Function at 0x492920
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583a26
mov eax, dword fs:[0]
push eax
mov eax, 0x8840
call fcn.00565240
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
call fcn.00402270
mov dword [ebp - 0x825c], eax
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push 0
push 0x596e10
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4929b7
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x861d], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00405f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404650
mov al, byte [ebp - 0x861d]
jmp 0x493743
mov dx, word [0x596ee8]
mov word [ebp - 0x8244], dx
push 0x206
push 0
lea eax, [ebp - 0x8242]
push eax
call fcn.00562540
add esp, 0xc
mov dword [ebp - 0x28], 0x104
mov dword [ebp - 0x803c], 0
mov dword [ebp - 0x8248], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x8258], 0
mov dword [ebp - 0x8254], 0
mov dword [ebp - 0x8038], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x8264], 0x3fff
lea ecx, [ebp - 0x8250]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x8038]
push eax
lea ecx, [ebp - 0x8254]
push ecx
lea edx, [ebp - 0x8258]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x8248]
push ecx
lea edx, [ebp - 0x803c]
push edx
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x8244]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x492ab9
mov byte [ebp - 0x861e], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00405f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404650
mov al, byte [ebp - 0x861e]
jmp 0x493743
cmp dword [ebp - 0x8258], 0
je 0x493711
mov byte [ebp - 0x8265], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
jmp 0x492ae6
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x8258]
jae 0x493711
mov dword [ebp - 0x8264], 0x3fff
xor edx, edx
mov word [ebp - 0x8034], dx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8264]
push eax
lea ecx, [ebp - 0x8034]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x49370c
xor ecx, ecx
mov word [ebp - 0x846c], cx
push 0x1fc
push 0
lea edx, [ebp - 0x846a]
push edx
call fcn.00562540
add esp, 0xc
mov dword [ebp - 0x8474], 0xff
lea eax, [ebp - 0x8474]
push eax
lea ecx, [ebp - 0x846c]
push ecx
push 0x61f6b0
push 0
lea edx, [ebp - 0x8034]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x8470], eax
cmp dword [ebp - 0x8470], 0
jne 0x4936e2
lea ecx, [ebp - 0x846c]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0
jne 0x492bb6
mov dword [ebp - 0x87bc], 0
jmp 0x492c1a
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3fffffff
jle 0x492bdb
mov dword [ebp - 0x87c0], 0
jmp 0x492c0e
mov eax, dword [ebp - 0x14]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x87c4], esp
mov eax, dword [ebp - 0x825c]
push eax
mov ecx, dword [ebp - 0x14]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x87c4]
push eax
call fcn.004022d0
mov dword [ebp - 0x87c0], eax
mov ecx, dword [ebp - 0x87c0]
mov dword [ebp - 0x87bc], ecx
mov edx, dword [ebp - 0x87bc]
push edx
lea ecx, [ebp - 0x8490]
call fcn.00405ef0
mov byte [ebp - 4], 2
push 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x8490]
call fcn.004191e0
cmp eax, dword [0x60123c]
je 0x4936d1
lea ecx, [ebp - 0x85c8]
call fcn.0040e4a0
mov byte [ebp - 4], 3
push 0x596eec
lea ecx, [ebp - 0x863c]
call fcn.00405ef0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x863c]
push ecx
lea edx, [ebp - 0x85c8]
push edx
lea eax, [ebp - 0x8490]
push eax
call fcn.004164d0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x863c]
call fcn.00405f70
lea ecx, [ebp - 0x85ac]
call fcn.004045c0
mov byte [ebp - 4], 5
push 0
lea ecx, [ebp - 0x85c8]
call fcn.0043da10
push eax
lea ecx, [ebp - 0x8504]
call fcn.00405f90
push 1
lea ecx, [ebp - 0x85c8]
call fcn.0043da10
push eax
lea ecx, [ebp - 0x853c]
call fcn.00405f90
push 2
lea ecx, [ebp - 0x85c8]
call fcn.0043da10
push eax
lea ecx, [ebp - 0x8574]
call fcn.00405f90
push 3
lea ecx, [ebp - 0x85c8]
call fcn.0043da10
push eax
lea ecx, [ebp - 0x8590]
call fcn.00405f90
push 4
lea ecx, [ebp - 0x85c8]
call fcn.0043da10
push eax
lea ecx, [ebp - 0x85ac]
call fcn.00405f90
push 0x58f06d
lea ecx, [ebp + 0x104]
push ecx
call fcn.00407c60
add esp, 8
movzx edx, al
test edx, edx
je 0x492de2
push fcn.0055b59a
lea eax, [ebp - 0x8644]
push eax
lea ecx, [ebp + 0x104]
call fcn.00405fd0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x864c]
push eax
lea ecx, [ebp + 0x104]
call fcn.00406000
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x8654]
push eax
lea ecx, [ebp + 0x104]
call fcn.00405fd0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x865c]
push eax
call fcn.00407be0
add esp, 0x20
push 0
push 0x596ef0
lea ecx, [ebp + 0x104]
call fcn.00422740
cmp eax, dword [0x60123c]
je 0x492dd2
push str.Enable
lea ecx, [ebp - 0x84cc]
call fcn.00405fb0
jmp 0x492de2
push str.Disable
lea ecx, [ebp - 0x84cc]
call fcn.00405fb0
push 0x58f06e
lea ecx, [ebp + 0x5c]
push ecx
call fcn.00407c60
add esp, 8
movzx edx, al
test edx, edx
je 0x492e09
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp - 0x8574]
call fcn.00405f90
mov byte [ebp - 0x85ad], 0
push 0x58f06f
lea ecx, [ebp + 0xcc]
push ecx
call fcn.00407c60
add esp, 8
movzx edx, al
test edx, edx
je 0x492e61
lea eax, [ebp + 0xcc]
push eax
lea ecx, [ebp - 0x8504]
push ecx
call fcn.0046cc10
add esp, 8
movzx edx, al
test edx, edx
je 0x492e4f
mov byte [ebp - 0x85ad], 1
lea eax, [ebp + 0xcc]
push eax
lea ecx, [ebp - 0x8504]
call fcn.00405f90
push 0x58f0f7
lea ecx, [ebp + 0x94]
push ecx
call fcn.00407c60
add esp, 8
movzx edx, al
test edx, edx
je 0x492eb2
lea eax, [ebp + 0x94]
push eax
lea ecx, [ebp - 0x853c]
push ecx
call fcn.0046cc10
add esp, 8
movzx edx, al
test edx, edx
je 0x492ea0
mov byte [ebp - 0x85ad], 1
lea eax, [ebp + 0x94]
push eax
lea ecx, [ebp - 0x853c]
call fcn.00405f90
movzx ecx, byte [ebp - 0x85ad]
test ecx, ecx
je 0x493509
push str.:::::
lea edx, [ebp - 0x8504]
push edx
lea eax, [ebp - 0x8678]
push eax
call fcn.00407b50
add esp, 0xc
mov dword [ebp - 0x87c8], eax
mov ecx, dword [ebp - 0x87c8]
mov dword [ebp - 0x87cc], ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x853c]
push edx
mov eax, dword [ebp - 0x87cc]
push eax
lea ecx, [ebp - 0x85e4]
push ecx
call fcn.0041e300
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x8678]
call fcn.00405f70
push 0x596f18
lea edx, [ebp - 0x8504]
push edx
lea eax, [ebp - 0x8694]
push eax
call fcn.00407b50
add esp, 0xc
mov dword [ebp - 0x87d0], eax
mov ecx, dword [ebp - 0x87d0]
mov dword [ebp - 0x87d4], ecx
mov byte [ebp - 4], 9
lea edx, [ebp - 0x853c]
push edx
mov eax, dword [ebp - 0x87d4]
push eax
lea ecx, [ebp - 0x86b0]
push ecx
call fcn.0041e300
add esp, 0xc
mov dword [ebp - 0x87d8], eax
mov edx, dword [ebp - 0x87d8]
mov dword [ebp - 0x87dc], edx
mov byte [ebp - 4], 0xa
push 0x596f14
mov eax, dword [ebp - 0x87dc]
push eax
lea ecx, [ebp - 0x86cc]
push ecx
call fcn.00407b50
add esp, 0xc
mov dword [ebp - 0x87e0], eax
mov edx, dword [ebp - 0x87e0]
mov dword [ebp - 0x87e4], edx
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x8574]
push eax
mov ecx, dword [ebp - 0x87e4]
push ecx
lea edx, [ebp - 0x86e8]
push edx
call fcn.0041e300
add esp, 0xc
mov dword [ebp - 0x87e8], eax
mov eax, dword [ebp - 0x87e8]
mov dword [ebp - 0x87ec], eax
mov byte [ebp - 4], 0xc
push 0x596f10
mov ecx, dword [ebp - 0x87ec]
push ecx
lea edx, [ebp - 0x8704]
push edx
call fcn.00407b50
add esp, 0xc
mov dword [ebp - 0x87f0], eax
mov eax, dword [ebp - 0x87f0]
mov dword [ebp - 0x87f4], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x84cc]
push ecx
mov edx, dword [ebp - 0x87f4]
push edx
lea eax, [ebp - 0x8720]
push eax
call fcn.0041e300
add esp, 0xc
mov dword [ebp - 0x87f8], eax
mov ecx, dword [ebp - 0x87f8]
mov dword [ebp - 0x87fc], ecx
mov byte [ebp - 4], 0xe
push 0x596f0c
mov edx, dword [ebp - 0x87fc]
push edx
lea eax, [ebp - 0x873c]
push eax
call fcn.00407b50
add esp, 0xc
mov dword [ebp - 0x8800], eax
mov ecx, dword [ebp - 0x8800]
mov dword [ebp - 0x8804], ecx
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x85ac]
push edx
mov eax, dword [ebp - 0x8804]
push eax
lea ecx, [ebp - 0x8600]
push ecx
call fcn.0041e300
add esp, 0xc
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x873c]
call fcn.00405f70
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x8720]
call fcn.00405f70
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x8704]
call fcn.00405f70
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x86e8]
call fcn.00405f70
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x86cc]
call fcn.00405f70
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x86b0]
call fcn.00405f70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x8694]
call fcn.00405f70
lea ecx, [ebp - 0x85e4]
call fcn.00406030
mov dword [ebp - 0x8260], eax
cmp dword [ebp - 0x8260], 0
jne 0x493127
mov dword [ebp - 0x8808], 0
jmp 0x49318f
mov edx, dword [ebp - 0x8260]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3fffffff
jle 0x49314f
mov dword [ebp - 0x880c], 0
jmp 0x493183
mov eax, dword [ebp - 0x14]
shl eax, 1
call fcn.0056a8e0
mov dword [ebp - 0x8810], esp
mov eax, dword [ebp - 0x825c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x8260]
push edx
mov eax, dword [ebp - 0x8810]
push eax
call fcn.00402280
mov dword [ebp - 0x880c], eax
mov ecx, dword [ebp - 0x880c]
mov dword [ebp - 0x8808], ecx
mov edx, dword [ebp - 0x8808]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x8470], eax
cmp dword [ebp - 0x8470], 0
jne 0x493225
mov byte [ebp - 0x873d], 1
lea ecx, [ebp - 0x8600]
call fcn.00405f70
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x85e4]
call fcn.00405f70
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x85ac]
call fcn.00404650
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x85c8]
call fcn.0040e510
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8490]
call fcn.00405f70
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00405f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404650
mov al, byte [ebp - 0x873d]
jmp 0x493743
mov byte [ebp - 0x873e], 0
lea ecx, [ebp - 0x8600]
call fcn.00405f70
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x85e4]
call fcn.00405f70
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x85ac]
call fcn.00404650
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x85c8]
call fcn.0040e510
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8490]
call fcn.00405f70
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00405f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404650
mov al, byte [ebp - 0x873e]
jmp 0x493743
lea ecx, [ebp - 0x853c]
push ecx
push str.netsh_firewall_set_portopening_protocol
lea edx, [ebp - 0x875c]
push edx
call fcn.00407ac0
add esp, 0xc
mov dword [ebp - 0x882c], eax
mov eax, dword [ebp - 0x882c]
mov dword [ebp - 0x8830], eax
mov byte [ebp - 4], 0x10
push 0x596f1c
mov ecx, dword [ebp - 0x8830]
push ecx
lea edx, [ebp - 0x8778]
push edx
call fcn.00407b50
add esp, 0xc
mov dword [ebp - 0x8834], eax
mov eax, dword [ebp - 0x8834]
mov dword [ebp - 0x8838], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x8504]
push ecx
mov edx, dword [ebp - 0x8838]
push edx
lea eax, [ebp - 0x861c]
push eax
call fcn.0041e300
add esp, 0xc
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x8778]
call fcn.00405f70
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x875c]
call fcn.00405f70
push 0x58f182
lea ecx, [ebp + 0x5c]
push ecx
call fcn.00407c60
add esp, 8
movzx edx, al
test edx, edx
je 0x493610
lea eax, [ebp - 0x8574]
push eax
push str.scopeCUSTOM_addresses
lea ecx, [ebp - 0x8794]
push ecx
call fcn.00407ac0
add esp, 0xc
mov dword [ebp - 0x883c], eax
mov edx, dword [ebp - 0x883c]
mov dword [ebp - 0x8840], edx
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x8840]
push eax
lea ecx, [ebp - 0x861c]
call fcn.00407ec0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x8794]
call fcn.00405f70
push 0x58f183
lea ecx, [ebp + 0x104]
push ecx
call fcn.00407c60
add esp, 8
movzx edx, al
test edx, edx
je 0x49367d
lea eax, [ebp - 0x84cc]
push eax
push str._mode
lea ecx, [ebp - 0x87b0]
push ecx
call fcn.00407ac0
add esp, 0xc
mov dword [ebp - 0x8844], eax
mov edx, dword [ebp - 0x8844]
mov dword [ebp - 0x8848], edx
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x8848]
push eax
lea ecx, [ebp - 0x861c]
call fcn.00407ec0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x87b0]
call fcn.00405f70
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x87b4], esp
lea edx, [ebp - 0x861c]
push edx
call fcn.00405f30
mov dword [ebp - 0x884c], eax
call fcn.004168f0
add esp, 0x20
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x861c]
call fcn.00405f70
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x85ac]
call fcn.00404650
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x85c8]
call fcn.0040e510
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8490]
call fcn.00405f70
jmp 0x49370c
mov byte [ebp - 0x87b5], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00405f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404650
mov al, byte [ebp - 0x87b5]
jmp 0x493743
jmp 0x492add
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x87b6], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00405f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404650
mov al, byte [ebp - 0x87b6]
lea esp, [ebp - 0x8850]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret