Function at 0x408700
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x108
mov eax, dword [0x421e3c]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x114]
push edi
call fcn.00401a50
push 1
push str.SeDebugPrivilege
call fcn.00401b40
mov eax, dword [esp + 0x11c]
add esp, 8
cmp eax, 2
jne 0x4089b8
mov eax, dword [esi + 4]
push str._List
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408766
push 1
push eax
call fcn.00404aa0
add esp, 8
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._ListAll
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408789
push eax
call fcn.00407380
add esp, 4
jmp 0x408f53
mov edx, dword [esi + 4]
push str._ListDll
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x4087ac
push eax
call fcn.00405950
add esp, 4
jmp 0x408f53
mov eax, dword [esi + 4]
push str._SetService
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x4087cb
call fcn.00402800
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._CheckSuspicious
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x4087ea
call fcn.00405ed0
jmp 0x408f53
mov edx, dword [esi + 4]
push str._SetHost
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408809
call fcn.00403ca0
jmp 0x408f53
mov eax, dword [esi + 4]
push str._SetSpecial
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408828
call fcn.00402d10
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._CheckMonitor
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408847
call fcn.00405e80
jmp 0x408f53
mov edx, dword [esi + 4]
push str._ListTime
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x40886a
push eax
call fcn.00406cc0
add esp, 4
jmp 0x408f53
mov eax, dword [esi + 4]
push str._ListWMI
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x4088b4
push eax
call fcn.00406260
add esp, 4
test al, al
jne 0x408f53
push 0
call fcn.004065e0
add esp, 4
test al, al
jne 0x408f53
push str.None_Found_n
call fcn.0040a0a0
add esp, 4
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._DelWMI
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x4088df
push 1
call fcn.00406260
push 1
call fcn.004065e0
add esp, 8
jmp 0x408f53
mov edx, dword [esi + 4]
push str._ListPath
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408919
call fcn.00402d50
test al, al
je 0x408907
call fcn.00402f40
jmp 0x408f53
push str.Windows_Defender_Isnt_Enabled_n
call fcn.0040a0a0
add esp, 4
jmp 0x408f53
mov eax, dword [esi + 4]
push str._FindService
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408938
call fcn.00405a00
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._WhoAmI
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408957
call fcn.00406b70
jmp 0x408f53
mov edx, dword [esi + 4]
push str._ListService
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408976
call fcn.00403ff0
jmp 0x408f53
mov eax, dword [esi + 4]
push str._ListDesktop
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408995
call fcn.00403280
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._CheckHook
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408f53
call fcn.00403710
jmp 0x408f53
cmp eax, 3
jne 0x408e0f
mov edx, dword [esi + 4]
push str._Kill
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x4089e7
mov eax, dword [esi + 8]
push eax
call fcn.00407f60
add esp, 4
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._ListAll
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408a16
mov edx, dword [esi + 8]
push 0xa
push eax
push edx
call fcn.0040b767
push eax
call fcn.00407380
add esp, 0x10
jmp 0x408f53
mov eax, dword [esi + 4]
push str._ListDll
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408a79
mov esi, dword [esi + 8]
push esi
call fcn.004017f0
add esp, 4
test al, al
je 0x408a58
push 0xa
push 0
push esi
call fcn.0040b767
add esp, 0xc
push 0
push eax
call fcn.00405410
add esp, 8
jmp 0x408f53
push esi
call fcn.00401c30
add esp, 4
test eax, eax
je 0x408f53
push 0
push eax
call fcn.00405410
add esp, 8
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._FindDll
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408a9f
mov edx, dword [esi + 8]
push edx
call fcn.00405950
add esp, 4
jmp 0x408f53
mov eax, dword [esi + 4]
push str._ListService
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408ac6
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.00403d80
add esp, 8
jmp 0x408f53
mov edx, dword [esi + 4]
push str._FindService
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408af1
mov eax, dword [esi + 8]
push eax
push 0x41be18
call fcn.00403d80
add esp, 8
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._GetService
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408b17
mov edx, dword [esi + 8]
push edx
call fcn.00402450
add esp, 4
jmp 0x408f53
mov eax, dword [esi + 4]
push str._SetService
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408b3d
mov ecx, dword [esi + 8]
push ecx
call fcn.00402570
add esp, 4
jmp 0x408f53
mov edx, dword [esi + 4]
push str._GetCommandLine
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
je 0x408dd6
mov eax, dword [esi + 4]
push str._GetDesktop
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
je 0x408dd6
mov ecx, dword [esi + 4]
push str._SetNetworkService
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408b9a
mov edx, dword [esi + 8]
push str.Network_Service
push edx
call fcn.00402600
add esp, 8
jmp 0x408f53
mov eax, dword [esi + 4]
push str._ListPrivilege
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408bed
push 0xff
push eax
lea ecx, [esp + 0x15]
push ecx
mov byte [esp + 0x18], al
call fcn.0040a180
mov edx, dword [esi + 8]
push edx
push str.__s_
lea eax, [esp + 0x20]
push 0xfe
push eax
call fcn.00403470
lea ecx, [esp + 0x28]
push ecx
call fcn.004077e0
add esp, 0x20
jmp 0x408f53
mov edx, dword [esi + 4]
push str._ListName
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408c13
mov eax, dword [esi + 8]
push eax
call fcn.00407b80
add esp, 4
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._AddPath
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
je 0x408d95
mov edx, dword [esi + 4]
push str._DelPath
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
je 0x408d95
mov eax, dword [esi + 4]
push str._ListTime
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408c74
mov ecx, dword [esi + 8]
push 0xa
push eax
push ecx
call fcn.0040b767
push eax
call fcn.00406cc0
add esp, 0x10
jmp 0x408f53
mov edx, dword [esi + 4]
push str._ListChild
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408ca3
push 0xa
push eax
mov eax, dword [esi + 8]
push eax
call fcn.0040b767
push eax
call fcn.004070a0
add esp, 0x10
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._AutoRestart
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408cc9
mov edx, dword [esi + 8]
push edx
call fcn.00403b80
add esp, 4
jmp 0x408f53
mov eax, dword [esi + 4]
push str._DACL
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408cef
mov ecx, dword [esi + 8]
push ecx
call fcn.00402970
add esp, 4
jmp 0x408f53
mov edx, dword [esi + 4]
push str._SetDACL
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408d1a
mov eax, dword [esi + 8]
push str.D:_A__CCLCSWRPWPDTLOCRRC___SY__A__CCDCLCSWRPWPDTLOCRSDRCWDWO___BA__A__CCLCSWLOCRRC___IU__A__CCLCSWLOCRRC___SU_
push eax
call fcn.00402aa0
add esp, 8
jmp 0x408f53
mov ecx, dword [esi + 4]
push str._ListACL
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408d40
mov edx, dword [esi + 8]
push edx
call fcn.00403ae0
add esp, 4
jmp 0x408f53
mov eax, dword [esi + 4]
push str._Hide
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408d6b
mov ecx, dword [esi + 8]
push str.D:_D__DCLCWPDTSD___IU__D__DCLCWPDTSD___SU__D__DCLCWPDTSD___BA__A__CCLCSWLOCRRC___IU__A__CCLCSWLOCRRC___SU__A__CCLCSWRPWPDTLOCRRC___SY__A__CCDCLCSWRPWPDTLOCRSDRCWDWO___BA_S:_AU_FA_CCDCLCSWRPWPDTLOCRSDRCWDWO___WD_
push ecx
call fcn.00402aa0
add esp, 8
jmp 0x408f53
mov edx, dword [esi + 4]
push str._Restrict
push edx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408f53
mov eax, dword [esi + 8]
push eax
call fcn.00406960
add esp, 4
jmp 0x408f53
call fcn.00402d50
test al, al
je 0x408907
mov ecx, dword [esi + 4]
mov edi, dword [esi + 8]
push str._DelPath
push ecx
mov byte [esp + 0x10], 1
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408dc3
mov byte [esp + 8], al
mov edx, dword [esp + 8]
push edx
push edi
call fcn.00408610
add esp, 8
jmp 0x408f53
mov eax, dword [esi + 8]
push 0xa
push 0
push eax
call fcn.0040b767
mov ecx, dword [esi + 4]
push str._GetDesktop
push ecx
mov edi, eax
call fcn.0040a38f
test eax, eax
sete dl
mov byte [esp + 0x1c], dl
mov eax, dword [esp + 0x1c]
push eax
push edi
call fcn.00402080
add esp, 0x1c
jmp 0x408f53
cmp eax, 4
jne 0x408f25
mov ecx, dword [esi + 4]
push str._Kill
push ecx
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408e6f
mov edi, dword [esi + 8]
push 0xff
push eax
lea edx, [esp + 0x15]
push edx
mov byte [esp + 0x18], al
call fcn.0040a180
mov eax, dword [esi + 0xc]
push eax
push str.__s_
lea ecx, [esp + 0x20]
push 0xfe
push ecx
call fcn.00403470
lea edx, [esp + 0x28]
push edx
push edi
call fcn.00407fa0
add esp, 0x24
jmp 0x408f53
mov eax, dword [esi + 4]
push str._SetDACL
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408e99
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push edx
call fcn.00402aa0
add esp, 8
jmp 0x408f53
mov eax, dword [esi + 4]
push str._FindAPI
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408ecc
mov ecx, dword [esi + 8]
push 0xa
push eax
push ecx
call fcn.0040b767
mov edx, dword [esi + 0xc]
push edx
push eax
call fcn.004058f0
add esp, 0x14
jmp 0x408f53
mov eax, dword [esi + 4]
push str._SetLimit
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408f53
mov edi, dword [esi + 8]
push edi
call fcn.004017f0
add esp, 4
test al, al
je 0x408f53
mov ecx, dword [esi + 0xc]
push ecx
call fcn.004017f0
add esp, 4
test al, al
je 0x408f53
push 0xa
push 0
push edi
call fcn.0040b767
mov edx, dword [esi + 0xc]
push edx
mov edi, eax
call fcn.0040b441
movzx eax, ax
push eax
push edi
call fcn.004032b0
add esp, 0x18
jmp 0x408f53
cmp eax, 5
jne 0x408f53
mov eax, dword [esi + 4]
push str._SetService
push eax
call fcn.0040a38f
add esp, 8
test eax, eax
jne 0x408f53
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ecx
push edx
push eax
call fcn.004037a0
add esp, 0xc
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040a165
add esp, 0x108
ret