Function at 0x409200
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x446044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor edi, edi
lea eax, [ebp - 0x217]
push edi
push eax
mov byte [ebp - 0x218], 0
call fcn.00426670
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x10f]
push edi
push ecx
mov byte [ebp - 0x110], 0
call fcn.00426670
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x11c
lea eax, [ebp - 0x338]
push edi
push eax
call fcn.00426670
add esp, 0xc
lea ecx, [ebp - 0x338]
push ecx
mov dword [ebp - 0x338], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x334], 6
jb 0x4095ee
call fcn.00409150
push str.Kernel32.dll
mov dword [0xc97d30], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x40931a
push str.GetPhysicallyInstalledSystemMemory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xc97d20
call eax
mov eax, dword [0xc97d24]
mov ecx, dword [0xc97d20]
cmp eax, edi
ja 0x4092e0
cmp ecx, 0x400
jbe 0x40930d
shrd ecx, eax, 0xa
shr eax, 0xa
mov dword [0xc97d28], ecx
mov dword [0xc97d2c], eax
cmp eax, edi
ja 0x4092fe
cmp ecx, 0x400
jbe 0x40930d
shrd ecx, eax, 0xa
shr eax, 0xa
mov dword [0xc97d1c], ecx
jmp 0x409313
mov dword [0xc97d1c], edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [0xc97d1c]
mov eax, dword [0xc97d2c]
mov ecx, dword [0xc97d28]
push edx
mov edx, dword [0xc97d24]
push eax
mov eax, dword [0xc97d20]
push ecx
mov ecx, dword [0xc97d30]
push edx
push eax
push ecx
push 0x43a5c8
push 0xc97518
call dword [sym.imp.USER32.dll_wsprintfW]
push 0xc97518
call fcn.00403960
add esp, 0x24
mov ecx, 0x43a62c
call fcn.00404710
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x4093bf
push 0x104
lea edx, [ebp - 0x110]
push 0
push edx
call fcn.00426670
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_delete_rule_name_ICMPv4_Inbound_
push ecx
call esi
add esp, 0xc
push 0
lea edx, [ebp - 0x110]
push edx
call edi
push 0x1f4
call ebx
mov ecx, 0x43a684
call fcn.00404710
test eax, eax
jne 0x40940c
push 0x104
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00426670
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_delete_rule_name_WinMasterServices_V7_Client7_
push edx
call esi
add esp, 0xc
push 0
lea eax, [ebp - 0x110]
push eax
call edi
push 0x1f4
call ebx
mov ecx, 0x43a6fc
call fcn.00404710
test eax, eax
jne 0x409459
push 0x104
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00426670
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_delete_rule_name_WinMasterRC_Slave7_
push eax
call esi
add esp, 0xc
push 0
lea ecx, [ebp - 0x110]
push ecx
call edi
push 0x1f4
call ebx
mov ecx, 0x43a758
call fcn.00404710
test eax, eax
jne 0x4094a6
push 0x104
push eax
lea edx, [ebp - 0x110]
push edx
call fcn.00426670
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_delete_rule_name_WinMasterFT_Slave7_
push ecx
call esi
add esp, 0xc
push 0
lea edx, [ebp - 0x110]
push edx
call edi
push 0x7d0
call ebx
call fcn.00404d40
test eax, eax
jne 0x4094ee
push 0x104
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00426670
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_add_rule_name_ICMPv4_Inbound__dirin_actionallow_enableyes_profileany_localipany_remoteipany_protocolicmpv4:8_any_interfacetypeany_edgeyes
push edx
call esi
add esp, 0xc
push 0
lea eax, [ebp - 0x110]
push eax
call edi
push 0x7d0
call ebx
mov edx, str.C:Program_FilesWW2017CFwmcSystem7.exe
mov ecx, str.WinMasterServices_V7_Client7
call fcn.00404f80
test eax, eax
jne 0x409540
push 0x104
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00426670
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_add_rule_name_WinMasterServices_V7_Client7__dirin_program_C:Program_FilesWW2017CFwmcSystem7.exe__actionallow_enableyes_profileany_localipany_remoteipany_protocolTCP_interfacetypeany_edgeyes
push eax
call esi
add esp, 0xc
push 0
lea ecx, [ebp - 0x110]
push ecx
call edi
push 0x1f4
call ebx
mov edx, str.C:Program_FilesWW2017CFwmcRCSlave7.exe
mov ecx, str.WinMasterRC_Slave7
call fcn.00404f80
test eax, eax
jne 0x409592
push 0x104
push eax
lea edx, [ebp - 0x110]
push edx
call fcn.00426670
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_add_rule_name_WinMasterRC_Slave7__dirin_program_C:Program_FilesWW2017CFwmcRCSlave7.exe__actionallow_enableyes_profileany_localipany_remoteipany_protocolTCP_interfacetypeany_edgeyes
push ecx
call esi
add esp, 0xc
push 0
lea edx, [ebp - 0x110]
push edx
call edi
push 0x1f4
call ebx
mov edx, str.C:Program_FilesWW2017CFwmcFTSlave7.exe
mov ecx, str.WinMasterFT_Slave7
call fcn.00404f80
test eax, eax
jne 0x409618
push 0x104
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00426670
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_add_rule_name_WinMasterFT_Slave7__dirin_program_C:Program_FilesWW2017CFwmcFTSlave7.exe__actionallow_enableyes_profileany_localipany_remoteipany_protocolTCP_interfacetypeany_edgeyes
push edx
call esi
add esp, 0xc
push 0
lea eax, [ebp - 0x110]
push eax
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x110]
push str._s_netsh.exe_firewall_set_icmpsetting_8_ENABLE
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push edi
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e7be
mov esp, ebp
pop ebp
ret