Function at 0x43fda0
Capabilities:
Create process on windows
Reference google public dns server
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6459f3
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x6bc858]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, 0x10
mov dword [ebp - 0xdc], 0
lea esi, [ebx + 0xc8]
cmp dword [ebx + 0xdc], edi
jb 0x43fdf1
mov eax, dword [esi]
jmp 0x43fdf3
mov eax, esi
test eax, eax
jne 0x43fdfe
call fcn.004c35a0
jmp 0x43fe09
push 0
push eax
call fcn.005fc7e0
add esp, 8
test eax, eax
je 0x43fe32
cmp dword [ebx + 0xdc], edi
jb 0x43fe17
mov esi, dword [esi]
push 0x67f510
push esi
call fcn.005f5530
add esp, 8
test eax, eax
je 0x43fe44
push eax
call fcn.005f64a0
add esp, 4
cmp dword [ebx + 0x9c], edi
lea edi, [ebx + 0x88]
jb 0x43fe6c
mov esi, dword [edi]
jmp 0x43fe6e
push str.Cache
push 0x7d
push str.DHCPManager.cpp
push 0x6c5bd8
mov edx, str.CDHCPManager::WriteIniFile
mov ecx, 0x12c
call fcn.004ccb50
add esp, 0x10
jmp 0x440876
mov esi, edi
test esi, esi
jne 0x43fe79
call fcn.004c35a0
jmp 0x43fe84
push 0
push esi
call fcn.005fc7e0
add esp, 8
test eax, eax
jne 0x43fe99
push esi
call fcn.005fc970
add esp, 4
test eax, eax
jne 0x440856
cmp dword [ebx + 0x9c], 0x10
jb 0x43fea6
mov eax, dword [edi]
jmp 0x43fea8
mov eax, edi
push 0x67f510
push eax
call fcn.005f5530
add esp, 8
test eax, eax
je 0x44082e
push eax
call fcn.005f64a0
add esp, 4
lea eax, [ebp - 0xd8]
push eax
call fcn.004c50e0
mov dword [ebp - 4], 0
cmp dword [ebx + 0x9c], 0x10
jb 0x43fee7
mov esi, dword [edi]
jmp 0x43fee9
mov esi, edi
lea edi, [ebp - 0xd8]
call fcn.004c52c0
cmp dword [ebx + 0x3c], 0x10
jb 0x43feff
mov eax, dword [ebx + 0x28]
jmp 0x43ff02
lea eax, [ebx + 0x28]
push eax
lea ecx, [ebp - 0xd8]
push ecx
mov edx, 0x6745b6
mov ecx, str.LISTEN_ON
call fcn.004c6c70
mov edi, 0x10
cmp dword [ebx + 0x11c], edi
jb 0x43ff2e
mov ecx, dword [ebx + 0x108]
jmp 0x43ff34
lea ecx, [ebx + 0x108]
cmp dword [ebx + 0xfc], edi
jb 0x43ff44
mov eax, dword [ebx + 0xe8]
jmp 0x43ff4a
lea eax, [ebx + 0xe8]
push ecx
push eax
push 0x67f550
lea ecx, [ebp - 0x88]
call fcn.004d2ae0
add esp, 0xc
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x70], edi
jae 0x43ff74
lea eax, [ebp - 0x84]
push eax
lea edx, [ebp - 0xd8]
push edx
mov edx, str.DHCPRange
mov ecx, str.RANGE_SET
call fcn.004c6c70
cmp dword [ebx + 0x5c], edi
jb 0x43ff95
mov eax, dword [ebx + 0x48]
jmp 0x43ff98
lea eax, [ebx + 0x48]
push eax
lea eax, [ebp - 0xd8]
push eax
mov edx, str.SubnetMask
mov ecx, str.RANGE_SET
call fcn.004c6c70
xor esi, esi
cmp dword [ebx + 0x178], esi
jne 0x43ffc9
lea ecx, [ebx + 0x164]
push str.7200
call fcn.004124a0
cmp dword [ebx + 0x17c], edi
jb 0x43ffd9
mov eax, dword [ebx + 0x168]
jmp 0x43ffdf
lea eax, [ebx + 0x168]
push eax
lea ecx, [ebp - 0xd8]
push ecx
mov edx, str.AddressTime
mov ecx, str.RANGE_SET
call fcn.004c6c70
mov dword [ebp - 0x48], esi
push 8
mov byte [ebp - 4], 2
call fcn.005f0fe0
add esp, 4
cmp eax, esi
je 0x4407fb
mov dword [ebp - 0x48], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x48]
mov dword [eax], edx
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], esi
mov byte [ebp - 0x44], cl
mov byte [ebp - 4], 3
mov eax, dword [ebx + 0x138]
cmp eax, esi
je 0x4400f7
cmp dword [ebx + 0x158], esi
je 0x440094
cmp dword [ebx + 0x15c], edi
jb 0x44005a
mov ecx, dword [ebx + 0x148]
jmp 0x440060
lea ecx, [ebx + 0x148]
cmp dword [ebx + 0x13c], edi
jb 0x440070
mov eax, dword [ebx + 0x128]
jmp 0x440076
lea eax, [ebx + 0x128]
push ecx
push eax
push 0x67f590
lea ecx, [ebp - 0xa8]
call fcn.004d2ae0
add esp, 0xc
mov byte [ebp - 4], 4
jmp 0x440186
cmp eax, esi
je 0x4400f7
cmp dword [ebx + 0x158], esi
jne 0x4400f3
lea esi, [ebx + 0x144]
push str.8.8.8.8
mov ecx, esi
call fcn.004124a0
cmp dword [esi + 0x18], edi
jb 0x4400bc
mov esi, dword [esi + 4]
jmp 0x4400bf
add esi, 4
cmp dword [ebx + 0x13c], edi
jb 0x4400cf
mov eax, dword [ebx + 0x128]
jmp 0x4400d5
lea eax, [ebx + 0x128]
push esi
push eax
push 0x67f590
lea ecx, [ebp - 0xa8]
call fcn.004d2ae0
add esp, 0xc
mov byte [ebp - 4], 5
jmp 0x440186
cmp eax, esi
jne 0x44014f
cmp dword [ebx + 0x158], esi
je 0x44014f
lea esi, [ebx + 0x124]
push str.8.8.8.8
mov ecx, esi
call fcn.004124a0
cmp dword [ebx + 0x15c], edi
jb 0x440121
mov eax, dword [ebx + 0x148]
jmp 0x440127
lea eax, [ebx + 0x148]
cmp dword [esi + 0x18], edi
jb 0x440131
mov esi, dword [esi + 4]
jmp 0x440134
add esi, 4
push eax
push esi
push 0x67f590
lea ecx, [ebp - 0xa8]
call fcn.004d2ae0
add esp, 0xc
mov byte [ebp - 4], 6
jmp 0x440186
lea esi, [ebx + 0x124]
push str.8.8.8.8
mov ecx, esi
call fcn.004124a0
cmp dword [esi + 0x18], edi
jb 0x44016b
mov esi, dword [esi + 4]
jmp 0x44016e
add esi, 4
push esi
push 0x675fac
lea ecx, [ebp - 0xa8]
call fcn.004d2ae0
add esp, 8
mov byte [ebp - 4], 7
mov esi, eax
lea edi, [ebp - 0x48]
call fcn.00419940
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 3
call fcn.00412410
mov eax, dword [ebp - 0x44]
mov edi, 0x10
cmp dword [ebp - 0x30], edi
jae 0x4401af
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0xd8]
push ecx
mov edx, str.DomainServer
mov ecx, str.RANGE_SET
call fcn.004c6c70
cmp dword [ebx + 0x3c], edi
jb 0x4401d0
mov eax, dword [ebx + 0x28]
jmp 0x4401d3
lea eax, [ebx + 0x28]
push eax
lea edx, [ebp - 0xd8]
push edx
mov edx, str.Router
mov ecx, str.RANGE_SET
call fcn.004c6c70
lea eax, [ebp - 0xec]
lea esi, [ebx + 0x1b8]
push eax
push esi
mov dword [ebp - 0xf8], esi
call fcn.0041e6d0
mov byte [ebp - 4], 8
cmp dword [ebx + 0xbc], edi
jb 0x440217
mov ebx, dword [ebx + 0xa8]
jmp 0x44021d
add ebx, 0xa8
push 0x67f510
push ebx
call fcn.005f5530
add esp, 8
lea ecx, [ebp - 0x138]
push ecx
push esi
mov dword [ebp - 0xf4], eax
call fcn.0046b950
mov esi, eax
lea edi, [ebp - 0xec]
mov byte [ebp - 4], 9
call fcn.00442240
test al, al
push 3
lea ecx, [ebp - 0xf0]
sete bl
mov byte [ebp - 4], 8
call fcn.00564140
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0xa
call fcn.00413660
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 8
call fcn.00564180
test bl, bl
je 0x4406e3
lea esi, [ebp - 0xec]
call fcn.004427a0
cmp dword [eax + 0x18], 0x10
jb 0x4402a1
mov eax, dword [eax + 4]
jmp 0x4402a4
add eax, 4
push eax
push 0x675fac
lea ecx, [ebp - 0x68]
call fcn.004d2ae0
add esp, 8
lea esi, [ebp - 0xec]
mov byte [ebp - 4], 0xb
call fcn.004427a0
lea ebx, [eax + 0x20]
mov eax, dword [ebx + 0x14]
push str.0.0.0.0
mov edi, 7
call fcn.004127d0
test eax, eax
je 0x440579
call fcn.004427a0
cmp dword [eax + 0x34], 0
je 0x440579
call fcn.004427a0
mov ecx, 0x10
cmp dword [eax + 0x38], ecx
jb 0x440304
mov eax, dword [eax + 0x24]
jmp 0x440307
add eax, 0x24
cmp dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x64]
jae 0x440312
lea ecx, [ebp - 0x64]
push eax
lea edx, [ebp - 0xd8]
push edx
mov edx, 0x67f5b8
call fcn.004c6c70
cmp dword [ebp - 0xf4], 0
je 0x4405cc
lea eax, [ebp - 0x108]
push eax
call fcn.004195e0
push 0x674cb8
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0xc
call fcn.00412330
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xd
call fcn.004d2460
add esp, 4
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0xc
call fcn.00412410
xor eax, eax
lea edx, [ebp - 0x12c]
mov dword [ebp - 0x17], eax
mov byte [ebp - 0x13], al
mov dword [ebp - 0xe0], eax
push edx
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 0x18], 0
call fcn.004c94d0
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0xe0], 6
jge 0x4403e1
lea ecx, [ebp - 0x168]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.00434830
mov byte [ebp - 4], 0x10
or dword [ebp - 0xdc], 1
mov esi, eax
lea edi, [ebp - 0x12c]
call fcn.00419af0
test al, al
jne 0x4403e1
mov bl, 1
jmp 0x4403e3
xor bl, bl
mov dword [ebp - 4], 0xe
test byte [ebp - 0xdc], 1
je 0x440425
and dword [ebp - 0xdc], 0xfffffffe
push 3
lea ecx, [ebp - 0x110]
call fcn.00564140
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x11
call fcn.00413660
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0xe
call fcn.00564180
test bl, bl
je 0x4404a1
lea esi, [ebp - 0x12c]
call fcn.00419a70
cmp dword [eax + 0x18], 0x10
jb 0x44043f
mov eax, dword [eax + 4]
jmp 0x440442
add eax, 4
push 0x10
push 0
push eax
call fcn.005f9660
mov ecx, dword [ebp - 0xe0]
add esp, 0xc
lea edx, [ebp - 0x150]
push edx
lea ebx, [ebp - 0x12c]
mov byte [ebp + ecx - 0x18], al
call fcn.004198d0
inc dword [ebp - 0xe0]
push 3
lea ecx, [ebp - 0x114]
call fcn.00564140
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0xf
call fcn.00413660
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0xe
call fcn.00564180
jmp 0x4403a5
push 3
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0xc
call fcn.00564140
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0x12
call fcn.00413660
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0xc
call fcn.00564180
lea esi, [ebp - 0xec]
call fcn.004427a0
cmp dword [eax + 0x38], 0x10
jb 0x4404e6
mov eax, dword [eax + 0x24]
jmp 0x4404e9
add eax, 0x24
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edx, dword [ebp - 0xf4]
xor ecx, ecx
mov dword [ebp - 0x27], ecx
push edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x23], ecx
push 0x10
mov dword [ebp - 0x1f], ecx
mov dword [ebp - 0x24], eax
mov word [ebp - 0x1b], cx
mov byte [ebp - 0x19], cl
mov cx, word [ebp - 0x14]
lea eax, [ebp - 0x28]
push 1
push eax
mov word [ebp - 0x20], cx
call fcn.005f5d70
add esp, 0x10
lea ebx, [ebp - 0x108]
mov byte [ebp - 4], 0x13
call fcn.004197d0
mov ecx, dword [ebp - 0x104]
push ecx
call fcn.005f0cb0
add esp, 4
mov ecx, ebx
mov byte [ebp - 4], 0x14
call fcn.0040ed70
mov edx, dword [ebp - 0x108]
push edx
call fcn.005f0cb0
add esp, 4
mov ecx, ebx
mov dword [ebp - 0x108], 0
mov byte [ebp - 4], 0xb
call fcn.0040ed70
jmp 0x4405cc
lea esi, [ebp - 0xec]
call fcn.004427a0
lea ebx, [eax + 0x20]
mov eax, dword [ebx + 0x14]
push str.0.0.0.0
call fcn.004127d0
test eax, eax
jne 0x4405cc
call fcn.004427a0
mov ecx, 0x10
cmp dword [eax + 0x38], ecx
jb 0x4405ac
mov eax, dword [eax + 0x24]
jmp 0x4405af
add eax, 0x24
cmp dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x64]
jae 0x4405ba
lea ecx, [ebp - 0x64]
push eax
lea eax, [ebp - 0xd8]
push eax
mov edx, 0x67f5b8
call fcn.004c6c70
lea ecx, [ebp - 0x15c]
push ecx
lea ebx, [ebp - 0xec]
call fcn.00441e10
push 3
lea ecx, [ebp - 0x120]
call fcn.00564140
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 0x15
call fcn.00413660
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 0xb
call fcn.00564180
cmp dword [ebp - 0x50], 0x10
jb 0x44061b
mov edx, dword [ebp - 0x64]
push edx
call fcn.005f0cb0
add esp, 4
xor esi, esi
mov dword [ebp - 0x50], 0xf
mov dword [ebp - 0x54], esi
mov byte [ebp - 0x64], 0
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x68], esi
je 0x440673
push 3
lea ecx, [ebp - 0x11c]
call fcn.00564140
mov eax, dword [ebp - 0x68]
cmp dword [eax + 4], esi
je 0x440662
lea esp, [esp]
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov edx, dword [eax + 4]
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
cmp ecx, esi
jne 0x440650
mov edx, dword [ebp - 0x68]
lea ecx, [ebp - 0x11c]
mov dword [edx + 4], esi
call fcn.00564180
mov eax, dword [ebp - 0x68]
push eax
call fcn.005f0cb0
add esp, 4
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0xf8]
push ecx
push edx
call fcn.0046b950
mov esi, eax
lea edi, [ebp - 0xec]
mov byte [ebp - 4], 9
call fcn.00442240
test al, al
push 3
lea ecx, [ebp - 0xf0]
sete bl
mov byte [ebp - 4], 8
call fcn.00564140
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0xa
call fcn.00413660
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 8
call fcn.00564180
test bl, bl
jne 0x44028b
mov eax, dword [ebp - 0xf4]
xor edi, edi
cmp eax, edi
je 0x4406f8
push eax
call fcn.005f64a0
add esp, 4
mov edx, dword [ebp - 0xd4]
mov ebx, 0x10
cmp dword [ebp - 0xc0], ebx
jae 0x440711
lea edx, [ebp - 0xd4]
lea ecx, [ebp - 0xd8]
call fcn.004c8030
push 3
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 3
call fcn.00564140
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 0x17
call fcn.00413660
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 3
call fcn.00564180
cmp dword [ebp - 0x30], ebx
jb 0x44075c
mov eax, dword [ebp - 0x44]
push eax
call fcn.005f0cb0
add esp, 4
mov esi, 0xf
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edi
mov byte [ebp - 0x44], 0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x18
call fcn.0040ed70
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.005f0cb0
add esp, 4
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], edi
mov byte [ebp - 4], 1
call fcn.0040ed70
cmp dword [ebp - 0x70], ebx
jb 0x4407a6
mov edx, dword [ebp - 0x84]
push edx
call fcn.005f0cb0
add esp, 4
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x74], edi
mov byte [ebp - 0x84], 0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x19
call fcn.0040ed70
mov eax, dword [ebp - 0x88]
push eax
call fcn.005f0cb0
add esp, 4
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], edi
mov byte [ebp - 4], 0
call fcn.0040ed70
lea ecx, [ebp - 0xd8]
push ecx
mov dword [ebp - 4], 0xffffffff
call fcn.004c5220
jmp 0x440876
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x10c], esi
call fcn.005f41f0
push 0x6a361c
lea eax, [ebp - 0x144]
push eax
mov dword [ebp - method.std::bad_alloc.virtual_0], vtable.std::bad_alloc.0
call fcn.006009e0
push 0x67f5bc
push 0xd7
push str.DHCPManager.cpp
push 0x6c5bd8
mov edx, str.CDHCPManager::WriteIniFile
mov ecx, 0x12c
call fcn.004ccb50
add esp, 0x10
jmp 0x440876
xor eax, eax
push eax
push str.TASKKILL__F__IM_wifidayrom.exe
mov dword [ebx + 0x184], eax
mov dword [ebx + 0x18c], eax
mov dword [ebx + 0x188], eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005f0da0
mov esp, ebp
pop ebp
ret