Function at 0x440620
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x814
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x810], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesNetwork
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4406ea
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoNetSetup
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4406c6
cmp word [esp + 0x20], 1
jne 0x4406e4
push eax
push 1
push 0xf1
push 0x28ef
push dword [0x4e6030]
call ebp
push eax
call ebx
jmp 0x4406e4
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 4
push 0
push str.NoNetSetup
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x440784
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoSecCpl
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440760
cmp word [esp + 0x20], 1
jne 0x44077e
push eax
push 1
push 0xf1
push 0x28f0
push dword [0x4e6030]
call ebp
push eax
call ebx
jmp 0x44077e
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.NoSecCpl
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesNetwork
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44081e
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.NoWorkgroupContents
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4407fa
cmp word [esp + 0x20], 1
jne 0x440818
push eax
push 1
push 0xf1
push 0x28f1
push dword [0x4e6030]
call ebp
push eax
call ebx
jmp 0x440818
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.NoWorkgroupContents
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4408b8
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.DisableChangePassword
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x440894
cmp word [esp + 0x20], 1
jne 0x4408b2
push eax
push 1
push 0xf1
push 0x28f2
push dword [0x4e6030]
call ebp
push eax
call ebx
jmp 0x4408b2
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.DisableChangePassword
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
lea eax, [esp + 0x10]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x440952
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0x400
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.DisableLockWorkstation
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44092e
cmp word [esp + 0x20], 1
jne 0x44094c
push eax
push 1
push 0xf1
push 0x28f3
push dword [0x4e6030]
call ebp
push eax
call ebx
jmp 0x44094c
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 4
push 0
push str.DisableLockWorkstation
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
call esi
push 0x28f4
push str.Hidden
mov edx, str.SYSTEMCurrentControlSetServicesLanmanServerParameters
mov ecx, 0x80000002
call fcn.0043e5c0
push 0x28f5
push str.RestrictAnonymous
mov edx, str.SYSTEMCurrentControlSetControlLSA
mov ecx, 0x80000002
call fcn.0043e5c0
push 0x28f6
push str.PerformRouterDiscovery
mov edx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov ecx, 0x80000002
call fcn.0043e5c0
push 0x28f7
push str.NoRecentDocsNetHood
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov ecx, 0x80000001
call fcn.0043e5c0
mov ecx, dword [esp + 0x840]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x814
ret