Function at 0x1003df70
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x80], 0
push 0x63
push 0
lea eax, [ebp - 0x7f]
push eax
call fcn.100139b0
add esp, 0xc
push 0x100751f8
push 0x100751fc
call fcn.10015838
add esp, 8
mov dword [ebp - 4], eax
push str.Option_Explicit_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10075220
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.Const_DISABLE_ICS__1_n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x1007523c
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.Sub_CheckPerInterfaceICSSetting___n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x10075264
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.____Dim_objShare_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.____Dim_objEveryColl_n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.____Dim_objShell_n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x100752c0
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.____Set_objShare__Wscript.CreateObject__HNetCfg.HNetShare___n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.____If__IsObject_objShare___FALSE___Then_n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str._______WScript.Echo__Unable_to_create_object_:_HNetCfg.HNetShare___n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10075374
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x10075390
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x1007539c
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.____Set_objEveryColl__objShare.EnumEveryConnection_n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.____If__IsObject_objEveryColl___FALSE__Then_n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str._______WScript.Echo__Unable_to_Enumerate_Connections___n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str._______WScript.Quit__2__n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.____END_IF_n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x10075468
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.____Dim_objNetConn_n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.____For_each_objNetConn_in_objEveryColl_n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str._______Dim_objShareCfg__ConnectionProps_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x100754d8
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str._______Set_objShareCfg__objShare.INetSharingConfigurationForINetConnection_objNetConn__n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str._______If__IsObject_objShareCfg___FALSE__Then_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.__________WScript.Echo__Unable_to_retrieve_Sharing_Cfg_Object___n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x1007556c
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x100755cc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x100755dc
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str._______Set_ConnectionProps__objShare.NetConnectionProps_objNetConn__n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str._______If__IsObject_ConnectionProps___FALSE__Then_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.__________WSCript.Echo__Unable_to_retrieve_ConnectionProps_object___n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.__________WScript.Quit__2__n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x100756c0
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x100756d0
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str._______WScript.Echo__Connection_:____ConnectionProps.Name_n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str._______If__objShareCfg.SharingEnabled__Then_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.__________WScript.Echo__ICS_is_Enabled_on_this_Interface___n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x1007577c
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.__________Disable_Connection_Sharing_on_this_interface_if_configured_to_do_so_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.__________If__DISABLE_ICS__1__Then_n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str._t_____DisableICS_objShareCfg__n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.__________Else_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str._t_____WScript.Echo__Connection_Sharing_is_Enabled_on_a_interface._Validation_Failed___n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str._____________WScript.Quit__1__n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.__________End_If_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str._______Else_n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.__________WScript.Echo__ICS_is_Disabled_on_this_Interface___n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str._______End_If_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.____Next_n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push 0x10075920
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.____Set_objShare__Nothing_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.____Set_objEveryColl__Nothing_n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.____Set_objShell__Nothing_n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x1007597c
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.____WScript.Echo__Connection_Sharing_is_Disabled_on_all_interfaces._Validation_Passed___n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.____WScript.Quit__0__n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x100759f4
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10075a00
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.Sub_DisableICS_objShareCfg__n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.____On_Error_Resume_Next_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10075a40
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.____WScript.Echo__Disabling_Connection_Sharing...___n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.____objShareCfg.DisableSharing_n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10075a9c
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.____If__Err.Number____0__Then_n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str._______WScript.Echo__Unable_to_Disable_ICS_on_the_Interface___n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str._______WSCript.Quit__3__n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.____End_If_n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push 0x10075b28
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push 0x10075b34
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.Sub_Main___n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
push str.____CheckPerInterfaceICSSetting___n
mov ecx, dword [ebp - 4]
push ecx
call fcn.10017bb8
add esp, 8
push str.End_Sub_n
mov edx, dword [ebp - 4]
push edx
call fcn.10017bb8
add esp, 8
push str.Main___n
mov eax, dword [ebp - 4]
push eax
call fcn.10017bb8
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call fcn.10015a42
add esp, 4
push 0x44
push 0
lea edx, [ebp - 0xc8]
push edx
call fcn.100139b0
add esp, 0xc
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.100139b0
add esp, 0xc
mov dword [ebp - 0xc8], 0x44
mov dword [ebp - 0x9c], 1
xor ecx, ecx
mov word [ebp - 0x98], cx
push str.cscript_ICSDisable.vbs
lea edx, [ebp - 0x80]
push edx
call fcn.10016875
add esp, 8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc8]
push ecx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
lea edx, [ebp - 0x80]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1003e565
jmp 0x1003e57c
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.ICSDisable.vbs
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret