Function at 0x448680
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
push edi
push 0
push 0
push 0xf0
push 0x2931
push dword [0x4def88]
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4486ed
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call edi
test eax, eax
jne 0x448751
push str.Tcp1323Opts
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x14]
jmp 0x44874f
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call edi
test eax, eax
jne 0x448751
push eax
push eax
push 0x147
push 0x293d
push dword [0x4def88]
call ebx
push eax
call ebp
mov dword [esp + 0x18], eax
cmp eax, 2
jne 0x448731
mov dword [esp + 0x18], 3
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.Tcp1323Opts
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
push 0
push 0xf0
push 0x2932
push dword [0x4def88]
call ebx
push eax
call ebp
test eax, eax
jne 0x44879f
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call edi
test eax, eax
jne 0x4487f6
push str.MaxDupAcks
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x1c]
jmp 0x4487f4
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call edi
test eax, eax
jne 0x4487f6
push eax
push eax
push 0x400
push 0x293a
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.MaxDupAcks
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
call esi
push 0
push 0
push 0xf0
push 0x2939
push dword [0x4def88]
call ebx
push eax
call ebp
test eax, eax
jne 0x448844
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call edi
test eax, eax
jne 0x44889b
push str.MaxConnectionsPer1_0Server
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x1c]
jmp 0x448899
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call edi
test eax, eax
jne 0x44889b
push eax
push eax
push 0x400
push 0x293b
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.MaxConnectionsPer1_0Server
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
call esi
push 0
push 0
push 0xf0
push 0x2939
push dword [0x4def88]
call ebx
push eax
call ebp
test eax, eax
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
jne 0x4488e5
call edi
test eax, eax
jne 0x448926
push str.MaxConnectionsPerServer
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x448920
call edi
test eax, eax
jne 0x448926
push eax
push eax
push 0x400
push 0x293c
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.MaxConnectionsPerServer
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x448989
push eax
push eax
push 0xf0
push 0x2937
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.SackOpts
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call edi
test eax, eax
jne 0x4489ec
push eax
push eax
push 0xf0
push 0x2938
push dword [0x4def88]
call ebx
push eax
call ebp
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4489cc
mov dword [esp + 0x1c], 2
push 4
lea eax, [esp + 0x20]
push eax
push 4
push 0
push str.SynAttackProtect
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesNetBTParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x448a4f
push eax
push eax
push 0xf0
push 0x2933
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.RandomAdapter
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftRASPROTOCOLS
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x448ab2
push eax
push eax
push 0xf0
push 0x2934
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.EnableUnimodem
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x448b15
push eax
push eax
push 0xf0
push 0x2935
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.DisableTaskOffload
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftOle
push 0x80000002
call edi
test eax, eax
jne 0x448b89
push eax
push eax
push 0xf0
push 0x2936
push dword [0x4def88]
call ebx
push eax
call ebp
test eax, eax
je 0x448b74
push 4
push 0x4b3e68
push 1
push 0
push str.EnableRemoteConnect
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push str.EnableRemoteConnect
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret