Function at 0x1003f8b0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x80], 0
push 0x63
push 0
lea eax, [ebp - 0x7f]
push eax
call fcn.100139b0
add esp, 0xc
push 0x10073090
push 0x10073094
call fcn.10015838
add esp, 8
mov dword [ebp - 4], eax
push str.sub_CHANGEIP_Cardid__n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.____strComputer___.__n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.____Set_objWMIService__GetObject__winmgmts:____n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.__________impersonationLevelimpersonate____strComputer____rootcimv2___n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.____Set_colNetAdapters__objWMIService.ExecQuery___n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.__________Select__from_Win32_NetworkAdapterConfiguration_where_IPEnabledTRUE___n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.____For_Each_objNetAdapter_in_colNetAdapters_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str._t________If_objNetAdapter.SettingID__Cardid_Then_n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str._______________errEnable__objNetAdapter.EnableDHCP___n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str._______________errEnable__objNetAdapter.ReleaseDHCPLease___n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str._t________End_If_n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x100732d0
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x100732dc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x100732e8
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x100732f4
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.____priv_con__objArgs_0__n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.____CHANGEIP_priv_con__n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x10073350
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x1007335c
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
mov edx, dword [ebp - 4]
push edx
call fcn.10015a42
add esp, 4
push 0x44
push 0
lea eax, [ebp - 0xc8]
push eax
call fcn.100139b0
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.100139b0
add esp, 0xc
mov dword [ebp - 0xc8], 0x44
mov dword [ebp - 0x9c], 1
xor edx, edx
mov word [ebp - 0x98], dx
mov eax, dword [ebp + 8]
push eax
push str.cscript_DHCP.vbs___s_
lea ecx, [ebp - 0x80]
push ecx
call fcn.10016875
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0xc8]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
lea ecx, [ebp - 0x80]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1003fabe
jmp 0x1003fad5
push 0xffffffffffffffff
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.DHCP.vbs
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret