Function at 0x428425
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cc770
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
mov dword [ebp - 0x1bc], ecx
cmp dword [0x5d3fc0], 0x6d
jl 0x428789
push 0xb0
mov ecx, dword [ebp - 0x1bc]
add ecx, 0xd0
call fcn.004b09fd
mov ecx, eax
call fcn.00414660
sub eax, 1
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x120], al
mov al, byte [ebp - 0x120]
mov byte [0x5d4379], al
mov ecx, dword [ebp - 0x120]
and ecx, 0xff
test ecx, ecx
jne 0x428769
push 0
push 0xb0
mov ecx, dword [ebp - 0x1bc]
add ecx, 0xd0
call fcn.004b09fd
mov ecx, eax
call fcn.004b0d06
mov byte [0x5d53e1], 1
push 0x528bf0
push 0x528bf4
push 0x528bfc
call fcn.0042908d
add esp, 0xc
push 0x528c0c
lea ecx, [ebp - 0x1b4]
call fcn.004ad180
mov dword [ebp - 4], 0
lea edx, [ebp - 0x1b4]
push edx
lea eax, [ebp - 0x1b8]
push eax
call fcn.0042c094
add esp, 4
mov dword [ebp - 0x1c0], eax
mov ecx, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c4], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1c4]
push edx
lea eax, [ebp - 0x124]
push eax
call fcn.004ad2ef
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1b8]
call fcn.004ad0c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1b4]
call fcn.004ad0c0
push 0
lea ecx, [ebp - 0x124]
call fcn.00406f50
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x128], 0
lea ecx, [ebp - 0x128]
push ecx
push 0x528c24
call fcn.004448bb
add esp, 8
cmp dword [ebp - 0x128], 0
je 0x4285a5
mov edx, dword [ebp - 0x128]
push edx
call fcn.004449bf
add esp, 4
cmp dword [ebp - 0x128], 0
jne 0x42856f
xor eax, eax
mov al, byte [0x5d4453]
test eax, eax
je 0x428609
push 0x62b800
push 0x62b7cc
push 0x62b7c8
call dword [sym.imp.RtlICS.dll_ICS_GetShare]
add esp, 0xc
and eax, 0xff
test eax, eax
je 0x428609
mov dword [0x62b7c8], 0
push 0x62b800
push 0x62b7cc
mov ecx, dword [0x62b7c8]
push ecx
call dword [sym.imp.RtlICS.dll_ICS_SetShare]
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.RtlICS.dll_ICS_Disable]
mov edx, dword [ebp - 0x120]
and edx, 0xff
test edx, edx
jne 0x42872b
lea ecx, [ebp - 0x12c]
call fcn.00406f30
mov byte [ebp - 4], 5
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x130], eax
push 0x80
push 0
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.00493430
add esp, 0xc
mov edx, dword [ebp - 0x130]
push edx
push 0x5d53e4
call fcn.00459fec
add esp, 8
and eax, 0xff
test eax, eax
je 0x4286d4
push 0x5d5274
mov eax, dword [ebp - 0x130]
push eax
push str.netsh_interface_ipv4__delete_address___s__addr_s_gatewayall
lea ecx, [ebp - 0x12c]
push ecx
call fcn.004a988a
add esp, 0x10
push 0
lea ecx, [ebp - 0x12c]
call fcn.00406f50
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edx, dword [ebp - 0x130]
push edx
push str.ipconfig__release___s_
lea eax, [ebp - 0x12c]
push eax
call fcn.004a988a
add esp, 0xc
push 0
lea ecx, [ebp - 0x12c]
call fcn.00406f50
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 1
push 0x5b8568
push 0x5b856c
push 0
push 1
call dword [sym.imp.RtlLib.dll_RT_SetVWiFi_TcpIpAddress]
add esp, 0x14
mov ecx, dword [ebp - 0x130]
push ecx
push str.ipconfig__renew___s_
lea edx, [ebp - 0x12c]
push edx
call fcn.004a988a
add esp, 0xc
push 0
lea ecx, [ebp - 0x12c]
call fcn.00406f50
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x12c]
call fcn.004ad0c0
call dword [sym.imp.RtlLib.dll_RT_ACM_SoftAP_Stop]
mov byte [0x5d53e1], 0
push 1
push 0xb0
mov ecx, dword [ebp - 0x1bc]
add ecx, 0xd0
call fcn.004b09fd
mov ecx, eax
call fcn.004b0d06
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x124]
call fcn.004ad0c0
mov al, byte [ebp - 0x120]
push eax
call dword [sym.imp.RtlLib.dll_RT_ACM_SoftAP_Enable]
add esp, 4
mov ecx, dword [ebp - 0x1bc]
call fcn.004245a9
jmp 0x428954
cmp dword [0x5d3fc0], 0x6b
jl 0x428797
jmp 0x428954
lea ecx, [ebp - 0x114]
call fcn.00406f30
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x11c]
call fcn.00406f30
mov byte [ebp - 4], 7
push 0x200
mov ecx, 0x5d3e18
call fcn.004ad4f0
push eax
lea ecx, [ebp - 0x10c]
call fcn.0042314e
push 0xb0
mov ecx, dword [ebp - 0x1bc]
add ecx, 0xd0
call fcn.004b09fd
mov ecx, eax
call fcn.00414660
sub eax, 1
neg eax
sbb eax, eax
inc eax
mov byte [0x5d3fbc], al
mov cl, byte [0x5d3fbc]
push ecx
call dword [sym.imp.RtlLib.dll_RT_EnableZeroConfig]
add esp, 4
xor edx, edx
mov dl, byte [0x5d3fbc]
test edx, edx
je 0x428832
push 0x528ca0
push 0x528ca4
push 0x528ca8
call fcn.0042908d
add esp, 0xc
jmp 0x428849
push 0x528cb8
push 0x528cbc
push 0x528cc0
call fcn.0042908d
add esp, 0xc
push str.Windows_Zero_Config
push str.Msg23_Title
push 0x528cf0
lea ecx, [ebp - 0x10c]
call fcn.004232f4
push eax
lea ecx, [ebp - 0x11c]
call fcn.004ad249
push str.You_are_in_Windows_Zero_Config_mode___
push str.Msg23_Value
push 0x528d30
lea ecx, [ebp - 0x10c]
call fcn.004232f4
push eax
lea ecx, [ebp - 0x114]
call fcn.004ad249
lea ecx, [ebp - 0x11c]
call fcn.00406f50
push eax
push 0
call fcn.00411030
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x4288fa
xor eax, eax
mov al, byte [0x5d3fc5]
test eax, eax
je 0x4288fa
xor ecx, ecx
mov cl, byte [0x5d3fbc]
test ecx, ecx
je 0x4288fa
push 0x40040
lea ecx, [ebp - 0x11c]
call fcn.00406f50
push eax
lea ecx, [ebp - 0x114]
call fcn.00406f50
push eax
call fcn.00410f70
mov edx, dword [eax + 0x1c]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov al, byte [0x5d3fc5]
test eax, eax
je 0x428933
push 0
mov ecx, dword [ebp - 0x1bc]
call fcn.00428962
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x42892e
push 1
mov ecx, dword [ebp - 0x118]
call fcn.0044ae11
call fcn.0043f022
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x11c]
call fcn.004ad0c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.004ad0c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret