Function at 0x478710
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry key
Set registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4cacfc]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push esi
push str.NodeType
xor esi, esi
push 0x4a8a30
push reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0x104
call fcn.0047f480
push str.DhcpNodeType
push 0x4a8ab8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f480
push str.SMBDeviceEnabled
push 0x4a8b48
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f480
push str.SMB1
push 0x4a8bc0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f480
push str.SMB2
push str.SYSTEMCurrentControlSet_servicesLanmanServerParameters
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f480
add esp, 0x3c
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerRemoteComputerNameSpaceD6277990_4C6A_11CF_8D87_00AA0060F5BF
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0x12
push 0x4aade4
push str.TransportBindName
push str.SYSTEMCurrentControlSet_servicesNetBTParameters
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f270
push 0xa
push str.Auto
push str.MaintainServerList
push 0x4a8e50
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f270
push 0xc
push str.FALSE
push str.IsDomainMaster
push str.SYSTEMCurrentControlSet_servicesBrowserParameters
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f270
push 1
push str.everyoneincludesanonymous
push 0x4a8f80
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x54], 1
call fcn.0047f3d0
mov eax, dword [esp + 0x54]
add esp, 0x4c
push eax
push str.EnableLMHOSTS
push str.SYSTEMCurrentControlSetServicesNetBTParameters
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f3d0
mov ecx, dword [esp + 0x18]
push ecx
push str.LmCompatibilityLevel
push 0x4a9080
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f3d0
mov edx, dword [esp + 0x28]
push edx
push str.AllowInsecureGuestAuth
push str.SYSTEMCurrentControlSetServicesLanmanWorkstationParameters
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f3d0
push esi
push str.NtlmMinClientSec
push 0x4a91b0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x48], esi
call fcn.0047f3d0
add esp, 0x40
mov eax, dword [esp + 8]
push eax
push str.NtlmMinServerSec
push str.SYSTEMCurrentControlSetControlLsaMSV1_0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f3d0
mov ecx, dword [esp + 0x18]
push ecx
push str.LimitBlankPasswordUse
push 0x4a92d8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f3d0
mov edx, dword [esp + 0x28]
push edx
push str.restrictanonymous
push 0x4a9328
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f3d0
mov eax, dword [esp + 0x38]
push eax
push str.restrictanonymoussam
push 0x4a93a0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f3d0
mov ecx, dword [esp + 0x48]
add esp, 0x40
push ecx
push str.NoLmHash
push 0x4a9400
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f3d0
mov edx, dword [esp + 0x18]
push edx
push str.restrictnullsessaccess
push 0x4a9480
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f3d0
push 0x1ed
push str.Epoch
push str.SYSTEMCurrentControlSetServicesSharedAccessEpoch
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], 0x1ed
call fcn.0047f3d0
push 8
push 0x4aadc4
push 3
push str.LogonTime
push str.SYSTEMCurrentControlSetControlPrintProviders
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f320
add esp, 0x48
push 0xf003f
push 0x4a95e4
push str.MACHINESYSTEMCurrentControlSetServicesSharedAccessParameters
call fcn.0047f000
push 0x4a9688
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f0d0
add esp, 0x14
test eax, eax
jne 0x4789a0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewa_llPolicy
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f120
add esp, 8
push 0x4a97d8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f0d0
add esp, 8
test eax, eax
jne 0x4789c8
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewa_llPolicyStandardProfile
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f120
add esp, 8
push 0x4a9960
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f0d0
add esp, 8
test eax, eax
jne 0x4789f0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewa_llPolicyStandardProfileGloballyOpenPorts
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f120
add esp, 8
push 0x4a9b10
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f0d0
add esp, 8
test eax, eax
jne 0x478a18
push 0x4a9bf8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f120
add esp, 8
push 0x62
push str.137:UDP:LocalSubNet:Enabled:_xpsp2res.dll__22001
push str.137:UDP
push 0x4a9cf8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f270
push 0x62
push str.138:UDP:LocalSubNet:Enabled:_xpsp2res.dll__22002
push str.138:UDP
push 0x4a9e00
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f270
push 0x62
push str.139:TCP:LocalSubNet:Enabled:_xpsp2res.dll__22004
push str.139:TCP
push 0x4a9f00
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f270
push 0x62
push str.445:TCP:LocalSubNet:Enabled:_xpsp2res.dll__22005
push str.445:TCP
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewa_llPolicyStandardProfileGloballyOpenPortsList
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0047f270
add esp, 0x50
lea eax, [esp + 0xc]
push eax
push 0x20019
push esi
push str.SYSTEMCurrentControlSet_servicesNetBTParametersInterfaces
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x478b65
push edi
mov edi, dword [esp + 0x10]
cmp edi, esi
je 0x478b64
push ebp
push 0x208
lea ecx, [esp + 0x24]
push esi
push ecx
call fcn.00487630
add esp, 0xc
push esi
push esi
push esi
push esi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x34]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x478b5c
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push 0x20006
push esi
lea edx, [esp + 0x2c]
push edx
push eax
inc ebx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x478b3e
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x478b3e
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push esi
push str.NetbiosOptions
push eax
mov dword [esp + 0x28], esi
call edi
mov edx, dword [esp + 0x18]
push edx
call ebp
mov edx, dword [esp + 0x14]
push esi
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x478af1
mov eax, dword [esp + 0x14]
push eax
call ebp
pop ebp
pop edi
mov ecx, dword [esp + 0x220]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00486dc0
add esp, 0x21c
ret