Function at 0x425a80
Capabilities:
Delete file
Get hostname
Get local ipv4 addresses
Get socket information
Query environment variable
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3a0
xor eax, eax
push ebx
push edi
xor ebx, ebx
mov ecx, 0x41
lea edi, [esp + 0x101]
mov byte [esp + 0x100], bl
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x2a1]
mov byte [esp + 0x2a0], bl
rep stosd dword es:[edi], eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], al
mov byte [esp + 0x40], bl
mov ecx, 0x2e
lea edi, [esp + 0x41]
mov dword [esp + 0x208], ebx
mov byte [esp + 0x10], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
cmp esi, ebx
mov ecx, 0x24
lea edi, [esp + 0x20c]
mov dword [esp + 8], 1
rep stosd dword es:[edi], eax
jne 0x425b23
or eax, 0xffffffff
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x50
push esi
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x425bc2
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x34]
mov dword [esp + 0x40], ecx
mov ecx, dword [ebp + 8]
push eax
push ecx
mov dword [esp + 0x18], 0x10
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x425b89
cmp dword [esp + 0xc], 8
jl 0x425b89
mov eax, dword [esp + 0x34]
mov dl, byte [esp + 0x36]
mov byte [esi + 0x58], al
mov al, byte [esp + 0x37]
mov byte [esi + 0x57], 1
mov byte [esi + 0x59], ah
mov byte [esi + 0x5a], dl
mov byte [esi + 0x5b], al
jmp 0x425bc2
push esi
call sub.WS2_32.dll_gethostbyname
cmp eax, ebx
je 0x425bc2
mov byte [esi + 0x57], 1
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov cl, byte [edx]
mov byte [esi + 0x58], cl
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov dl, byte [ecx + 1]
mov byte [esi + 0x59], dl
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov cl, byte [edx + 2]
mov byte [esi + 0x5a], cl
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov cl, byte [eax + 3]
mov byte [esi + 0x5b], cl
cmp byte [esi + 0x57], bl
jne 0x425bd2
mov eax, 0xfffffffe
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x104
lea edx, [esp + 0x104]
push edx
push str.TEMP
call edi
cmp eax, ebx
jle 0x425c33
cmp eax, 0x104
jae 0x425c33
lea eax, [esp + 0x100]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x425c01
sub eax, edx
cmp byte [esp + eax + 0xff], 0x5c
je 0x425c9b
lea edi, [esp + 0x100]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x425c20
mov ax, word [0x469b10]
mov word [edi], ax
jmp 0x425c9b
push 0x104
lea ecx, [esp + 0x104]
push ecx
push 0x4757f8
call edi
cmp eax, ebx
jle 0x425c94
cmp eax, 0x104
jae 0x425c94
lea eax, [esp + 0x100]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x425c60
sub eax, edx
cmp byte [esp + eax + 0xff], 0x5c
je 0x425c9b
lea edi, [esp + 0x100]
dec edi
jmp 0x425c80
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x425c80
mov dx, word [0x469b10]
mov word [edi], dx
jmp 0x425c9b
mov byte [esp + 0x100], bl
mov eax, dword [str.ipXXXXXX]
mov ecx, dword [0x4757f0]
mov dl, byte [0x4757f4]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
call fcn.00467d9e
lea edi, [esp + 0x14]
add esp, 4
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x425cd0
mov ecx, dword [str..txt]
mov dl, byte [0x4757e8]
mov dword [edi], ecx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x104]
push ecx
mov byte [edi + 4], dl
lea edx, [esp + 0x2a8]
push 0x4697b0
push edx
call fcn.00458ee7
add esp, 0x10
lea eax, [esp + 0x208]
push eax
mov dword [esp + 0x20c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x425d5a
cmp dword [esp + 0x218], 1
jne 0x425d5a
push ebx
lea ecx, [esp + 0x2a4]
push ecx
push str._batch
push str._all
push str.winipcfg
push str.winipcfg
push ebx
call fcn.00467d88
add esp, 0x1c
jmp 0x425d76
push ebx
push ebx
lea edx, [esp + 0x2a8]
push edx
push 0x2710
push str.ipconfig__all
call fcn.00446f70
add esp, 0x14
lea eax, [esp + 0x2a0]
push 0x473eec
push eax
call fcn.00459902
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x42606f
test byte [edi + 0xc], 0x10
jne 0x42604e
nop
lea ecx, [esp + 0x40]
push edi
push ecx
call fcn.00423ed0
mov eax, dword [esp + 0xac]
add esp, 8
cmp eax, ebx
je 0x425de9
mov dl, byte [esi + 0x58]
cmp dl, byte [esp + 0xa8]
jne 0x425de9
mov al, byte [esi + 0x59]
cmp al, byte [esp + 0xa9]
jne 0x425de9
mov cl, byte [esi + 0x5a]
cmp cl, byte [esp + 0xaa]
jne 0x425de9
mov dl, byte [esi + 0x5b]
cmp dl, byte [esp + 0xab]
je 0x425e10
test byte [edi + 0xc], 0x10
je 0x425da0
push edi
call fcn.00459521
add esp, 4
lea edx, [esp + 0x2a0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], bl
jne 0x425e24
push 0x50
lea eax, [esp + 0x44]
push eax
push esi
call fcn.00458f80
add esp, 0xc
cmp dword [esp + 0x80], ebx
je 0x425f00
mov al, byte [esp + 0x86]
mov cl, byte [esp + 0x84]
mov dl, byte [esp + 0x85]
mov byte [esi + 0x64], al
cmp dword [esp + 0x88], ebx
mov byte [esi + 0x62], cl
mov cl, byte [esp + 0x87]
mov byte [esi + 0x61], 1
mov byte [esi + 0x63], dl
mov byte [esi + 0x65], cl
je 0x425f00
mov al, byte [esp + 0x8d]
mov dl, byte [esp + 0x8c]
mov cl, byte [esp + 0x8e]
mov byte [esi + 0x68], al
cmp dword [esp + 0x90], ebx
mov byte [esi + 0x67], dl
mov dl, byte [esp + 0x8f]
mov byte [esi + 0x66], 1
mov byte [esi + 0x69], cl
mov byte [esi + 0x6a], dl
je 0x425f00
mov al, byte [esp + 0x94]
mov cl, byte [esp + 0x95]
mov dl, byte [esp + 0x96]
mov byte [esi + 0x6c], al
mov al, byte [esp + 0x97]
mov byte [esi + 0x6f], al
cmp dword [esp + 0x98], ebx
mov byte [esi + 0x6b], 1
mov byte [esi + 0x6d], cl
mov byte [esi + 0x6e], dl
je 0x425f00
mov cl, byte [esp + 0x9c]
mov dl, byte [esp + 0x9d]
mov al, byte [esp + 0x9e]
mov byte [esi + 0x71], cl
mov cl, byte [esp + 0x9f]
mov byte [esi + 0x70], 1
mov byte [esi + 0x72], dl
mov byte [esi + 0x73], al
mov byte [esi + 0x74], cl
cmp dword [esp + 0xac], ebx
mov dl, byte [esp + 0xa0]
mov byte [esi + 0x51], dl
je 0x425f3f
mov al, byte [esp + 0xb0]
mov cl, byte [esp + 0xb1]
mov dl, byte [esp + 0xb2]
mov byte [esi + 0x5d], al
mov al, byte [esp + 0xb3]
mov byte [esi + 0x5c], 1
mov byte [esi + 0x5e], cl
mov byte [esi + 0x5f], dl
mov byte [esi + 0x60], al
cmp dword [esp + 0xb4], ebx
je 0x425f74
mov cl, byte [esp + 0xb8]
mov dl, byte [esp + 0xb9]
mov al, byte [esp + 0xba]
mov byte [esi + 0x76], cl
mov cl, byte [esp + 0xbb]
mov byte [esi + 0x75], 1
mov byte [esi + 0x77], dl
mov byte [esi + 0x78], al
mov byte [esi + 0x79], cl
cmp dword [esp + 0xbc], ebx
je 0x425fa9
mov dl, byte [esp + 0xc0]
mov al, byte [esp + 0xc1]
mov cl, byte [esp + 0xc2]
mov byte [esi + 0x53], dl
mov dl, byte [esp + 0xc3]
mov byte [esi + 0x52], 1
mov byte [esi + 0x54], al
mov byte [esi + 0x55], cl
mov byte [esi + 0x56], dl
cmp dword [esp + 0xc4], ebx
je 0x425fe4
mov al, byte [esp + 0xc8]
mov cl, byte [esp + 0xc9]
mov dl, byte [esp + 0xca]
mov byte [esi + 0x7c], al
mov al, byte [esp + 0xcb]
mov byte [esi + 0x7b], 1
mov byte [esi + 0x7d], cl
mov byte [esi + 0x7e], dl
mov byte [esi + 0x7f], al
mov byte [esi + 0x7a], 1
jmp 0x425fe8
mov byte [esi + 0x7a], 2
cmp dword [esp + 0xcc], ebx
je 0x42602c
mov cl, byte [esp + 0xd0]
mov dl, byte [esp + 0xd1]
mov al, byte [esp + 0xd2]
mov byte [esi + 0x81], cl
mov cl, byte [esp + 0xd3]
mov byte [esi + 0x80], 1
mov byte [esi + 0x82], dl
mov byte [esi + 0x83], al
mov byte [esi + 0x84], cl
lea eax, [esp + 0xd4]
lea edx, [esi + 0x85]
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x426040
mov dword [esp + 8], ebx
push edi
call fcn.00459521
add esp, 4
lea edx, [esp + 0x2a0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x2a0]
push edx
mov dword [esp + 0xc], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret