Function at 0x1005a7e0
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x4c], 0
push 0x31
push 0
lea eax, [ebp - 0x4b]
push eax
call fcn.100139b0
add esp, 0xc
mov byte [ebp - 0xf0], 0
push 0x63
push 0
lea ecx, [ebp - 0xef]
push ecx
call fcn.100139b0
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.10001af0
mov byte [ebp - 0x208], 0
xor edx, edx
mov dword [ebp - 0x207], edx
mov dword [ebp - 0x203], edx
mov dword [ebp - 0x1ff], edx
mov word [ebp - 0x1fb], dx
mov byte [ebp - 0x1f9], dl
lea eax, [ebp - 0x84]
mov dword [ebp - 0x230], eax
mov dword [ebp - 8], 0x10079738
mov dword [ebp - 0x1f4], 2
lea ecx, [ebp - 0x1f8]
call fcn.10001af0
lea ecx, [ebp - 4]
call fcn.10001af0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x1f8]
call fcn.100017b0
lea ecx, [ebp - 0x1f8]
call fcn.10001330
sub eax, 1
push eax
push 1
lea edx, [ebp - 0x234]
push edx
lea ecx, [ebp - 0x1f8]
call fcn.10001e20
push eax
lea ecx, [ebp - 4]
call fcn.10002750
lea ecx, [ebp - 0x234]
call fcn.10001850
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x1f8]
call fcn.10002750
lea ecx, [ebp - 0x1f8]
call fcn.10001330
sub eax, 1
push eax
push 0
lea ecx, [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x1f8]
call fcn.10001e20
push eax
lea ecx, [ebp - 4]
call fcn.10002750
lea ecx, [ebp - 0x238]
call fcn.10001850
lea edx, [ebp - 0x228]
push edx
lea ecx, [ebp - 4]
call fcn.100035f0
push eax
call dword [sym.imp.RPCRT4.dll_UuidFromStringA]
cmp dword [ebp + 0xc], 0
jne 0x1005ac5e
lea eax, [ebp - 0x14]
push eax
push 0x10079740
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x14], 0xffffffff
je 0x1005a9b9
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10013a30
add esp, 4
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
push 0x1007977c
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10013a30
add esp, 4
push eax
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0
push 0x1007978c
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x208]
push ecx
call fcn.10013a30
add esp, 4
push eax
lea edx, [ebp - 0x208]
push edx
push 1
push 0
push 0x100797a0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x14]
push edx
push 0x100797b8
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x14], 0xffffffff
je 0x1005aa4f
mov eax, dword [ebp + 0x10]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
push 0x100797f0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 0x10]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
push 0x10079800
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x208]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x208]
push ecx
push 1
push 0
push 0x10079814
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
push ecx
push 0x1007982c
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x14], 0xffffffff
je 0x1005aae5
mov edx, dword [ebp + 0x10]
push edx
call fcn.10013a30
add esp, 4
push eax
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0
push 0x10079864
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp + 0x10]
push edx
call fcn.10013a30
add esp, 4
push eax
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0
push 0x10079874
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp - 0x208]
push edx
call fcn.10013a30
add esp, 4
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0
push 0x10079888
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.100139b0
add esp, 0xc
push 0x100798a0
lea ecx, [ebp - 0x1f0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x50]
push ecx
push 0x20006
push 0
lea edx, [ebp - 0x1f0]
push edx
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1005ab73
mov byte [ebp - 0x239], 0
lea ecx, [ebp - 4]
call fcn.10001850
lea ecx, [ebp - 0x1f8]
call fcn.10001850
lea ecx, [ebp - 0xc]
call fcn.10001850
mov al, byte [ebp - 0x239]
jmp 0x1005b029
mov dword [ebp - 0x10], 0
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x100798e0
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push 0x100798f4
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10013a30
add esp, 4
add eax, 2
mov dword [ebp - 0x88], eax
mov edx, dword [ebp + 0x14]
push edx
call fcn.10013a30
add esp, 4
add eax, 2
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 7
push 0
push 0x10079900
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x22c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 7
push 0
push 0x1007990c
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1006facb
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x228]
mov dword [eax], ecx
mov edx, dword [ebp - 0x224]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x220]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x21c]
mov dword [eax + 0xc], edx
call fcn.10040410
add esp, 0x1c
jmp 0x1005b001
lea eax, [ebp - 0x14]
push eax
push str.SYSTEMCurrentControlSet_servicesSharedAccessParameters_
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x14], 0xffffffff
je 0x1005ad22
push 0x10079954
lea ecx, [ebp - 0x208]
push ecx
call fcn.10016875
add esp, 8
lea edx, [ebp - 0x208]
push edx
call fcn.10013a30
add esp, 4
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0
push 0x10079964
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp - 0x208]
push edx
call fcn.10013a30
add esp, 4
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0
push 0x10079974
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x10079988
lea edx, [ebp - 0x208]
push edx
call fcn.10016875
add esp, 8
lea eax, [ebp - 0x208]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x208]
push ecx
push 1
push 0
push 0x10079998
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
push ecx
push str.SYSTEMControlSet001_servicesSharedAccessParameters_
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x14], 0xffffffff
je 0x1005adf0
push 0x100799e8
lea edx, [ebp - 0x208]
push edx
call fcn.10016875
add esp, 8
lea eax, [ebp - 0x208]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x208]
push ecx
push 1
push 0
push 0x100799f8
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x208]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x208]
push ecx
push 1
push 0
push 0x10079a08
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x10079a1c
lea eax, [ebp - 0x208]
push eax
call fcn.10016875
add esp, 8
lea ecx, [ebp - 0x208]
push ecx
call fcn.10013a30
add esp, 4
push eax
lea edx, [ebp - 0x208]
push edx
push 1
push 0
push 0x10079a2c
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x14]
push edx
push str.SYSTEMControlSet002_servicesSharedAccessParameters_
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x14], 0xffffffff
je 0x1005aebe
push str.192.168.137.1
lea eax, [ebp - 0x208]
push eax
call fcn.10016875
add esp, 8
lea ecx, [ebp - 0x208]
push ecx
call fcn.10013a30
add esp, 4
push eax
lea edx, [ebp - 0x208]
push edx
push 1
push 0
push str.ScopeAddress
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x208]
push ecx
call fcn.10013a30
add esp, 4
push eax
lea edx, [ebp - 0x208]
push edx
push 1
push 0
push str.ScopeAddressBackup
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.192.168.173.1
lea ecx, [ebp - 0x208]
push ecx
call fcn.10016875
add esp, 8
lea edx, [ebp - 0x208]
push edx
call fcn.10013a30
add esp, 4
push eax
lea eax, [ebp - 0x208]
push eax
push 1
push 0
push str.StandaloneDhcpAddress
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.100139b0
add esp, 0xc
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
lea ecx, [ebp - 0x1f0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x50]
push ecx
push 0x20006
push 0
lea edx, [ebp - 0x1f0]
push edx
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1005af4c
mov byte [ebp - 0x23a], 0
lea ecx, [ebp - 4]
call fcn.10001850
lea ecx, [ebp - 0x1f8]
call fcn.10001850
lea ecx, [ebp - 0xc]
call fcn.10001850
mov al, byte [ebp - 0x23a]
jmp 0x1005b029
mov dword [ebp - 0x10], 1
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.EnableDeadGWDetect
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push str.EnableDHCP
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.IPAddress
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.SubnetMask
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x228]
mov dword [eax], ecx
mov edx, dword [ebp - 0x224]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x220]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x21c]
mov dword [eax + 0xc], edx
call fcn.10040360
add esp, 0x10
push 0x1006face
push 0x1006facf
push 0x1006faed
push 0x1006faee
push 1
mov eax, dword [ebp + 8]
push eax
call sym.RtlLib.dll_RT_SetNicTcpipAddr
add esp, 0x18
mov ecx, dword [ebp + 8]
push ecx
call fcn.1003f8b0
add esp, 4
mov byte [ebp - 0x23b], 1
lea ecx, [ebp - 4]
call fcn.10001850
lea ecx, [ebp - 0x1f8]
call fcn.10001850
lea ecx, [ebp - 0xc]
call fcn.10001850
mov al, byte [ebp - 0x23b]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret