Function at 0x404d20
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov eax, dword [0x441e0c]
sub esp, 0x114
push ebx
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
je 0x404d56
mov eax, dword [esp + 0x128]
push eax
call fcn.00403170
add esp, 4
dec eax
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x114
ret
push 0x441780
push str.SYSTEMCurrentControlSetServicesNetBTParametersInterfacesTcpip__s
lea ecx, [esp + 0x24]
push 0x104
push ecx
mov dword [esp + 0x20], ebp
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push edx
push eax
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push ecx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x38], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
cmp ebx, ebp
je 0x404e6d
push 0x29
mov ecx, 0x442408
call fcn.0042053a
push ebp
push ebp
push ebp
push ebp
push 2
push 0x11
call fcn.0041e7ec
mov eax, dword [0x441ff4]
add esp, 0x18
cmp eax, ebp
je 0x4051c4
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 1
je 0x404df5
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebp
jne 0x4051c4
cmp eax, 1
jle 0x4051c4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x436030]
cmp eax, ebp
jge 0x404e1a
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x404e52
mov eax, dword [0x436030]
push 1
push eax
push 0x4a5
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
lea ecx, [esp + 0x2c]
push ebx
push ecx
push str.Failed_to_open_reg:_s__error_d_n
call fcn.0041c506
add esp, 0x1c
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x114
ret
mov eax, dword [esp + 0x14]
cmp eax, 1
mov eax, dword [0x441ff4]
jne 0x404f00
cmp eax, ebp
je 0x404f8e
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 3
je 0x404eab
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebp
jne 0x404f8e
cmp eax, 3
jle 0x404f8e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x436030]
cmp eax, ebp
jge 0x404ed0
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x404f80
mov eax, dword [0x436030]
push 3
push eax
push 0x4ab
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
lea ecx, [esp + 0x2c]
push ecx
push str.Key_created:__s_n
jmp 0x404f73
cmp eax, ebp
je 0x404f8e
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 3
je 0x404f24
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebp
jne 0x404f8e
cmp eax, 3
jle 0x404f8e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x404f49
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x404f80
mov eax, dword [0x436030]
push 3
push eax
push 0x4af
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
lea ecx, [esp + 0x2c]
push ecx
push str.Key_opened:__s_n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x441730]
lea edx, [eax + eax*4]
lea eax, [edx*4 + 0xa]
push eax
call sub.MFC42.DLL_operatornew
mov ebp, eax
mov eax, dword [0x441730]
mov edi, ebp
add esp, 4
lea ecx, [eax + eax*4]
xor eax, eax
xor esi, esi
mov dword [esp + 0x18], ebp
lea ecx, [ecx*4 + 0xa]
mov ebx, ebp
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [0x441730]
test eax, eax
jle 0x405029
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [0x441734]
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + esi*4 + 3]
mov dl, byte [eax + esi*4 + 2]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + esi*4 + 1]
mov dl, byte [eax + esi*4]
push ecx
push edx
push 0x4365b4
push ebx
call ebp
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
mov eax, dword [0x441730]
not ecx
dec ecx
inc esi
cmp esi, eax
lea ebx, [ebx + ecx + 1]
jl 0x404fe0
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
sub ebx, ebp
inc ebx
push ebx
push ebp
push 7
push 0
push str.NameServerList
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4050fa
mov eax, dword [0x441ff4]
test eax, eax
je 0x4050d9
mov ecx, dword [0x441fd4]
mov eax, dword [ecx]
cmp eax, 3
je 0x405074
mov edx, dword [0x441fdc]
cmp dword [edx], 0
jne 0x4050d9
cmp eax, 3
jle 0x4050d9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x405097
mov eax, dword [0x441fa0]
mov dword [0x436030], eax
call fcn.0041c4b1
test eax, eax
je 0x4050cb
mov ecx, dword [0x436030]
push 3
push ecx
push 0x4c2
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
push ebp
push str.Wins_Server_set_to__s_n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebp
call sub.MFC42.DLL_operatordelete
mov edx, dword [esp + 0x14]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x114
ret
push 0x28
mov ecx, 0x442408
call fcn.0042053a
push 0
push 0
push 0
push 0
push 2
push 0x11
call fcn.0041e7ec
mov eax, dword [0x441ff4]
add esp, 0x18
test eax, eax
je 0x4051b0
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 1
je 0x405143
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x4051b0
cmp eax, 1
jle 0x4051b0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40516a
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x4051a2
mov eax, dword [0x436030]
push 1
push eax
push 0x4cb
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call ebx
push eax
push str.Failed_to_set_Wins_Server__error_d_n
call fcn.0041c506
add esp, 8
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebp
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x14]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x114
ret