Function at 0x40311f
Capabilities:
Delete file
Get hostname
Impersonate user
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x450024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x214], 0x500
xor ebx, ebx
call fcn.0040232b
mov dword [0x453420], eax
lea eax, [ebp - 0x218]
push eax
push 2
call fcn.0040202a
push 0x451e18
mov dword [0x453430], eax
call fcn.004022cd
push 0x4458c8
call fcn.0040241c
add esp, 0x10
test eax, eax
jne 0x403777
push 0x4458cc
call fcn.0040241c
pop ecx
test eax, eax
jne 0x403777
push 0x4458d0
call fcn.0040241c
pop ecx
test eax, eax
jne 0x403777
cmp dword [0x453430], ebx
je 0x403777
mov eax, dword [0x453420]
test eax, eax
je 0x403777
push eax
push str._s_:_Starting_Connection_to:
mov edi, 0x452818
push edi
call fcn.0040303f
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor edi, edi
inc edi
push edi
push 0x4019b7
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea eax, [ebp - 0x214]
push eax
push 0x450a18
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x40322c
push str.GetComputerName___failed._Use_a_valid_name__:__n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push 0xfffffffffffffffd
pop eax
jmp 0x40377f
push 0
call fcn.00402a0d
pop ecx
test eax, eax
jne 0x403240
push 0xfffffffffffffffe
pop esi
jmp 0x403715
push 0x10
push dword [0x450004]
push dword [0x453420]
call fcn.0040ffe2
add esp, 0xc
test eax, eax
je 0x4035ae
push 0x10
push dword [0x450008]
push dword [0x453420]
call fcn.0040ffe2
add esp, 0xc
test eax, eax
je 0x4035ae
push 2
push 0x445314
push dword [0x453420]
call fcn.0040ffe2
add esp, 0xc
test eax, eax
je 0x4035ae
lea eax, [ebp - 0x210]
push eax
push 3
push 9
push dword [0x453424]
push 0
push dword [0x453428]
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
mov ebx, eax
test ebx, ebx
je 0x4032dc
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x4032d5
mov edi, str.Impersonation_success_n
jmp 0x4032e1
mov edi, str.Impersonation_failed_n
jmp 0x4032e1
mov edi, str.LogonUser_failed_n
xor eax, eax
inc eax
push eax
call fcn.00410fb1
push edi
push 0x4452fc
push eax
call fcn.004030e7
xor edi, edi
inc edi
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x18
push str.Initiating_Connection_to_Remote_Service_._._.
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
push edi
push str.ADMIN_
push dword [0x453420]
call fcn.00401b56
add esp, 0x20
test eax, eax
jne 0x4033f3
push 0xfffffffffffffffe
pop esi
push str.Failed_n_n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push str.Couldnt_connect_to
push 0x4452fc
push 2
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push 2
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push dword [0x453420]
push 0x4452fc
push 2
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push 2
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push str.ADMIN__n
push 0x4452fc
push 2
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push 2
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
call fcn.00402a77
jmp 0x403715
call fcn.004019bc
test eax, eax
jne 0x4034d5
push 0xfffffffffffffffe
pop esi
push str.Failed_n_n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push str.Couldnt_copy
push 0x4452fc
push 2
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push 2
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push dword [0x453430]
push 0x4452fc
push 2
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push 2
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push str._to
push 0x4452fc
push 2
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push 2
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push dword [0x453420]
push 0x4452fc
push 2
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push 2
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push str.ADMIN_System32_n
jmp 0x4033c6
push 0
push edi
call fcn.004018c6
pop ecx
pop ecx
test eax, eax
jne 0x4035a4
call fcn.00401a4e
test eax, eax
jne 0x403523
push 0xfffffffffffffffe
pop esi
push str.Failed_n_n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push str.Couldnt_copy_service_to
jmp 0x40347f
call fcn.0040238f
test eax, eax
jne 0x40355f
push 0xfffffffffffffffe
pop esi
push str.Failed_n_n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push str.Couldnt_start_remote_service_n
jmp 0x4033c6
push 0x3e8
push 5
call fcn.004018c6
pop ecx
pop ecx
test eax, eax
jne 0x4035a4
push 0xfffffffffffffffe
pop esi
push str.Failed_n_n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push str.Couldnt_connect_to_remote_service_n
jmp 0x4033c6
call fcn.00401c96
jmp 0x403715
call fcn.0040248c
test eax, eax
je 0x4035dd
push str.Local_Admin_n_n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push str.Localhost_entered_for_Target_Machine_.._Going_to_RunAs_Command_n_n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
mov dword [0x453420], 0x4452e4
call fcn.00401dc2
test eax, eax
je 0x4036be
push str.Launching_Local_Process_..._n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00404d10
push dword [0x453430]
lea eax, [ebp - 0x20c]
push dword [0x453424]
push dword [0x453428]
push 0x453218
push str._s__s__s__s
push eax
call fcn.0040303f
lea eax, [ebp - 0x20c]
push eax
call fcn.00402caf
add esp, 0x3c
test eax, eax
jne 0x4036b1
push str.Create_Local_Process_Failed._Illegal_Command
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push 0x453218
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x403715
push str.Cannot_Extract_Local_Resources._Please_check_write_access_to_local_tmp_filesystem_n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
push str.Create_Process_as_User_Failed._Trying_to_run_the_process_with_the_current_user_n_n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
push dword [0x453430]
call fcn.00402caf
add esp, 0x18
push 0
push str.ADMIN_
push dword [0x453420]
call fcn.00401b56
add esp, 0xc
test ebx, ebx
je 0x403773
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x40375e
push str.RevertToSelf_failed_n
push 0x4452fc
push edi
call fcn.00410fb1
pop ecx
push eax
call fcn.004030e7
push edi
call fcn.00410fb1
push eax
call fcn.00422e62
add esp, 0x14
cmp dword [ebp - 0x210], 0
je 0x403773
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x40377f
call fcn.00402af9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403c9c
leave
ret