Function at 0x422816
Capabilities:
Delete registry key
Persist via windows service
Set registry value

Disassembly:
mov eax, 0x432467
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x54c
and byte [esp + 0x224], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [esp + 0x231]
rep stosd dword es:[edi], eax
and byte [esp + 0x28], 0
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [esp + 0x29]
and byte [esp + 0x12c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [esp + 0x12d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
cmp byte [esp + 0x56c], 0
mov dword [esp + 0x20], esi
stosb byte es:[edi], al
je 0x422885
push str.SoftwareArray_NetworksAdapter_Interface_For_VNic
jmp 0x42288a
push str.SoftwareArray_NetworksAdapter_Interface
lea eax, [esp + 0x130]
push 0x43657c
push eax
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea eax, [esp + 0x12c]
lea ecx, [esp + 0x334]
push 0x20019
push eax
push reloc.WS2_32.dll_bind
call fcn.0041d2d7
cmp dword [esp + 0x334], esi
mov dword [esp + 0x560], esi
jne 0x422967
cmp dword [0x441ff4], esi
je 0x422f5f
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x422900
mov ecx, dword [0x441fdc]
cmp dword [ecx], esi
jne 0x422f5f
cmp eax, 3
jle 0x422f5f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x43d8ac], esi
mov ebx, eax
jge 0x422922
mov eax, dword [0x441fa0]
mov dword [0x43d8ac], eax
call fcn.0041c4b1
test eax, eax
je 0x422954
push 3
push dword [0x43d8ac]
push 0x5b9
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutility_apiext.cpp
call fcn.0041c4e1
push str.Resume_OldPPPDNS__no_need_do_it._n
call fcn.0041c506
add esp, 0x14
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x422f5f
cmp dword [0x441ff4], esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
je 0x4229f4
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x422997
mov ecx, dword [0x441fdc]
cmp dword [ecx], esi
jne 0x4229f4
cmp eax, 3
jle 0x4229f4
call ebp
mov esi, eax
call ebx
cmp dword [0x43d8ac], 0
mov edi, eax
jge 0x4229b2
mov eax, dword [0x441fa0]
mov dword [0x43d8ac], eax
call fcn.0041c4b1
test eax, eax
je 0x4229e4
push 3
push dword [0x43d8ac]
push 0x5bc
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutility_apiext.cpp
call fcn.0041c4e1
push str.Resume_OldPPPDNS_starting..._n
call fcn.0041c506
add esp, 0x14
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
cmp dword [esp + 0x33c], esi
mov dword [esp + 0x18], esi
jle 0x422ec3
push 0xf003f
lea ecx, [esp + 0x33c]
push dword [esp + 0x1c]
call fcn.0041d630
mov edi, eax
cmp edi, esi
mov dword [esp + 0x20], edi
je 0x422eae
lea eax, [edi + 0x11c]
mov dword [esp + 0x14], esi
push eax
lea eax, [esp + 0x30]
push 0x43657c
push eax
mov dword [esp + 0x1c], esi
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea eax, [esp + 0x14]
mov ecx, edi
push eax
lea eax, [esp + 0x2c]
push eax
push 1
push str.NameServer
call fcn.0041d7b1
test eax, eax
jne 0x422af8
cmp dword [0x441ff4], esi
je 0x422c5c
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x422a99
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x422c5c
cmp eax, 3
jle 0x422c5c
call ebp
mov esi, eax
call ebx
cmp dword [0x43d8ac], 0
mov edi, eax
jge 0x422ab4
mov eax, dword [0x441fa0]
mov dword [0x43d8ac], eax
call fcn.0041c4b1
test eax, eax
je 0x422aeb
push 3
push dword [0x43d8ac]
push 0x5c8
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutility_apiext.cpp
call fcn.0041c4e1
lea eax, [esp + 0x3c]
push eax
push str.Resume_OldPPPDNS:_Get_DNS_Value_failed__the_key_is__s._n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
jmp 0x422c56
cmp dword [0x441ff4], esi
je 0x422b7f
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x422b1b
mov ecx, dword [0x441fdc]
cmp dword [ecx], esi
jne 0x422b7f
cmp eax, 3
jle 0x422b7f
call ebp
mov esi, eax
call ebx
cmp dword [0x43d8ac], 0
mov edi, eax
jge 0x422b36
mov eax, dword [0x441fa0]
mov dword [0x43d8ac], eax
call fcn.0041c4b1
test eax, eax
je 0x422b71
push 3
push dword [0x43d8ac]
push 0x5cc
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutility_apiext.cpp
call fcn.0041c4e1
push dword [esp + 0x24]
lea eax, [esp + 0x40]
push eax
push str.Resume_OldPPPDNS:_Get_DNS_Value_success__the_key_is__s._the_value_is__s._n
call fcn.0041c506
add esp, 0x1c
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x2c]
push eax
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
lea eax, [esp + 0x23c]
push 0x436a00
push eax
call sub.MSVCRT.dll_sprintf
push dword [esp + 0x24]
call sub.MSVCRT.dll_strlen
add esp, 0x14
inc eax
push eax
lea eax, [esp + 0x238]
push dword [esp + 0x18]
push 1
pop edi
push edi
push str.NameServer
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov esi, eax
test esi, esi
jne 0x422bd8
mov dword [esp + 0x24], edi
jmp 0x422c5c
cmp dword [0x441ff4], 0
je 0x422c5c
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, edi
je 0x422bfb
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x422c5c
cmp eax, edi
jle 0x422c5c
call ebp
mov edi, eax
call ebx
cmp dword [0x43d8ac], 0
mov dword [esp + 0x1c], eax
jge 0x422c18
mov eax, dword [0x441fa0]
mov dword [0x43d8ac], eax
call fcn.0041c4b1
test eax, eax
je 0x422c4b
push 1
push dword [0x43d8ac]
push 0x5d5
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutility_apiext.cpp
call fcn.0041c4e1
push esi
push str.Resume_OldPPPDNS:_failed__error_is__d._n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
cmp dword [esp + 0x14], esi
je 0x422c6e
push dword [esp + 0x14]
call sub.MSVCRT.dll_free
pop ecx
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
push 1
pop edi
push edi
push str.DhcpNameServer
call fcn.0041d7b1
test eax, eax
jne 0x422d20
cmp dword [0x441ff4], esi
je 0x422e88
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x422cc1
mov ecx, dword [0x441fdc]
cmp dword [ecx], esi
jne 0x422e88
cmp eax, 3
jle 0x422e88
call ebp
mov esi, eax
call ebx
cmp dword [0x43d8ac], 0
mov edi, eax
jge 0x422cdc
mov eax, dword [0x441fa0]
mov dword [0x43d8ac], eax
call fcn.0041c4b1
test eax, eax
je 0x422d13
push 3
push dword [0x43d8ac]
push 0x5df
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutility_apiext.cpp
call fcn.0041c4e1
lea eax, [esp + 0x3c]
push eax
push str.Resume_OldPPPDNS:_Get_DhcpDNS_Value_failed__the_key_is__s._n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
jmp 0x422e82
cmp dword [0x441ff4], esi
je 0x422dae
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x422d47
mov ecx, dword [0x441fdc]
cmp dword [ecx], esi
jne 0x422dae
cmp eax, 3
jle 0x422dae
call ebp
mov esi, eax
call ebx
cmp dword [0x43d8ac], 0
mov edi, eax
jge 0x422d62
mov eax, dword [0x441fa0]
mov dword [0x43d8ac], eax
call fcn.0041c4b1
test eax, eax
je 0x422d9d
push 3
push dword [0x43d8ac]
push 0x5e3
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutility_apiext.cpp
call fcn.0041c4e1
push dword [esp + 0x20]
lea eax, [esp + 0x40]
push eax
push str.Resume_OldPPPDNS:_Get_DhcpDNS_Value_success__the_key_is__s._the_value_is__s._n
call fcn.0041c506
add esp, 0x1c
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
pop edi
lea eax, [esp + 0x2c]
push eax
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
lea eax, [esp + 0x23c]
push 0x436a00
push eax
call sub.MSVCRT.dll_sprintf
push dword [esp + 0x20]
call sub.MSVCRT.dll_strlen
add esp, 0x14
inc eax
push eax
lea eax, [esp + 0x238]
push dword [esp + 0x14]
push edi
push str.DhcpNameServer
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov esi, eax
test esi, esi
jne 0x422e04
mov dword [esp + 0x24], edi
jmp 0x422e88
cmp dword [0x441ff4], 0
je 0x422e88
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, edi
je 0x422e27
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x422e88
cmp eax, edi
jle 0x422e88
call ebp
mov edi, eax
call ebx
cmp dword [0x43d8ac], 0
mov dword [esp + 0x1c], eax
jge 0x422e44
mov eax, dword [0x441fa0]
mov dword [0x43d8ac], eax
call fcn.0041c4b1
test eax, eax
je 0x422e77
push 1
push dword [0x43d8ac]
push 0x5ec
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutility_apiext.cpp
call fcn.0041c4e1
push esi
push str.Resume_OldPPPDNS:_failed__error_is__d._n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esp + 0x10], 0
je 0x422e99
push dword [esp + 0x10]
call sub.MSVCRT.dll_free
pop ecx
mov ecx, dword [esp + 0x20]
call fcn.0041d3c3
push dword [esp + 0x20]
call sub.MFC42.DLL_operatordelete
pop ecx
xor esi, esi
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x33c]
jl 0x422a05
lea eax, [esp + 0x130]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov edi, eax
cmp edi, esi
je 0x422f5a
cmp dword [0x441ff4], esi
je 0x422f5a
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 1
je 0x422eff
mov ecx, dword [0x441fdc]
cmp dword [ecx], esi
jne 0x422f5a
cmp eax, 1
jle 0x422f5a
call ebp
mov ebp, eax
call ebx
cmp dword [0x43d8ac], esi
mov ebx, eax
jge 0x422f19
mov eax, dword [0x441fa0]
mov dword [0x43d8ac], eax
call fcn.0041c4b1
test eax, eax
je 0x422f4c
push 1
push dword [0x43d8ac]
push 0x5fb
push str.C:_build_rel_sp_8_4_6_2_srcwindowsSHAREDutility_apiext.cpp
call fcn.0041c4e1
push edi
push str.Resume_OldPPPDNS_finished:_Delete_the_adapter_interface_key_failed__the_error_is__d._n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push ebp
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0x24]
pop ebp
or dword [esp + 0x560], 0xffffffff
lea ecx, [esp + 0x334]
call fcn.0041d3c3
mov ecx, dword [esp + 0x558]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret