Function at 0x10052b90
Capabilities:
Create process on windows
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100693f8
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x1008af93]
test eax, eax
je 0x10052bd1
push str.AddIPAddr
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 0x228], 0
lea ecx, [ebp - 0x368]
call fcn.10001af0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.10001af0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.10001af0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.10001af0
mov byte [ebp - 4], 3
push 0x1006fa2e
lea ecx, [ebp - 0x22c]
call fcn.100017d0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.10013a30
add esp, 4
test eax, eax
jne 0x10052c9b
mov dword [ebp - 0x36c], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x22c]
call fcn.10001850
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.10001850
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.10001850
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.10001850
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368]
call fcn.10001850
mov eax, dword [ebp - 0x36c]
jmp 0x10053390
mov edx, dword [ebp + 8]
push edx
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
lea eax, [ebp - 0x364]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0x20219
push 0
lea edx, [ebp - 0x364]
push edx
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10053018
mov dword [ebp - 0x218], 0xff
mov dword [ebp - 0x224], 1
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x224]
push edx
push 0
push 0x10078748
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10052ffc
lea ecx, [ebp - 0x214]
push ecx
push 0x10078750
lea edx, [ebp - 0x368]
push edx
call fcn.100025d0
add esp, 0xc
push 0
lea ecx, [ebp - 0x368]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea eax, [ebp - 0x214]
push eax
push 0x10078770
lea ecx, [ebp - 0x368]
push ecx
call fcn.100025d0
add esp, 0xc
push 0
lea ecx, [ebp - 0x368]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [ebp + 0x20], 0
je 0x10052de2
call fcn.1003b3c0
movzx edx, al
test edx, edx
je 0x10052dae
lea eax, [ebp - 0x214]
push eax
push 0x10078794
lea ecx, [ebp - 0x368]
push ecx
call fcn.100025d0
add esp, 0xc
jmp 0x10052dc9
lea edx, [ebp - 0x214]
push edx
push 0x100787bc
lea eax, [ebp - 0x368]
push eax
call fcn.100025d0
add esp, 0xc
push 0
lea ecx, [ebp - 0x368]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10052f8b
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10013a30
add esp, 4
test eax, eax
jne 0x10052e5f
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x370], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x22c]
call fcn.10001850
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.10001850
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.10001850
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.10001850
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368]
call fcn.10001850
mov eax, dword [ebp - 0x370]
jmp 0x10053390
call fcn.1003b3c0
movzx eax, al
test eax, eax
je 0x10052e8c
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x214]
push edx
push 0x100787e8
lea eax, [ebp - 0x220]
push eax
call fcn.100025d0
add esp, 0x10
jmp 0x10052eab
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x214]
push edx
push 0x1007882c
lea eax, [ebp - 0x220]
push eax
call fcn.100025d0
add esp, 0x10
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.10013a30
add esp, 4
cmp eax, 8
jbe 0x10052edd
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x220]
push eax
push 0x1007886c
lea ecx, [ebp - 0x230]
push ecx
call fcn.100025d0
add esp, 0x10
jmp 0x10052eef
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x230]
call fcn.10002750
mov eax, dword [ebp + 0x18]
push eax
call fcn.10013a30
add esp, 4
cmp eax, 8
jbe 0x10052f40
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 0x230]
push edx
push 0x10078878
lea eax, [ebp - 0x368]
push eax
call fcn.100025d0
add esp, 0x10
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0x214]
push edx
push str.netsh_interface_ipv4_set_address_name__s__sourcestatic_gateway_s_gwmetric1
lea eax, [ebp - 0x22c]
push eax
call fcn.100025d0
add esp, 0x10
jmp 0x10052f52
lea ecx, [ebp - 0x230]
push ecx
lea ecx, [ebp - 0x368]
call fcn.10002750
push 0
lea ecx, [ebp - 0x368]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edx, dword [ebp + 0x18]
push edx
call fcn.10013a30
add esp, 4
cmp eax, 8
jbe 0x10052f8b
push 0
lea ecx, [ebp - 0x22c]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp + 0x1c]
push eax
call fcn.10013a30
add esp, 4
cmp eax, 8
jbe 0x10052ffc
call fcn.1003b3c0
movzx ecx, al
test ecx, ecx
je 0x10052fc9
mov edx, dword [ebp + 0x1c]
push edx
lea eax, [ebp - 0x214]
push eax
push 0x100788e8
lea ecx, [ebp - 0x368]
push ecx
call fcn.100025d0
add esp, 0x10
jmp 0x10052fe8
mov edx, dword [ebp + 0x1c]
push edx
lea eax, [ebp - 0x214]
push eax
push 0x10078914
lea ecx, [ebp - 0x368]
push ecx
call fcn.100025d0
add esp, 0x10
push 0
lea ecx, [ebp - 0x368]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x228], 1
jmp 0x10053333
lea eax, [ebp - 0x21c]
push eax
push 0x20119
push 0
lea ecx, [ebp - 0x364]
push ecx
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10053333
mov dword [ebp - 0x218], 0xff
mov dword [ebp - 0x224], 1
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x224]
push ecx
push 0
push str.Name
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005331c
lea eax, [ebp - 0x214]
push eax
push str.netsh_delete_arpcache_name__s_
lea ecx, [ebp - 0x368]
push ecx
call fcn.100025d0
add esp, 0xc
push 0
lea ecx, [ebp - 0x368]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea edx, [ebp - 0x214]
push edx
push str.netsh_delete_dns_name__s__addrall
lea eax, [ebp - 0x368]
push eax
call fcn.100025d0
add esp, 0xc
push 0
lea ecx, [ebp - 0x368]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [ebp + 0x20], 0
je 0x10053146
call fcn.1003b3c0
movzx ecx, al
test ecx, ecx
je 0x10053112
lea edx, [ebp - 0x214]
push edx
push str.netsh_interface_ipv4_set_dns___s__dhcp
lea eax, [ebp - 0x368]
push eax
call fcn.100025d0
add esp, 0xc
jmp 0x1005312d
lea ecx, [ebp - 0x214]
push ecx
push str.netsh_interface_ip_set_dns___s__dhcp
lea edx, [ebp - 0x368]
push edx
call fcn.100025d0
add esp, 0xc
push 0
lea ecx, [ebp - 0x368]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x100532ab
mov eax, dword [ebp + 0x10]
push eax
call fcn.10013a30
add esp, 4
test eax, eax
jne 0x100531c3
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x374], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x22c]
call fcn.10001850
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.10001850
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.10001850
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.10001850
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368]
call fcn.10001850
mov eax, dword [ebp - 0x374]
jmp 0x10053390
call fcn.1003b3c0
movzx edx, al
test edx, edx
je 0x100531f0
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x214]
push ecx
push str.netsh_interface_ipv4_set_address_name__s__sourcestatic_addr_s
lea edx, [ebp - 0x220]
push edx
call fcn.100025d0
add esp, 0x10
jmp 0x1005320f
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x214]
push ecx
push str.netsh_interface_ip_set_address_name__s__sourcestatic_addr_s
lea edx, [ebp - 0x220]
push edx
call fcn.100025d0
add esp, 0x10
mov eax, dword [ebp + 0x14]
push eax
call fcn.10013a30
add esp, 4
cmp eax, 8
jbe 0x10053241
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x220]
push edx
push str._s_mask_s
lea eax, [ebp - 0x230]
push eax
call fcn.100025d0
add esp, 0x10
jmp 0x10053253
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x230]
call fcn.10002750
mov edx, dword [ebp + 0x18]
push edx
call fcn.10013a30
add esp, 4
cmp eax, 8
jbe 0x10053285
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 0x230]
push ecx
push str._s_gateway_s_gwmetric1
lea edx, [ebp - 0x368]
push edx
call fcn.100025d0
add esp, 0x10
jmp 0x10053297
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x368]
call fcn.10002750
push 0
lea ecx, [ebp - 0x368]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.10013a30
add esp, 4
cmp eax, 8
jbe 0x1005331c
call fcn.1003b3c0
movzx edx, al
test edx, edx
je 0x100532e9
mov eax, dword [ebp + 0x1c]
push eax
lea ecx, [ebp - 0x214]
push ecx
push str.netsh_interface_ipv4_set_dns___s__static__s
lea edx, [ebp - 0x368]
push edx
call fcn.100025d0
add esp, 0x10
jmp 0x10053308
mov eax, dword [ebp + 0x1c]
push eax
lea ecx, [ebp - 0x214]
push ecx
push str.netsh_interface_ip_set_dns___s__static__s
lea edx, [ebp - 0x368]
push edx
call fcn.100025d0
add esp, 0x10
push 0
lea ecx, [ebp - 0x368]
call fcn.10001ae0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x228], 1
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x378], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x22c]
call fcn.10001850
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.10001850
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.10001850
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.10001850
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368]
call fcn.10001850
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret