Function at 0x449250
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
push edi
push 0
push 0
push 0xf0
push 0x2931
push dword [0x4e6030]
call ebx
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4492bd
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call edi
test eax, eax
jne 0x449321
push str.Tcp1323Opts
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x14]
jmp 0x44931f
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call edi
test eax, eax
jne 0x449321
push eax
push eax
push 0x147
push 0x293d
push dword [0x4e6030]
call ebx
push eax
call ebp
mov dword [esp + 0x18], eax
cmp eax, 2
jne 0x449301
mov dword [esp + 0x18], 3
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.Tcp1323Opts
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
push 0
push 0xf0
push 0x2932
push dword [0x4e6030]
call ebx
push eax
call ebp
test eax, eax
jne 0x44936f
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call edi
test eax, eax
jne 0x4493c6
push str.MaxDupAcks
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x1c]
jmp 0x4493c4
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call edi
test eax, eax
jne 0x4493c6
push eax
push eax
push 0x400
push 0x293a
push dword [0x4e6030]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.MaxDupAcks
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
call esi
push 0
push 0
push 0xf0
push 0x2939
push dword [0x4e6030]
call ebx
push eax
call ebp
test eax, eax
jne 0x449414
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call edi
test eax, eax
jne 0x44946b
push str.MaxConnectionsPer1_0Server
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x1c]
jmp 0x449469
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call edi
test eax, eax
jne 0x44946b
push eax
push eax
push 0x400
push 0x293b
push dword [0x4e6030]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.MaxConnectionsPer1_0Server
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
call esi
push 0
push 0
push 0xf0
push 0x2939
push dword [0x4e6030]
call ebx
push eax
call ebp
test eax, eax
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
jne 0x4494b5
call edi
test eax, eax
jne 0x4494f6
push str.MaxConnectionsPerServer
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4494f0
call edi
test eax, eax
jne 0x4494f6
push eax
push eax
push 0x400
push 0x293c
push dword [0x4e6030]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.MaxConnectionsPerServer
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x449559
push eax
push eax
push 0xf0
push 0x2937
push dword [0x4e6030]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.SackOpts
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call edi
test eax, eax
jne 0x4495bc
push eax
push eax
push 0xf0
push 0x2938
push dword [0x4e6030]
call ebx
push eax
call ebp
mov dword [esp + 0x1c], eax
test eax, eax
je 0x44959c
mov dword [esp + 0x1c], 2
push 4
lea eax, [esp + 0x20]
push eax
push 4
push 0
push str.SynAttackProtect
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesNetBTParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x44961f
push eax
push eax
push 0xf0
push 0x2933
push dword [0x4e6030]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.RandomAdapter
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftRASPROTOCOLS
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x449682
push eax
push eax
push 0xf0
push 0x2934
push dword [0x4e6030]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.EnableUnimodem
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4496e5
push eax
push eax
push 0xf0
push 0x2935
push dword [0x4e6030]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.DisableTaskOffload
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftOle
push 0x80000002
call edi
test eax, eax
jne 0x449759
push eax
push eax
push 0xf0
push 0x2936
push dword [0x4e6030]
call ebx
push eax
call ebp
test eax, eax
je 0x449744
push 4
push 0x4ba170
push 1
push 0
push str.EnableRemoteConnect
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push str.EnableRemoteConnect
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret