Function at 0x42b2d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b0
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x46a5bd
mov eax, dword [ebp + 8]
push eax
call fcn.00445510
add esp, 8
push 0x40
push 0
lea ecx, [ebp - 0x150]
push ecx
call fcn.004456b0
add esp, 0xc
mov byte [ebp - 0x150], 0x37
lea edx, [ebp - 0x108]
mov dword [ebp - 0x14c], edx
mov eax, 0x100
mov word [ebp - 0x148], ax
lea ecx, [ebp - 0x150]
push ecx
call sub.NETAPI32.dll_Netbios
mov byte [ebp - 0x109], al
mov dword [ebp - 0x110], 0
jmp 0x42b353
mov edx, dword [ebp - 0x110]
add edx, 1
mov dword [ebp - 0x110], edx
movzx eax, byte [ebp - 0x108]
cmp dword [ebp - 0x110], eax
jge 0x42b463
push 0x40
push 0
lea ecx, [ebp - 0x150]
push ecx
call fcn.004456b0
add esp, 0xc
mov byte [ebp - 0x150], 0x32
mov edx, dword [ebp - 0x110]
mov al, byte [ebp + edx - 0x107]
mov byte [ebp - 0x120], al
lea ecx, [ebp - 0x150]
push ecx
call sub.NETAPI32.dll_Netbios
mov byte [ebp - 0x109], al
push 0x40
push 0
lea edx, [ebp - 0x150]
push edx
call fcn.004456b0
add esp, 0xc
mov byte [ebp - 0x150], 0x33
mov eax, dword [ebp - 0x110]
mov cl, byte [ebp + eax - 0x107]
mov byte [ebp - 0x120], cl
push 0x46e8e0
lea edx, [ebp - 0x146]
push edx
call fcn.00445510
add esp, 8
lea eax, [ebp - 0x3a8]
mov dword [ebp - 0x14c], eax
mov ecx, 0x258
mov word [ebp - 0x148], cx
lea edx, [ebp - 0x150]
push edx
call sub.NETAPI32.dll_Netbios
mov byte [ebp - 0x109], al
movzx eax, byte [ebp - 0x109]
test eax, eax
jne 0x42b45e
movzx ecx, byte [ebp - 0x3a3]
push ecx
movzx edx, byte [ebp - 0x3a4]
push edx
movzx eax, byte [ebp - 0x3a5]
push eax
movzx ecx, byte [ebp - 0x3a6]
push ecx
movzx edx, byte [ebp - 0x3a7]
push edx
movzx eax, byte [ebp - 0x3a8]
push eax
push str._02x_02x_02x_02x_02x_02x
mov ecx, dword [ebp + 8]
push ecx
call fcn.00445608
add esp, 0x20
jmp 0x42b463
jmp 0x42b344
mov edx, dword [ebp + 8]
push edx
call fcn.00445950
add esp, 4
test eax, eax
jne 0x42b5ce
push 0x46e910
push 0x46e914
call fcn.00448c8e
add esp, 8
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0
jne 0x42b4f3
mov dword [ebp - 0x3b0], 0
push 0
push str.command.com__c_getmac___C:medentmacadd.txt
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp - 0x3b0]
add eax, 1
mov dword [ebp - 0x3b0], eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x46e95c
push str.C:medentmacadd.txt
call fcn.00448c8e
add esp, 8
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0
jne 0x42b4f3
cmp dword [ebp - 0x3b0], 0x14
jl 0x42b4af
cmp dword [ebp - 0x3ac], 0
je 0x42b5ce
mov cl, byte [0x46a5be]
mov byte [ebp - 0x4b0], cl
push 0xfe
push 0
lea edx, [ebp - 0x4af]
push edx
call fcn.004456b0
add esp, 0xc
mov eax, dword [ebp - 0x3ac]
push eax
push 0xff
lea ecx, [ebp - 0x4b0]
push ecx
call fcn.00449395
add esp, 0xc
test eax, eax
je 0x42b5bf
movsx edx, byte [ebp - 0x4ae]
cmp edx, 0x2d
jne 0x42b5ba
movsx eax, byte [ebp - 0x4ab]
cmp eax, 0x2d
jne 0x42b5ba
movsx ecx, byte [ebp - 0x4a8]
cmp ecx, 0x2d
jne 0x42b5ba
movsx edx, byte [ebp - 0x4a5]
cmp edx, 0x2d
jne 0x42b5ba
movsx eax, byte [ebp - 0x4a2]
cmp eax, 0x2d
jne 0x42b5ba
lea ecx, [ebp - 0x4a1]
push ecx
lea edx, [ebp - 0x4a4]
push edx
lea eax, [ebp - 0x4a7]
push eax
lea ecx, [ebp - 0x4aa]
push ecx
lea edx, [ebp - 0x4ad]
push edx
lea eax, [ebp - 0x4b0]
push eax
push str._2.2s_2.2s_2.2s_2.2s_2.2s_2.2s
mov ecx, dword [ebp + 8]
push ecx
call fcn.00445608
add esp, 0x20
jmp 0x42b5bf
jmp 0x42b522
mov edx, dword [ebp - 0x3ac]
push edx
call fcn.004484c1
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret