fcn.00405dc6
push 0x40
pop ebx
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._ConnectToRemoteService_Failed.__d_n
push edi
jmp 0x4043c8
call fcn.00402cf7
push dword [0x435f30]
call fcn.004058ef
pop ecx
jmp 0x404913
call fcn.004013e1
test eax, eax
push 0x20
mov esi, 0x429378
pop ebx
je 0x4047ea
push str.Local_Admin_n_n
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.Localhost_entered_for_Target_Machine_.._Going_to_RunAs_Command_n_n
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
mov dword [0x433604], 0x429328
call fcn.00401dac
test eax, eax
je 0x4048c2
push str.Launching_Local_Process_..._n
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
and word [esp + 0x30], 0
push 0x206
lea eax, [esp + 0x36]
push 0
push eax
call fcn.00406740
push dword [0x435f2c]
lea eax, [esp + 0x40]
push dword [0x435f20]
push dword [0x435f24]
push 0x435d18
push str._s__s__s__s
push eax
call fcn.00406585
lea eax, [esp + 0x54]
push eax
call fcn.00403bdc
add esp, 0x38
test eax, eax
jne 0x4048b5
push str.Create_Local_Process_Failed._Illegal_Command
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push 0x435d18
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x404913
push str.Cannot_Extract_Local_Resources._Please_check_write_access_to_local_tmp_filesystem_n
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
add esp, 0x10
push str.Create_Process_as_User_Failed._Trying_to_run_the_process_with_the_current_user_n_n
push esi
call fcn.00405dc6
add eax, ebx
push eax
call fcn.004051d3
call fcn.00405dc6
add eax, ebx
push eax
call fcn.00405177
push dword [0x435f2c]
call fcn.00403bdc
add esp, 0x14
mov eax, dword [0x433600]
test eax, eax
je 0x404923
push eax
call fcn.004058ef
pop ecx
push str._nCLEANUP_Called_n
push ebp
push dword [0x4331fc]
call fcn.004010f4
push 0
push str.IPC_
push dword [0x433604]
call fcn.00401a8f
push 0
push str.ADMIN_
push dword [0x433604]
call fcn.00401a8f
push str.RemCom_Main_Thread_Ends_n_n
push edi
push dword [0x4331fc]
call fcn.004010f4
mov eax, dword [esp + 0x44]
add esp, 0x30
jmp 0x40497a
call fcn.00402f92
or eax, 0xffffffff
mov ecx, dword [esp + 0x22c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00405d58
add esp, 0x224
ret