Function at 0x433100
Capabilities:
Check os version
Create process on windows
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x43e268]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x238], 0x94
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x444], 0
mov byte [ebp - 0x198], 0
push 0x7f
push 0
lea ecx, [ebp - 0x197]
push ecx
call fcn.00409ed0
add esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x437098
push 0x4370a0
call fcn.0041a610
add esp, 8
push str.RTLDHCP.exe_Command:
call fcn.0041a610
add esp, 4
mov dword [ebp - 4], 0
jmp 0x43319a
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jge 0x4331bb
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + ecx*4]
push eax
push 0x4370c0
call fcn.0041a610
add esp, 8
jmp 0x433191
push 0x4370c4
call fcn.0041a610
add esp, 4
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea ecx, [ebp - 0x117]
push ecx
call fcn.00409ed0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x118]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x440], 0
push 0x203
push 0
lea eax, [ebp - 0x43f]
push eax
call fcn.00409ed0
add esp, 0xc
cmp dword [ebp - 0x19c], 0
je 0x4337e4
cmp dword [ebp - 0x228], 2
jb 0x4337e4
cmp dword [ebp + 8], 1
jle 0x4334d0
push 0x4370c8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4334d0
call fcn.0041a280
call fcn.00433830
call fcn.00418dc0
movzx eax, al
test eax, eax
je 0x4334b7
push 0x4370cc
push 0x4370d4
call fcn.0041a610
add esp, 8
push 0x4370dc
call fcn.0041a610
add esp, 4
push 0
push 0x4370f4
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x437130
push 0x437138
call fcn.0041a610
add esp, 8
push 0x437140
call fcn.0041a610
add esp, 4
push 0
push 0x43715c
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x43719c
push 0x4371a4
call fcn.0041a610
add esp, 8
push str.Delete_RTLDNS_Port.._n
call fcn.0041a610
add esp, 4
push 0
push str.netsh_advfirewall_firewall_delete_rule_name_RTLDNS_Port_
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x437200
push 0x437208
call fcn.0041a610
add esp, 8
push 0x437210
call fcn.0041a610
add esp, 4
push 0
push str.netsh_advfirewall_firewall_delete_rule_name_RTLDNS_Port_2_
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x437268
push 0x437270
call fcn.0041a610
add esp, 8
push str.Create_RTLDHCP_Port.._n
call fcn.0041a610
add esp, 4
lea ecx, [ebp - 0x118]
push ecx
push 0x437290
push 0x204
lea edx, [ebp - 0x440]
push edx
call fcn.004073f6
add esp, 0x10
push 0
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x437324
push 0x43732c
call fcn.0041a610
add esp, 8
push str.Create_RTLDHCP_Port_2.._n
call fcn.0041a610
add esp, 4
lea ecx, [ebp - 0x118]
push ecx
push 0x437350
push 0x204
lea edx, [ebp - 0x440]
push edx
call fcn.004073f6
add esp, 0x10
push 0
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4373e4
push 0x4373ec
call fcn.0041a610
add esp, 8
push str.Create_RTLDNS_Port.._n
call fcn.0041a610
add esp, 4
lea ecx, [ebp - 0x118]
push ecx
push str.netsh_advfirewall_firewall_add_rule_name_RTLDNS_Port__program__s__protocolTCP_dirin_localport53_actionallow_profileprivate_public_domain
push 0x204
lea edx, [ebp - 0x440]
push edx
call fcn.004073f6
add esp, 0x10
push 0
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4374a0
push 0x4374a8
call fcn.0041a610
add esp, 8
push str.Create_RTLDNS_Port_2.._n
call fcn.0041a610
add esp, 4
lea ecx, [ebp - 0x118]
push ecx
push str.netsh_advfirewall_firewall_add_rule_name_RTLDNS_Port_2__program__s__protocolUDP_dirin_localport53_actionallow_profileprivate_public_domain
push 0x204
lea edx, [ebp - 0x440]
push edx
call fcn.004073f6
add esp, 0x10
push 0
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x43f063], 1
jmp 0x4334cb
push 0
push 0x43755c
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [0x43f063], 0
jmp 0x4337e2
cmp dword [ebp + 8], 1
jle 0x4334f6
push 0x437594
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4334f6
call fcn.0041d4e0
jmp 0x4337e2
cmp dword [ebp + 8], 1
jle 0x433744
push 0x437598
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x433744
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x448], eax
mov byte [ebp - 0x449], 1
cmp dword [ebp - 0x448], 0
je 0x43358e
push 0x24
push str.RTLDHCPService
mov edx, dword [ebp - 0x448]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
je 0x433581
mov eax, dword [ebp - 0x450]
push eax
call fcn.0041a380
add esp, 4
mov byte [ebp - 0x449], al
mov ecx, dword [ebp - 0x450]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [ebp - 0x448]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, byte [ebp - 0x449]
test eax, eax
je 0x433732
call fcn.00418dc0
movzx ecx, al
test ecx, ecx
je 0x433687
push 0x43759c
push 0x4375a4
call fcn.0041a610
add esp, 8
push str.Delete_RTLDHCP_Port.._n
call fcn.0041a610
add esp, 4
push 0
push str.netsh_advfirewall_firewall_delete_rule_name_RTLDHCP_Port_
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x437600
push 0x437608
call fcn.0041a610
add esp, 8
push str.Delete_RTLDHCP_Port_2.._n
call fcn.0041a610
add esp, 4
push 0
push str.netsh_advfirewall_firewall_delete_rule_name_RTLDHCP_Port_2_
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x118]
push edx
push str.netsh_advfirewall_firewall_add_rule_name_RTLDHCP_Port__program__s__protocolUDP_dirin_localport67_actionallow_profileprivate_public_domain
lea eax, [ebp - 0x440]
push eax
call fcn.00407379
add esp, 0xc
push 0
lea ecx, [ebp - 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x118]
push edx
push str.netsh_advfirewall_firewall_add_rule_name_RTLDHCP_Port_2__program__s__protocolUDP_dirin_localport68_actionallow_profileprivate_public_domain
lea eax, [ebp - 0x440]
push eax
call fcn.00407379
add esp, 0xc
push 0
lea ecx, [ebp - 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x433694
push 0
push str.netsh_firewall_set_service_type__upnp_mode__enable
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x4404f8
call fcn.0041a650
add esp, 4
mov dword [0x461da8], 0x43f054
mov dword [0x461dac], 0x43f064
cmp dword [ebp + 8], 5
jle 0x433726
push 0x4377d4
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x433726
push str._range
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x433726
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [0x461da8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x14]
mov dword [0x461dac], eax
mov ecx, dword [0x461da8]
push ecx
push str.Using_DHCP_Server_IP___s_n
call fcn.00409d25
add esp, 8
mov edx, dword [0x461dac]
push edx
push str.Using_DHCP_Server_range___s_n
call fcn.00409d25
add esp, 8
call fcn.0041a880
call fcn.00431700
jmp 0x43373f
push str.Failed_to_Stop_Service_n
call fcn.00409d25
add esp, 4
jmp 0x4337e2
cmp dword [ebp + 8], 1
jle 0x4337dd
push 0x437834
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4337dd
push 0x437838
push 0x437840
call fcn.0041a610
add esp, 8
push str.Close_RTLDHCP.._n
call fcn.0041a610
add esp, 4
push 0x43785c
call fcn.0041ada0
add esp, 4
push eax
push 0
push 0x42b
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0
je 0x4337db
push str.main
push 0x43786c
call fcn.0041a610
add esp, 8
push str.Terminate_RTLDHCP.._n
call fcn.0041a610
add esp, 4
push 0
mov edx, dword [ebp - 0x454]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4337e2
call fcn.004330d0
jmp 0x433814
cmp dword [ebp + 8], 1
je 0x433800
push 0x43788c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x433807
call fcn.00431700
jmp 0x433814
push str.This_option_is_not_available_on_Windows95_98_ME_n
call fcn.00409d25
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406dc0
mov esp, ebp
pop ebp
ret