Function at 0x406df0
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x320
lea eax, [esp + 4]
push ebx
push eax
xor ebx, ebx
push 0xf003f
push ebx
push str.SOFTWAREArray_NetworksArray_SSL_VPN8_4_6_40DNS_Backup
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40716b
push esi
push edi
mov ecx, 0x40
lea edi, [esp + 0x21]
mov byte [esp + 0x20], bl
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
lea ecx, [esp + 0x18]
push ebx
lea edx, [esp + 0x30]
push ecx
stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
push edx
mov esi, 0x104
push ebx
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40715e
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
lea edx, [esp + 0x2c]
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407127
mov ecx, 0x40
lea edi, [esp + 0x22d]
mov byte [esp + 0x22c], bl
lea edx, [esp + 0x22c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], ebx
stosb byte es:[edi], al
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push edx
push eax
push ebx
push 0x437184
push ecx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407117
mov ecx, 0x40
lea edi, [esp + 0x129]
mov byte [esp + 0x128], bl
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x12c]
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [0x441ff4]
add esp, 0xc
cmp eax, ebx
je 0x406f99
mov ecx, dword [0x441fd4]
mov eax, dword [ecx]
cmp eax, 3
je 0x406f2c
mov edx, dword [0x441fdc]
cmp dword [edx], ebx
jne 0x406f99
cmp eax, 3
jle 0x406f99
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call ebp
mov edi, eax
mov eax, dword [0x436030]
cmp eax, ebx
jge 0x406f4b
mov eax, dword [0x441fa0]
mov dword [0x436030], eax
call fcn.0041c4b1
test eax, eax
je 0x406f8b
mov ecx, dword [0x436030]
push 3
push ecx
push 0x6ba
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
lea edx, [esp + 0x138]
lea eax, [esp + 0x34]
push edx
push eax
push str.restore_interface:__s_:__s_n
call fcn.0041c506
add esp, 0x1c
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x128]
push ecx
push 0x20006
push ebx
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40705f
cmp dword [0x441ff4], ebx
je 0x407117
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 1
je 0x406fee
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebx
jne 0x407117
cmp eax, 1
jle 0x407117
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call ebp
mov edi, eax
mov eax, dword [0x436030]
cmp eax, ebx
jge 0x40700f
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x40704c
mov eax, dword [0x436030]
push 1
push eax
push 0x6bf
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call ebp
lea ecx, [esp + 0x24]
push eax
push ecx
push str.Failed_to_open_interface_registry:_s__error_d_n
call fcn.0041c506
add esp, 0xc
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x407117
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x22c]
push edx
push eax
push 1
push ebx
push str.NameServer
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40710c
cmp dword [0x441ff4], ebx
je 0x40710c
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 3
je 0x4070ab
mov ecx, dword [0x441fdc]
cmp dword [ecx], ebx
jne 0x40710c
cmp eax, 3
jle 0x40710c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call ebp
mov edi, eax
mov eax, dword [0x436030]
cmp eax, ebx
jge 0x4070cc
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x4070fe
mov eax, dword [0x436030]
push 3
push eax
push 0x6c5
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
push str.restore_physical_dns_sucess_n
call fcn.0041c506
add esp, 0x14
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x104
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0x14]
push ebx
push ebx
push ebx
lea edx, [esp + 0x1c]
push ebx
lea eax, [esp + 0x34]
push edx
push eax
push ebx
push ecx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x406e62
pop ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x320
ret