Function at 0x42d414
Capabilities:
Create process on windows
Create process suspended
Get common file path
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push esi
push edi
mov dword [ebp - 4], eax
push str.In_Release_RenewIP
push 0x1b
call fcn.00403208
add esp, 8
mov esi, 0x54a918
lea edi, [ebp - 0x214]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0x104
push 0x104
push 0
lea eax, [ebp - 0x214]
push eax
call fcn.00525570
add esp, 0xc
push dword [ebp - 8]
lea edx, [ebp - 0x214]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov dword [ebp - 0xc], eax
push 0x44
push 0
push 0x57ec94
call fcn.00525570
add esp, 0xc
mov dword [0x57ec94], 0x44
push 0x10
push 0
push 0x57ecd8
call fcn.00525570
add esp, 0xc
push str.ipconfig.exe__release_all
lea ecx, [ebp - 0x110]
push ecx
call sub.USER32.DLL_wsprintfA
add esp, 8
mov word [0x57ecc4], 0
lea eax, [ebp - 0x110]
mov dword [0x57eca0], eax
mov dword [0x57ecc0], 1
mov dword [0x57ec94], 0x44
mov byte [0x547f53], 1
push 0x57ecd8
push 0x57ec94
lea edx, [ebp - 0x214]
push edx
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x42d6a6
mov byte [0x547c6c], 0
mov eax, dword [0x57ecd8]
mov dword [0x57a7e0], eax
push 0x7530
push 0
push 0x57a7dc
push 2
call sub.KERNEL32.DLL_WaitForMultipleObjects
push dword [0x57a7ec]
call sub.KERNEL32.DLL_ResetEvent
push 1
push dword [0x57ecd8]
call sub.KERNEL32.DLL_TerminateProcess
push 2
push dword [0x57ecdc]
call sub.KERNEL32.DLL_TerminateThread
push dword [0x57ecd8]
call sub.KERNEL32.DLL_CloseHandle
push dword [0x57ecdc]
call sub.KERNEL32.DLL_CloseHandle
push 0x44
push 0
push 0x57ec94
call fcn.00525570
add esp, 0xc
mov dword [0x57ec94], 0x44
push 0x10
push 0
push 0x57ecd8
call fcn.00525570
add esp, 0xc
push str.ipconfig.exe__renew_all
lea edx, [ebp - 0x110]
push edx
call sub.USER32.DLL_wsprintfA
add esp, 8
mov word [0x57ecc4], 0
lea ecx, [ebp - 0x110]
mov dword [0x57eca0], ecx
mov dword [0x57ecc0], 1
mov dword [0x57ec94], 0x44
mov byte [0x547f53], 2
push str.In_CreateProcess
push 0x1b
call fcn.00403208
add esp, 8
lea eax, [ebp - 0x110]
push eax
push str.szCom__s_n
push 0x1b
call fcn.00403208
add esp, 0xc
lea edx, [ebp - 0x214]
push edx
push str._path__s_n
push 0x1b
call fcn.00403208
add esp, 0xc
push 0x57ecd8
push 0x57ec94
lea ecx, [ebp - 0x214]
push ecx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x42d691
push str.In_WaitForSingleObject
push 0x1b
call fcn.00403208
add esp, 8
mov edx, dword [0x57ecd8]
mov dword [0x57a7e8], edx
push 0x15f90
push 0
push 0x57a7e4
push 2
call sub.KERNEL32.DLL_WaitForMultipleObjects
push dword [0x57a7f0]
call sub.KERNEL32.DLL_ResetEvent
push str.Out_WaitForSingleObject
push 0x1b
call fcn.00403208
add esp, 8
call sub.KERNEL32.DLL_GetLastError
push eax
push str.errorcode___d_n
push 0x1b
call fcn.00403208
add esp, 0xc
push 1
push dword [0x57ecd8]
call sub.KERNEL32.DLL_TerminateProcess
push 2
push dword [0x57ecdc]
call sub.KERNEL32.DLL_TerminateThread
push dword [0x57ecd8]
call sub.KERNEL32.DLL_CloseHandle
push dword [0x57ecdc]
call sub.KERNEL32.DLL_CloseHandle
mov byte [0x547c6c], 1
mov byte [0x547f53], 0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x94c]
call fcn.005114f4
push str.Out_Release_RenewIP
push 0x1b
call fcn.00403208
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret