Function at 0x447d80
Capabilities:
Create process on windows

Disassembly:
push ecx
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0xf0
push 0x2a2f
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, dword [sym.imp.SHELL32.dll_ShellExecuteW]
test eax, eax
je 0x447dcb
push 1
push 0
push 0x4b3d68
push 0x4b0574
push str.open
push dword [0x4def88]
call ebp
push ebx
push esi
push 0
push 0
push 0xf0
push 0x2a30
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x447ea0
push str.Kernel32.dll
mov dword [esp + 0x14], 0
call ebx
mov esi, eax
test esi, esi
jne 0x447e24
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x447e3e
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x447e3b
lea ecx, [esp + 0x10]
push ecx
call eax
push esi
call edi
mov ebx, dword [esp + 0x10]
push 1
push 0
push str._T:97__C_nbtstat__R
push 0x4b0574
push str.open
push dword [0x4def88]
call ebp
test ebx, ebx
je 0x447e9a
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Kernel32.dll
call eax
mov esi, eax
test esi, esi
jne 0x447e84
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x447e9a
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x447e97
push ebx
call eax
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
push 0xf0
push 0x2a31
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x447f65
push str.Kernel32.dll
mov dword [esp + 0x14], 0
call ebx
mov esi, eax
test esi, esi
jne 0x447eef
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x447f09
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x447f06
lea ecx, [esp + 0x10]
push ecx
call eax
push esi
call edi
mov ebx, dword [esp + 0x10]
push 1
push 0
push str._T:97__C_nbtstat__RR
push 0x4b0574
push str.open
push dword [0x4def88]
call ebp
test ebx, ebx
je 0x447f65
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.Kernel32.dll
call eax
mov esi, eax
test esi, esi
jne 0x447f4f
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x447f65
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x447f62
push ebx
call eax
push esi
call edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0xf0
push 0x2a32
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop ebx
test eax, eax
je 0x447fa9
push 1
push 0
push str._T:97__C_netsh_int_ip_reset
push 0x4b0574
push str.open
push dword [0x4def88]
call ebp
push 0
push 0
push 0xf0
push 0x2a33
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x447fe5
push 1
push 0
push str._T:97__C_netsh_winsock_reset
push 0x4b0574
push str.open
push dword [0x4def88]
call ebp
pop edi
pop ebp
pop ecx
ret