Function at 0x4282ff
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5df0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x884
push esi
push edi
cmp dword [0x521a00], 0x67
jg 0x42832d
jmp 0x428a61
xor eax, eax
mov al, byte [0x521a05]
test eax, eax
jne 0x42833d
jmp 0x428a61
push 0x4f2bb0
lea ecx, [ebp - 0x874]
call fcn.004a3364
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x874]
push ecx
lea edx, [ebp - 0x878]
push edx
call fcn.0042c922
add esp, 4
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x888], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x888]
push ecx
lea edx, [ebp - 0x78]
push edx
call fcn.004a34d3
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x878]
call fcn.004a32a4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x874]
call fcn.004a32a4
push 0
lea ecx, [ebp - 0x78]
call fcn.00406f50
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [ebp - 0x864], 0xf
push 0x4f2bc8
lea ecx, [ebp - 0x87c]
call fcn.004a3364
mov byte [ebp - 4], 5
lea eax, [ebp - 0x87c]
push eax
lea ecx, [ebp - 0x880]
push ecx
call fcn.0042c922
add esp, 4
mov dword [ebp - 0x88c], eax
mov edx, dword [ebp - 0x88c]
mov dword [ebp - 0x890], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x890]
push eax
lea ecx, [ebp - 0x85c]
push ecx
call fcn.004a34d3
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x880]
call fcn.004a32a4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x87c]
call fcn.004a32a4
push 0x64
push 0
lea edx, [ebp - 0x74]
push edx
call fcn.0048a490
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.RtlLib.dll_RT_GetMacAddress]
add esp, 4
push 0x388
push 0
lea ecx, [ebp - 0x418]
push ecx
call fcn.0048a490
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.IpLib.dll_GetIpInformation]
add esp, 8
movsx ecx, byte [ebp - 0x418]
test ecx, ecx
jne 0x428510
cmp dword [ebp - 0x864], 0
je 0x428510
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x864]
sub edx, 1
mov dword [ebp - 0x864], edx
push 0x388
push 0
lea eax, [ebp - 0x418]
push eax
call fcn.0048a490
add esp, 0xc
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x74]
push edx
call dword [sym.imp.IpLib.dll_GetIpInformation]
add esp, 8
xor eax, eax
mov al, byte [0x521a05]
test eax, eax
jne 0x42850b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x85c]
call fcn.004a32a4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.004a32a4
jmp 0x428a61
jmp 0x428481
xor ecx, ecx
mov cl, byte [0x521a05]
test ecx, ecx
jne 0x42853f
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x85c]
call fcn.004a32a4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.004a32a4
jmp 0x428a61
movsx edx, byte [ebp - 0x418]
test edx, edx
jne 0x42856d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x85c]
call fcn.004a32a4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.004a32a4
jmp 0x428a61
push 0x578804
push 0x5787d0
push 0x5787cc
call dword [sym.imp.RtlICS.dll_Ordinal_3]
add esp, 0xc
and eax, 0xff
test eax, eax
je 0x42862b
cmp dword [0x5787cc], 0
jne 0x4285bd
push 0x5787d0
call fcn.0048a4f0
add esp, 4
test eax, eax
jne 0x4285bd
push 0x578804
call fcn.0048a4f0
add esp, 4
test eax, eax
je 0x42862b
push str._Set_IP_to_169.168.100.1__2_
call fcn.0040e045
add esp, 4
mov dword [ebp - 0x870], str.169.168.100.1
mov dword [ebp - 0x86c], 0x4f2c10
mov eax, dword [ebp - 0x86c]
push eax
mov ecx, dword [ebp - 0x870]
push ecx
push 0
push 0x505f74
call dword [sym.imp.RtlLib.dll_RT_SetSoftAP_TcpIpAddress]
add esp, 0x10
mov dword [0x5787cc], 0
push 0x578804
push 0x5787d0
mov edx, dword [0x5787cc]
push edx
call dword [sym.imp.RtlICS.dll_Ordinal_2]
add esp, 0xc
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.RtlICS.dll_CheckICS]
and eax, 0xff
test eax, eax
je 0x428645
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.RtlICS.dll_CheckICS]
and eax, 0xff
test eax, eax
jne 0x428661
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x428645
mov dword [0x5787cc], 1
mov eax, dword [ebp + 8]
push eax
push 0x505f74
mov ecx, dword [0x5787cc]
push ecx
call dword [sym.imp.RtlICS.dll_Ordinal_2]
add esp, 0xc
and eax, 0xff
test eax, eax
jne 0x4286e6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.RtlICS.dll_CheckICS]
and eax, 0xff
test eax, eax
je 0x4286b2
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.RtlICS.dll_CheckICS]
and eax, 0xff
test eax, eax
jne 0x4286ce
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4286b2
mov edx, dword [ebp + 8]
push edx
push 0x505f74
mov eax, dword [0x5787cc]
push eax
call dword [sym.imp.RtlICS.dll_Ordinal_2]
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.RtlICS.dll_Ordinal_5]
add esp, 4
push str._Set_IP_192.168.100.1__1_
call fcn.0040e045
add esp, 4
cmp dword [0x521a00], 0x6d
jge 0x428725
push 0x4f2c3c
push 0x4f2c4c
push 0
push 0x505f74
call dword [sym.imp.RtlLib.dll_RT_SetSoftAP_TcpIpAddress]
add esp, 0x10
jmp 0x428749
push 0x5060cc
push 0x5060d0
push 0x4f2c5c
push 0x4f2c6c
push 0
push 0x505f74
call dword [sym.imp.RtlLib.dll_RT_SetNicTcpipAddr]
add esp, 0x18
push 0
lea ecx, [ebp - 0x85c]
call fcn.00406f50
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
call dword [sym.imp.RtlICS.dll_CheckICS]
and eax, 0xff
test eax, eax
je 0x428777
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.RtlICS.dll_CheckICS]
and eax, 0xff
test eax, eax
jne 0x428793
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x428777
lea ecx, [ebp - 0x7c]
call fcn.00406f30
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x84]
call fcn.00406f30
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x88]
call fcn.00406f30
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x8c]
call fcn.00406f30
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x868]
call fcn.00406f30
mov byte [ebp - 4], 0xe
push 0x4f2c7c
lea ecx, [ebp - 0x7c]
call fcn.004a342d
push str.192.168.0.1
lea ecx, [ebp - 0x84]
call fcn.004a342d
push 0x4f2c94
lea ecx, [ebp - 0x88]
call fcn.004a342d
lea edx, [ebp - 0x74]
push edx
call dword [sym.imp.RtlLib.dll_RT_GetMacAddress]
add esp, 4
push 0x388
push 0
lea eax, [ebp - 0x418]
push eax
call fcn.0048a490
add esp, 0xc
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x74]
push edx
call dword [sym.imp.IpLib.dll_GetIpInformation]
add esp, 8
lea eax, [ebp - 0x418]
push eax
push 0x4f2ca4
lea ecx, [ebp - 0x7c]
push ecx
call fcn.0049faa5
add esp, 0xc
mov dword [ebp - 0x80], 0xa
lea ecx, [ebp - 0x88]
call fcn.00406f50
push eax
lea ecx, [ebp - 0x7c]
call fcn.0042e0a0
test eax, eax
je 0x42893d
xor edx, edx
mov dl, byte [0x521a05]
test edx, edx
je 0x42893d
cmp dword [0x521a4c], 2
je 0x4288a0
cmp dword [0x521a4c], 3
jne 0x42893d
cmp dword [ebp - 0x80], 0
je 0x42893d
push 0x5060d4
push 0x5060d8
push 0x4f2ca8
push 0x4f2cb8
push 0
push 0x505f74
call dword [sym.imp.RtlLib.dll_RT_SetNicTcpipAddr]
add esp, 0x18
push 0
lea ecx, [ebp - 0x85c]
call fcn.00406f50
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp - 0x80]
sub eax, 1
mov dword [ebp - 0x80], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x388
push 0
lea ecx, [ebp - 0x418]
push ecx
call fcn.0048a490
add esp, 0xc
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.IpLib.dll_GetIpInformation]
add esp, 8
lea ecx, [ebp - 0x418]
push ecx
push 0x4f2cc8
lea edx, [ebp - 0x7c]
push edx
call fcn.0049faa5
add esp, 0xc
jmp 0x42885e
mov dword [ebp - 0x10], 0xa
mov dword [ebp - 0x90], 0
lea eax, [ebp - 0x90]
push eax
push 0x4f2ccc
call fcn.00443e60
add esp, 8
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 1
jge 0x4289c8
cmp dword [ebp - 0x10], 0
je 0x4289c8
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
push 0x4f2cd8
call fcn.0040e045
add esp, 4
push 0
lea ecx, [ebp - 0x85c]
call fcn.00406f50
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x90]
push edx
push 0x4f2ce8
call fcn.00443e60
add esp, 8
mov dword [ebp - 0x860], eax
jmp 0x428968
lea eax, [ebp - 0x858]
push eax
call fcn.004386a8
add esp, 0xfffffbc4
mov ecx, 0x110
lea esi, [ebp - 0x858]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00440d30
add esp, 0x440
mov byte [0x521f48], 1
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x868]
call fcn.004a32a4
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x8c]
call fcn.004a32a4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x88]
call fcn.004a32a4
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x84]
call fcn.004a32a4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x7c]
call fcn.004a32a4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x85c]
call fcn.004a32a4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.004a32a4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret