Function at 0x43fa80
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesNetwork
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43fb4a
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoNetSetup
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fb26
cmp word [esp + 0x20], 1
jne 0x43fb44
push eax
push 1
push 0xf1
push 0x28ef
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43fb44
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 4
push 0
push str.NoNetSetup
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fbe4
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoSecCpl
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fbc0
cmp word [esp + 0x20], 1
jne 0x43fbde
push eax
push 1
push 0xf1
push 0x28f0
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43fbde
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.NoSecCpl
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesNetwork
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fc7e
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoWorkgroupContents
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fc5a
cmp word [esp + 0x20], 1
jne 0x43fc78
push eax
push 1
push 0xf1
push 0x28f1
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43fc78
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.NoWorkgroupContents
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fd18
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.DisableChangePassword
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fcf4
cmp word [esp + 0x20], 1
jne 0x43fd12
push eax
push 1
push 0xf1
push 0x28f2
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43fd12
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.DisableChangePassword
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43fdb2
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.DisableLockWorkstation
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43fd8e
cmp word [esp + 0x20], 1
jne 0x43fdac
push eax
push 1
push 0xf1
push 0x28f3
push dword [0x4def88]
call ebp
push eax
call ebx
jmp 0x43fdac
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.DisableLockWorkstation
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
push 0x28f4
push str.Hidden
mov edx, str.SYSTEMCurrentControlSetServicesLanmanServerParameters
mov ecx, 0x80000002
call fcn.0043da20
push 0x28f5
push str.RestrictAnonymous
mov edx, str.SYSTEMCurrentControlSetControlLSA
mov ecx, 0x80000002
call fcn.0043da20
push 0x28f6
push str.PerformRouterDiscovery
mov edx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov ecx, 0x80000002
call fcn.0043da20
push 0x28f7
push str.NoRecentDocsNetHood
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov ecx, 0x80000001
call fcn.0043da20
mov ecx, dword [esp + 0x840]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x814
ret