Function at 0x409ad0
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x217]
push 0
push eax
mov byte [ebp - 0x218], 0
call fcn.004279d0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x10f]
push 0
push ecx
mov byte [ebp - 0x110], 0
call fcn.004279d0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x11c
lea eax, [ebp - 0x338]
push 0
push eax
call fcn.004279d0
add esp, 0xc
lea ecx, [ebp - 0x338]
push ecx
mov dword [ebp - 0x338], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x334], 6
jb 0x409d4c
mov edx, 0x439a04
mov ecx, str.ICMPv4_Inbound
call fcn.004050a0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x409bd1
push 0x104
lea edx, [ebp - 0x110]
push 0
push edx
call fcn.004279d0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_add_rule_name_ICMPv4_Inbound__dirin_actionallow_enableyes_profileany_localipany_remoteipany_protocolicmpv4:8_any_interfacetypeany_edgeyes
push ecx
call esi
add esp, 0xc
push 0
lea edx, [ebp - 0x110]
push edx
call edi
push 0x7d0
call ebx
mov edx, str.C:Program_FilesWW2017CFwmcSystem7.exe
mov ecx, str.WinMaster_Client7
call fcn.004050a0
push 0x104
push 0
test eax, eax
jne 0x409c1d
lea eax, [ebp - 0x110]
push eax
call fcn.004279d0
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_add_rule_name_WinMaster_Client7__dirin_program_C:Program_FilesWW2017CFwmcSystem7.exe__actionallow_enableyes_profileany_localipany_remoteipany_protocolTCP_interfacetypeany_edgeyes
push edx
call esi
add esp, 0xc
push 0
lea eax, [ebp - 0x110]
push eax
jmp 0x409c4d
lea ecx, [ebp - 0x110]
push ecx
call fcn.004279d0
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_delete_rule_name_WinMasterServices_V7_Client7_
push eax
call esi
add esp, 0xc
push 0
lea ecx, [ebp - 0x110]
push ecx
call edi
push 0x1f4
call ebx
mov edx, str.C:Program_FilesWW2017CFwmcRCSlave7.exe
mov ecx, str.WinMasterRC_Slave7
call fcn.004050a0
test eax, eax
jne 0x409ca8
push 0x104
push eax
lea edx, [ebp - 0x110]
push edx
call fcn.004279d0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_add_rule_name_WinMasterRC_Slave7__dirin_program_C:Program_FilesWW2017CFwmcRCSlave7.exe__actionallow_enableyes_profileany_localipany_remoteipany_protocolTCP_interfacetypeany_edgeyes
push ecx
call esi
add esp, 0xc
push 0
lea edx, [ebp - 0x110]
push edx
call edi
push 0x1f4
call ebx
mov edx, str.C:Program_FilesWW2017CFwmcRCSlaveX7.exe
mov ecx, str.WinMasterRC_SlaveX7
call fcn.004050a0
test eax, eax
jne 0x409cfa
push 0x104
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004279d0
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_add_rule_name_WinMasterRC_SlaveX7__dirin_program_C:Program_FilesWW2017CFwmcRCSlaveX7.exe__actionallow_enableyes_profileany_localipany_remoteipany_protocolTCP_interfacetypeany_edgeyes
push edx
call esi
add esp, 0xc
push 0
lea eax, [ebp - 0x110]
push eax
call edi
push 0x1f4
call ebx
mov edx, str.C:Program_FilesWW2017CFwmcFTSlave7.exe
mov ecx, str.WinMasterFT_Slave7
call fcn.004050a0
test eax, eax
jne 0x409d4c
push 0x104
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.004279d0
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x110]
push str._s_netsh.exe_advfirewall_firewall_add_rule_name_WinMasterFT_Slave7__dirin_program_C:Program_FilesWW2017CFwmcFTSlave7.exe__actionallow_enableyes_profileany_localipany_remoteipany_protocolTCP_interfacetypeany_edgeyes
push eax
call esi
add esp, 0xc
push 0
lea ecx, [ebp - 0x110]
push ecx
call edi
push 0x1f4
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret