Function at 0x404056
Capabilities:
Delete file
Get hostname
Impersonate user
Set console window title

Disassembly:
push 0xffffffffffffffff
push 0x428fe9
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x43305c]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43305c]
xor eax, esp
push eax
lea eax, [esp + 0x234]
mov dword fs:[0], eax
call fcn.00404037
push 8
call fcn.0040592a
pop ecx
mov dword [esp + 0x18], eax
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x23c], ebx
je 0x4040c3
push dword [0x436f34]
mov ecx, eax
push str...logsRemcomServer_Logs.log
call fcn.00401289
jmp 0x4040c5
xor eax, eax
or dword [esp + 0x23c], 0xffffffff
push str.RemCom_Main_Thread_Starts_n
mov edi, 0x42a574
push edi
push eax
mov dword [0x4341fc], eax
call fcn.004010f4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0x100
mov dword [esp + 0x24], ebx
call fcn.0040188f
push eax
push str.Client_Machine_::__ws_n
push edi
push dword [0x4341fc]
mov dword [0x434604], eax
call fcn.004010f4
call fcn.0040176e
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040592a
mov dword [0x434600], eax
lea eax, [esp + 0x44]
push eax
push 2
call fcn.004016fd
push eax
push 0x42e01c
push edi
push dword [0x4341fc]
mov dword [0x436f2c], eax
call fcn.004010f4
push dword [0x434600]
call fcn.004017dc
call fcn.00402ee3
push 0x42e018
call fcn.00401642
add esp, 0x40
test eax, eax
jne 0x40494b
push 0x42e014
call fcn.00401642
test eax, eax
pop ecx
jne 0x40494b
push str.help
call fcn.00401642
test eax, eax
pop ecx
jne 0x40494b
cmp dword [0x436f2c], ebx
je 0x40494b
mov eax, dword [0x434604]
cmp eax, ebx
je 0x40494b
push eax
push str._s_:_Starting_Connection_to:
mov esi, 0x434608
push esi
call fcn.0040661c
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 1
push 0x402ede
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea eax, [esp + 0x20]
push eax
mov esi, 0x434200
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x40423f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetComputerName_Failed_::__d_n
push edi
push dword [0x4341fc]
call fcn.004010f4
add esp, 0x10
push str.GetComputerName___failed._Use_a_valid_name__:__n
push 0x42a378
call fcn.00405d9e
push 0x20
pop ebx
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push 0xfffffffffffffffd
pop eax
jmp 0x404953
push esi
push str.GetComputerName_is_Succeeded_:_ws_n
mov esi, 0x42a310
push esi
push dword [0x4341fc]
call fcn.004010f4
push ebx
call fcn.00401a2c
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x14
test eax, eax
jne 0x404276
mov dword [esp + 0x14], 0xfffffffe
jmp 0x4048bf
push 0x10
push dword [0x433004]
push dword [0x434604]
call fcn.0040642b
add esp, 0xc
test eax, eax
je 0x404762
push 0x10
push dword [0x433008]
push dword [0x434604]
call fcn.0040642b
add esp, 0xc
test eax, eax
je 0x404762
push 2
push 0x42a568
push dword [0x434604]
call fcn.0040642b
add esp, 0xc
test eax, eax
je 0x404762
push str.Initiating_Impersonation_._._.__n
push esi
push dword [0x4341fc]
call fcn.004010f4
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 3
push 9
push dword [0x436f20]
push ebx
push dword [0x436f24]
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x404335
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x40432b
push str.Impersonation_success_n
push edi
push dword [0x4341fc]
call fcn.004010f4
add esp, 0xc
jmp 0x40434c
call ebp
push eax
push str.Impersonation_failed_::__d_n
jmp 0x40433d
call ebp
push eax
push str.LogonUser_failed_::__d_n
push edi
push dword [0x4341fc]
call fcn.004010f4
add esp, 0x10
push str.Initiating_Connection_to_Remote_Service_._._.__n
push esi
push dword [0x4341fc]
call fcn.004010f4
add esp, 0xc
push str.Initiating_Connection_to_Remote_Service_._._.
mov esi, 0x42a378
push esi
call fcn.00405d9e
push 0x20
pop ebx
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
push str.Connecting_ADMIN__._._.__n
push 0x42a310
push dword [0x4341fc]
call fcn.004010f4
push 1
push str.ADMIN_
push dword [0x434604]
call fcn.00401a9b
add esp, 0x28
test eax, eax
jne 0x404477
push str.Failed_n_n
push esi
mov dword [esp + 0x1c], 0xfffffffe
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push str.Couldnt_connect_to
push esi
call fcn.00405d9e
push 0x40
pop ebx
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push dword [0x434604]
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push str.ADMIN__n
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
call ebp
push eax
push str.EstablishConnection_ADMIN___Failed_::__d_n
push 0x42a310
push dword [0x4341fc]
call fcn.004010f4
add esp, 0x10
call fcn.004012a7
jmp 0x4048bf
call fcn.00403ef1
mov dword [0x436f30], eax
call fcn.00401c9b
test eax, eax
jne 0x40458e
push str.Failed_n_n
push esi
mov dword [esp + 0x1c], 0xfffffffe
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push str.Couldnt_copy
push esi
call fcn.00405d9e
push 0x40
pop ebx
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push dword [0x436f2c]
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push str._to
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push dword [0x434604]
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push str.ADMIN_System32_n
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
call fcn.004012a7
call ebp
push eax
push str.CopyBinaryToRemoteSystem_Failed_::__d_n
push edi
push dword [0x4341fc]
call fcn.004010f4
add esp, 0x10
jmp 0x4048bf
push 0
push 1
call fcn.0040222f
test eax, eax
pop ecx
pop ecx
jne 0x40474c
call ebp
push eax
push str.ConnectToRemoteService_Check_for_Installed_service__Failed_::__d_n
push edi
push dword [0x4341fc]
call fcn.004010f4
add esp, 0x10
call fcn.00401e68
test eax, eax
jne 0x40466f
push str.Failed_n_n
push esi
mov dword [esp + 0x1c], 0xfffffffe
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push str.Couldnt_copy_service_to
push esi
call fcn.00405d9e
push 0x40
pop ebx
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push dword [0x434604]
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push str.ADMIN_System32_n
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
call fcn.004012a7
call ebp
push eax
push str.CopyServiceToRemoteMachine_Failed_:__d_n
jmp 0x40457a
call fcn.00402047
test eax, eax
jne 0x4046db
push str.Failed_n_n
push esi
mov dword [esp + 0x1c], 0xfffffffe
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push str.Couldnt_start_remote_service_n
push esi
call fcn.00405d9e
push 0x40
pop ebx
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
call fcn.004012a7
call ebp
push eax
push str.InstallAndStartRemoteService_Failed_::__d_n
jmp 0x40457a
push 0x3e8
push 5
call fcn.0040222f
test eax, eax
pop ecx
pop ecx
jne 0x40474c
push str.Failed_n_n
push esi
mov dword [esp + 0x1c], 0xfffffffe
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push str.Couldnt_connect_to_remote_service_n
push esi
call fcn.00405d9e
push 0x40
pop ebx
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
call ebp
push eax
push str._ConnectToRemoteService_Failed.__d_n
push edi
jmp 0x40445f
call fcn.00402d03
push dword [0x436f30]
call fcn.004058c7
pop ecx
jmp 0x4048bf
call fcn.004013e1
test eax, eax
push 0x20
mov esi, 0x42a378
pop ebx
je 0x404796
push str.Local_Admin_n_n
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push str.Localhost_entered_for_Target_Machine_.._Going_to_RunAs_Command_n_n
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
mov dword [0x434604], 0x42a328
call fcn.00401db8
test eax, eax
je 0x40486e
push str.Launching_Local_Process_..._n
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
and word [esp + 0x38], 0
push 0x206
lea eax, [esp + 0x3e]
push 0
push eax
call fcn.004067d0
push dword [0x436f2c]
lea eax, [esp + 0x48]
push dword [0x436f20]
push dword [0x436f24]
push 0x436d18
push str._s__s__s__s
push eax
call fcn.0040661c
lea eax, [esp + 0x5c]
push eax
call fcn.00403be8
add esp, 0x38
test eax, eax
jne 0x404861
push str.Create_Local_Process_Failed._Illegal_Command
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push 0x436d18
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4048bf
push str.Cannot_Extract_Local_Resources._Please_check_write_access_to_local_tmp_filesystem_n
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
add esp, 0x10
push str.Create_Process_as_User_Failed._Trying_to_run_the_process_with_the_current_user_n_n
push esi
call fcn.00405d9e
add eax, ebx
push eax
call fcn.004051ab
call fcn.00405d9e
add eax, ebx
push eax
call fcn.0040514f
push dword [0x436f2c]
call fcn.00403be8
add esp, 0x14
mov eax, dword [0x434600]
xor esi, esi
cmp eax, esi
je 0x4048d1
push eax
call fcn.004058c7
pop ecx
push str._nCLEANUP_Called_n
push 0x42a310
push dword [0x4341fc]
call fcn.004010f4
push esi
push str.ADMIN_
push dword [0x434604]
call fcn.00401a9b
add esp, 0x18
cmp dword [esp + 0x18], esi
je 0x404931
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x404921
call ebp
push eax
push str.RevertToSelf_failed_::__d_n
push edi
push dword [0x4341fc]
call fcn.004010f4
add esp, 0x10
cmp dword [esp + 0x1c], esi
je 0x404931
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.RemCom_Main_Thread_Ends_n_n
push edi
push dword [0x4341fc]
call fcn.004010f4
mov eax, dword [esp + 0x20]
add esp, 0xc
jmp 0x404953
call fcn.00402f9e
or eax, 0xffffffff
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.00405d30
add esp, 0x22c
ret