Function at 0x1003faf0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x80], 0
push 0x63
push 0
lea eax, [ebp - 0x7f]
push eax
call fcn.100139b0
add esp, 0xc
push 0x10072ce8
push 0x10072cec
call fcn.10015838
add esp, 8
mov dword [ebp - 4], eax
push 0x10072cf8
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10072d10
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x10072d28
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x10072d60
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10072db0
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x10072e00
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x64
push 0
lea ecx, [ebp - 0xe8]
push ecx
call fcn.100139b0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push str.strIPAddress__Array___s___n
lea eax, [ebp - 0xe8]
push eax
call fcn.10016875
add esp, 0xc
lea ecx, [ebp - 0xe8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x64
push 0
lea eax, [ebp - 0xe8]
push eax
call fcn.100139b0
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
push str.strSubnetMask__Array___s___n
lea edx, [ebp - 0xe8]
push edx
call fcn.10016875
add esp, 0xc
lea eax, [ebp - 0xe8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x64
push 0
lea edx, [ebp - 0xe8]
push edx
call fcn.100139b0
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
push str.strGateway__Array___s___n
lea ecx, [ebp - 0xe8]
push ecx
call fcn.10016875
add esp, 0xc
lea edx, [ebp - 0xe8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.strGatewayMetric__Array_1__n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10072eb0
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x10072ee0
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str._______________errEnable__objNetAdapter.EnableStatic_strIPAddress__strSubnetMask__n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str._______________errGateways__objNetAdapter.SetGateways_strGateway__strGatewaymetric__n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x10072f6c
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x10072fd8
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10072fe4
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x10072ff0
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x10072ffc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10073024
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x10073040
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x10073058
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10073064
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
mov eax, dword [ebp - 4]
push eax
call fcn.10015a42
add esp, 4
push 0x44
push 0
lea ecx, [ebp - 0x130]
push ecx
call fcn.100139b0
add esp, 0xc
push 0x10
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.100139b0
add esp, 0xc
mov dword [ebp - 0x130], 0x44
mov dword [ebp - 0x104], 1
xor eax, eax
mov word [ebp - 0x100], ax
mov ecx, dword [ebp + 8]
push ecx
push str.cscript_SetIp.vbs___s_
lea edx, [ebp - 0x80]
push edx
call fcn.10016875
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x130]
push ecx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
lea edx, [ebp - 0x80]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1003fdc9
jmp 0x1003fde0
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.SetIp.vbs
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret