Function at 0x40ce80
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword [0x441ff4]
sub esp, 0x81c
test eax, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
push edi
je 0x40cf18
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x40cebb
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x40cf18
cmp eax, 3
jle 0x40cf18
call ebp
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40ced8
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x40cf0a
mov eax, dword [0x436030]
push 3
push eax
push 0xb99
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
push str.Restore_network_params_..._n
call fcn.0041c506
add esp, 0x14
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.00421d32
mov ecx, dword [esp + 0x830]
lea edx, [esp + 0x42c]
push ecx
push 0x436d98
push str.Array_Networks
push str.Software_s_s_s
push edx
mov dword [esp + 0x38], eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea eax, [esp + 0x10]
lea ecx, [esp + 0x42c]
push eax
push 0x2001f
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40d018
mov eax, dword [0x441ff4]
test eax, eax
je 0x40d706
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 1
je 0x40cfa2
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x40d706
cmp eax, 1
jle 0x40d706
call ebp
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40cfbf
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x40cfff
mov eax, dword [0x436030]
push 1
push eax
push 0xba6
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call ebx
lea ecx, [esp + 0x42c]
push eax
push ecx
push str.Failed_to_open_registry_for_this_version__s__error_d_n
call fcn.0041c506
add esp, 0xc
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push 0
push str.OldDefaultRouteNums
push ecx
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d388
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jbe 0x40d388
lea eax, [ecx*8]
sub eax, ecx
shl eax, 3
push eax
mov dword [esp + 0x18], eax
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x28], ebp
je 0x40d301
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push ebp
push 0
push 0
push str.OldDefaultRoute
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d26d
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
test eax, eax
jbe 0x40d1c2
lea esi, [ebp + 0xf]
lea edi, [esi - 0xf]
push edi
call sub.iphlpapi.dll_CreateIpForwardEntry
mov ebx, eax
mov eax, dword [0x441ff4]
test eax, eax
je 0x40d1a4
mov ecx, dword [0x441fd4]
mov eax, dword [ecx]
cmp eax, 3
je 0x40d0eb
mov edx, dword [0x441fdc]
cmp dword [edx], 0
jne 0x40d1a4
cmp eax, 3
jle 0x40d1a4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x20], eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40d110
mov eax, dword [0x441fa0]
mov dword [0x436030], eax
call fcn.0041c4b1
test eax, eax
je 0x40d18e
mov ecx, dword [0x436030]
push 3
push ecx
push 0xbba
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
mov edx, dword [esi + 1]
push ebx
xor eax, eax
push edx
mov al, byte [esi]
xor ecx, ecx
mov cl, byte [esi - 1]
xor edx, edx
mov dl, byte [esi - 2]
push eax
push ecx
xor eax, eax
mov al, byte [esi - 3]
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [esi - 8]
mov dl, byte [esi - 9]
push eax
push ecx
xor eax, eax
push edx
mov al, byte [esi - 0xa]
xor ecx, ecx
mov cl, byte [esi - 0xb]
xor edx, edx
mov dl, byte [esi - 0xc]
push eax
push ecx
xor eax, eax
mov al, byte [esi - 0xd]
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [esi - 0xe]
mov dl, byte [edi]
push eax
push ecx
push edx
push str.RestoreNetworkParams__add_route:__d._d._d._d__d._d._d._d_____d._d._d._d__d__returned__d_n
call fcn.0041c506
add esp, 0x4c
call fcn.0041c4cc
push ebp
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc eax
add esi, 0x38
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x40d0ae
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.OldDefaultRoute
push ecx
call esi
test eax, eax
jne 0x40d2f3
mov edx, dword [esp + 0x10]
push str.OldDefaultRouteNums
push edx
call esi
test eax, eax
jne 0x40d2f3
mov eax, dword [0x441ff4]
test eax, eax
je 0x40d2f3
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x40d221
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x40d2f3
cmp eax, 3
jle 0x40d2f3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40d242
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x40d2e5
mov eax, dword [0x436030]
push 3
push eax
push 0xbc0
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
push str.Deleted_saved_default_route_n
jmp 0x40d2d8
mov eax, dword [0x441ff4]
test eax, eax
je 0x40d2f3
mov ecx, dword [0x441fd4]
mov eax, dword [ecx]
cmp eax, 3
je 0x40d293
mov edx, dword [0x441fdc]
cmp dword [edx], 0
jne 0x40d2f3
cmp eax, 3
jle 0x40d2f3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40d2b2
mov eax, dword [0x441fa0]
mov dword [0x436030], eax
call fcn.0041c4b1
test eax, eax
je 0x40d2e5
mov ecx, dword [0x436030]
push 3
push ecx
push 0xbc5
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
push str.Didnt_find_saved_default_route_n
call fcn.0041c506
add esp, 0x14
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
jmp 0x40d388
mov eax, dword [0x441ff4]
test eax, eax
je 0x40d388
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 1
je 0x40d327
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x40d388
cmp eax, 1
jle 0x40d388
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40d348
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x40d37a
mov eax, dword [0x436030]
push 1
push eax
push 0xbca
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
push str.Didnt_allocate_memory_for_default_route_n
call fcn.0041c506
add esp, 0x14
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2c]
push ecx
push edx
push 0
push 0
push str.OrigSearchList
push eax
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40d679
mov eax, dword [esp + 0x24]
mov ebx, str.SystemCurrentControlSetServicesVxDMSTCP
test eax, eax
jne 0x40d3ce
mov ebx, str.SYSTEMCurrentControlSetServicesTcpipParameters
lea ecx, [esp + 0x18]
push ecx
push 0x20006
push 0
push ebx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d545
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x2c]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x28]
push str.SearchList
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov eax, dword [0x441ff4]
jne 0x40d4a8
test eax, eax
je 0x40d539
mov ecx, dword [0x441fd4]
mov eax, dword [ecx]
cmp eax, 3
je 0x40d44c
mov edx, dword [0x441fdc]
cmp dword [edx], 0
jne 0x40d539
cmp eax, 3
jle 0x40d539
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40d46f
mov eax, dword [0x441fa0]
mov dword [0x436030], eax
call fcn.0041c4b1
test eax, eax
je 0x40d52b
mov ecx, dword [0x436030]
push 3
push ecx
push 0xbdd
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
lea edx, [esp + 0x3c]
push edx
push str.Reset_domain_Search_List:__s_n
call fcn.0041c506
add esp, 0x18
jmp 0x40d526
test eax, eax
je 0x40d539
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 1
je 0x40d4cc
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x40d539
cmp eax, 1
jle 0x40d539
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40d4f3
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x40d52b
mov eax, dword [0x436030]
push 1
push eax
push 0xbe1
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call ebx
push eax
push str.Failed_to_resset_domain_search_list__error_d_n
call fcn.0041c506
add esp, 8
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x18]
push ecx
call ebp
jmp 0x40d5df
mov eax, dword [0x441ff4]
test eax, eax
je 0x40d5df
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 1
je 0x40d56f
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x40d5df
cmp eax, 1
jle 0x40d5df
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40d594
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x40d5d1
mov eax, dword [0x436030]
push 1
push eax
push 0xbe8
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str.Failed_to_open_reg:_s__error_d_n
call fcn.0041c506
add esp, 0xc
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x10]
push str.OrigSearchList
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x40d6ff
mov eax, dword [0x441ff4]
test eax, eax
je 0x40d6ff
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 3
je 0x40d629
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x40d6ff
cmp eax, 3
jle 0x40d6ff
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40d64e
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x40d6f1
mov eax, dword [0x436030]
push 3
push eax
push 0xbed
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
push str.Deleted_saved_Original_Domain_Search_List_n
jmp 0x40d6e4
mov eax, dword [0x441ff4]
test eax, eax
je 0x40d6ff
mov ecx, dword [0x441fd4]
mov eax, dword [ecx]
cmp eax, 3
je 0x40d69f
mov edx, dword [0x441fdc]
cmp dword [edx], 0
jne 0x40d6ff
cmp eax, 3
jle 0x40d6ff
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40d6be
mov eax, dword [0x441fa0]
mov dword [0x436030], eax
call fcn.0041c4b1
test eax, eax
je 0x40d6f1
mov ecx, dword [0x436030]
push 3
push ecx
push 0xbf2
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
push str.Didnt_find_saved_search_list_n
call fcn.0041c506
add esp, 0x14
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x10]
push edx
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x81c
ret