Function at 0x4988f0
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589cc6
mov eax, dword fs:[0]
push eax
mov eax, 0x8840
call fcn.0056b140
mov eax, dword [0x61b000]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
call fcn.00402270
mov dword [ebp - 0x825c], eax
lea eax, [ebp - 0x24]
push eax
push 0x2001f
push 0
push 0x59ce30
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x498987
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x861d], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004060d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404750
mov al, byte [ebp - 0x861d]
jmp 0x499713
mov dx, word [0x59cf08]
mov word [ebp - 0x8244], dx
push 0x206
push 0
lea eax, [ebp - 0x8242]
push eax
call fcn.00568440
add esp, 0xc
mov dword [ebp - 0x28], 0x104
mov dword [ebp - 0x803c], 0
mov dword [ebp - 0x8248], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x8258], 0
mov dword [ebp - 0x8254], 0
mov dword [ebp - 0x8038], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x8264], 0x3fff
lea ecx, [ebp - 0x8250]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x8038]
push eax
lea ecx, [ebp - 0x8254]
push ecx
lea edx, [ebp - 0x8258]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x8248]
push ecx
lea edx, [ebp - 0x803c]
push edx
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x8244]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x498a89
mov byte [ebp - 0x861e], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004060d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404750
mov al, byte [ebp - 0x861e]
jmp 0x499713
cmp dword [ebp - 0x8258], 0
je 0x4996e1
mov byte [ebp - 0x8265], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
jmp 0x498ab6
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x8258]
jae 0x4996e1
mov dword [ebp - 0x8264], 0x3fff
xor edx, edx
mov word [ebp - 0x8034], dx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8264]
push eax
lea ecx, [ebp - 0x8034]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4996dc
xor ecx, ecx
mov word [ebp - 0x846c], cx
push 0x1fc
push 0
lea edx, [ebp - 0x846a]
push edx
call fcn.00568440
add esp, 0xc
mov dword [ebp - 0x8474], 0xff
lea eax, [ebp - 0x8474]
push eax
lea ecx, [ebp - 0x846c]
push ecx
push 0x6256b0
push 0
lea edx, [ebp - 0x8034]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x8470], eax
cmp dword [ebp - 0x8470], 0
jne 0x4996b2
lea ecx, [ebp - 0x846c]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0
jne 0x498b86
mov dword [ebp - 0x87bc], 0
jmp 0x498bea
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3fffffff
jle 0x498bab
mov dword [ebp - 0x87c0], 0
jmp 0x498bde
mov eax, dword [ebp - 0x14]
shl eax, 1
call fcn.00570840
mov dword [ebp - 0x87c4], esp
mov eax, dword [ebp - 0x825c]
push eax
mov ecx, dword [ebp - 0x14]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x87c4]
push eax
call fcn.004022d0
mov dword [ebp - 0x87c0], eax
mov ecx, dword [ebp - 0x87c0]
mov dword [ebp - 0x87bc], ecx
mov edx, dword [ebp - 0x87bc]
push edx
lea ecx, [ebp - 0x8490]
call fcn.00406050
mov byte [ebp - 4], 2
push 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x8490]
call fcn.00418ae0
cmp eax, dword [0x60735c]
je 0x4996a1
lea ecx, [ebp - 0x85c8]
call fcn.0040e640
mov byte [ebp - 4], 3
push 0x59cf0c
lea ecx, [ebp - 0x863c]
call fcn.00406050
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x863c]
push ecx
lea edx, [ebp - 0x85c8]
push edx
lea eax, [ebp - 0x8490]
push eax
call fcn.00415af0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x863c]
call fcn.004060d0
lea ecx, [ebp - 0x85ac]
call fcn.004046c0
mov byte [ebp - 4], 5
push 0
lea ecx, [ebp - 0x85c8]
call fcn.00412aa0
push eax
lea ecx, [ebp - 0x8504]
call fcn.004060f0
push 1
lea ecx, [ebp - 0x85c8]
call fcn.00412aa0
push eax
lea ecx, [ebp - 0x853c]
call fcn.004060f0
push 2
lea ecx, [ebp - 0x85c8]
call fcn.00412aa0
push eax
lea ecx, [ebp - 0x8574]
call fcn.004060f0
push 3
lea ecx, [ebp - 0x85c8]
call fcn.00412aa0
push eax
lea ecx, [ebp - 0x8590]
call fcn.004060f0
push 4
lea ecx, [ebp - 0x85c8]
call fcn.00412aa0
push eax
lea ecx, [ebp - 0x85ac]
call fcn.004060f0
push 0x59508d
lea ecx, [ebp + 0x104]
push ecx
call fcn.00407dd0
add esp, 8
movzx edx, al
test edx, edx
je 0x498db2
push fcn.00561611
lea eax, [ebp - 0x8644]
push eax
lea ecx, [ebp + 0x104]
call fcn.00406130
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x864c]
push eax
lea ecx, [ebp + 0x104]
call fcn.00406160
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x8654]
push eax
lea ecx, [ebp + 0x104]
call fcn.00406130
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x865c]
push eax
call fcn.00407d50
add esp, 0x20
push 0
push 0x59cf10
lea ecx, [ebp + 0x104]
call fcn.00422ea0
cmp eax, dword [0x60735c]
je 0x498da2
push str.Enable
lea ecx, [ebp - 0x84cc]
call fcn.00406110
jmp 0x498db2
push str.Disable
lea ecx, [ebp - 0x84cc]
call fcn.00406110
push 0x59508e
lea ecx, [ebp + 0x5c]
push ecx
call fcn.00407dd0
add esp, 8
movzx edx, al
test edx, edx
je 0x498dd9
lea eax, [ebp + 0x5c]
push eax
lea ecx, [ebp - 0x8574]
call fcn.004060f0
mov byte [ebp - 0x85ad], 0
push 0x59508f
lea ecx, [ebp + 0xcc]
push ecx
call fcn.00407dd0
add esp, 8
movzx edx, al
test edx, edx
je 0x498e31
lea eax, [ebp + 0xcc]
push eax
lea ecx, [ebp - 0x8504]
push ecx
call fcn.004708e0
add esp, 8
movzx edx, al
test edx, edx
je 0x498e1f
mov byte [ebp - 0x85ad], 1
lea eax, [ebp + 0xcc]
push eax
lea ecx, [ebp - 0x8504]
call fcn.004060f0
push 0x595117
lea ecx, [ebp + 0x94]
push ecx
call fcn.00407dd0
add esp, 8
movzx edx, al
test edx, edx
je 0x498e82
lea eax, [ebp + 0x94]
push eax
lea ecx, [ebp - 0x853c]
push ecx
call fcn.004708e0
add esp, 8
movzx edx, al
test edx, edx
je 0x498e70
mov byte [ebp - 0x85ad], 1
lea eax, [ebp + 0x94]
push eax
lea ecx, [ebp - 0x853c]
call fcn.004060f0
movzx ecx, byte [ebp - 0x85ad]
test ecx, ecx
je 0x4994d9
push str.:::::
lea edx, [ebp - 0x8504]
push edx
lea eax, [ebp - 0x8678]
push eax
call fcn.00407cc0
add esp, 0xc
mov dword [ebp - 0x87c8], eax
mov ecx, dword [ebp - 0x87c8]
mov dword [ebp - 0x87cc], ecx
mov byte [ebp - 4], 6
lea edx, [ebp - 0x853c]
push edx
mov eax, dword [ebp - 0x87cc]
push eax
lea ecx, [ebp - 0x85e4]
push ecx
call fcn.0041ea00
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x8678]
call fcn.004060d0
push 0x59cf38
lea edx, [ebp - 0x8504]
push edx
lea eax, [ebp - 0x8694]
push eax
call fcn.00407cc0
add esp, 0xc
mov dword [ebp - 0x87d0], eax
mov ecx, dword [ebp - 0x87d0]
mov dword [ebp - 0x87d4], ecx
mov byte [ebp - 4], 9
lea edx, [ebp - 0x853c]
push edx
mov eax, dword [ebp - 0x87d4]
push eax
lea ecx, [ebp - 0x86b0]
push ecx
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x87d8], eax
mov edx, dword [ebp - 0x87d8]
mov dword [ebp - 0x87dc], edx
mov byte [ebp - 4], 0xa
push 0x59cf34
mov eax, dword [ebp - 0x87dc]
push eax
lea ecx, [ebp - 0x86cc]
push ecx
call fcn.00407cc0
add esp, 0xc
mov dword [ebp - 0x87e0], eax
mov edx, dword [ebp - 0x87e0]
mov dword [ebp - 0x87e4], edx
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x8574]
push eax
mov ecx, dword [ebp - 0x87e4]
push ecx
lea edx, [ebp - 0x86e8]
push edx
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x87e8], eax
mov eax, dword [ebp - 0x87e8]
mov dword [ebp - 0x87ec], eax
mov byte [ebp - 4], 0xc
push 0x59cf30
mov ecx, dword [ebp - 0x87ec]
push ecx
lea edx, [ebp - 0x8704]
push edx
call fcn.00407cc0
add esp, 0xc
mov dword [ebp - 0x87f0], eax
mov eax, dword [ebp - 0x87f0]
mov dword [ebp - 0x87f4], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x84cc]
push ecx
mov edx, dword [ebp - 0x87f4]
push edx
lea eax, [ebp - 0x8720]
push eax
call fcn.0041ea00
add esp, 0xc
mov dword [ebp - 0x87f8], eax
mov ecx, dword [ebp - 0x87f8]
mov dword [ebp - 0x87fc], ecx
mov byte [ebp - 4], 0xe
push 0x59cf2c
mov edx, dword [ebp - 0x87fc]
push edx
lea eax, [ebp - 0x873c]
push eax
call fcn.00407cc0
add esp, 0xc
mov dword [ebp - 0x8800], eax
mov ecx, dword [ebp - 0x8800]
mov dword [ebp - 0x8804], ecx
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x85ac]
push edx
mov eax, dword [ebp - 0x8804]
push eax
lea ecx, [ebp - 0x8600]
push ecx
call fcn.0041ea00
add esp, 0xc
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x873c]
call fcn.004060d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x8720]
call fcn.004060d0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x8704]
call fcn.004060d0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x86e8]
call fcn.004060d0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x86cc]
call fcn.004060d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x86b0]
call fcn.004060d0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x8694]
call fcn.004060d0
lea ecx, [ebp - 0x85e4]
call fcn.00406190
mov dword [ebp - 0x8260], eax
cmp dword [ebp - 0x8260], 0
jne 0x4990f7
mov dword [ebp - 0x8808], 0
jmp 0x49915f
mov edx, dword [ebp - 0x8260]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3fffffff
jle 0x49911f
mov dword [ebp - 0x880c], 0
jmp 0x499153
mov eax, dword [ebp - 0x14]
shl eax, 1
call fcn.00570840
mov dword [ebp - 0x8810], esp
mov eax, dword [ebp - 0x825c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x8260]
push edx
mov eax, dword [ebp - 0x8810]
push eax
call fcn.00402280
mov dword [ebp - 0x880c], eax
mov ecx, dword [ebp - 0x880c]
mov dword [ebp - 0x8808], ecx
mov edx, dword [ebp - 0x8808]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x8470], eax
cmp dword [ebp - 0x8470], 0
jne 0x4991f5
mov byte [ebp - 0x873d], 1
lea ecx, [ebp - 0x8600]
call fcn.004060d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x85e4]
call fcn.004060d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x85ac]
call fcn.00404750
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x85c8]
call fcn.0040e6b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8490]
call fcn.004060d0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004060d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404750
mov al, byte [ebp - 0x873d]
jmp 0x499713
mov byte [ebp - 0x873e], 0
lea ecx, [ebp - 0x8600]
call fcn.004060d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x85e4]
call fcn.004060d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x85ac]
call fcn.00404750
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x85c8]
call fcn.0040e6b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8490]
call fcn.004060d0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004060d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404750
mov al, byte [ebp - 0x873e]
jmp 0x499713
lea ecx, [ebp - 0x853c]
push ecx
push str.netsh_firewall_set_portopening_protocol
lea edx, [ebp - 0x875c]
push edx
call fcn.00407c30
add esp, 0xc
mov dword [ebp - 0x882c], eax
mov eax, dword [ebp - 0x882c]
mov dword [ebp - 0x8830], eax
mov byte [ebp - 4], 0x10
push 0x59cf3c
mov ecx, dword [ebp - 0x8830]
push ecx
lea edx, [ebp - 0x8778]
push edx
call fcn.00407cc0
add esp, 0xc
mov dword [ebp - 0x8834], eax
mov eax, dword [ebp - 0x8834]
mov dword [ebp - 0x8838], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x8504]
push ecx
mov edx, dword [ebp - 0x8838]
push edx
lea eax, [ebp - 0x861c]
push eax
call fcn.0041ea00
add esp, 0xc
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x8778]
call fcn.004060d0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x875c]
call fcn.004060d0
push 0x5951a2
lea ecx, [ebp + 0x5c]
push ecx
call fcn.00407dd0
add esp, 8
movzx edx, al
test edx, edx
je 0x4995e0
lea eax, [ebp - 0x8574]
push eax
push str.scopeCUSTOM_addresses
lea ecx, [ebp - 0x8794]
push ecx
call fcn.00407c30
add esp, 0xc
mov dword [ebp - 0x883c], eax
mov edx, dword [ebp - 0x883c]
mov dword [ebp - 0x8840], edx
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x8840]
push eax
lea ecx, [ebp - 0x861c]
call fcn.00408030
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x8794]
call fcn.004060d0
push 0x5951a3
lea ecx, [ebp + 0x104]
push ecx
call fcn.00407dd0
add esp, 8
movzx edx, al
test edx, edx
je 0x49964d
lea eax, [ebp - 0x84cc]
push eax
push str._mode
lea ecx, [ebp - 0x87b0]
push ecx
call fcn.00407c30
add esp, 0xc
mov dword [ebp - 0x8844], eax
mov edx, dword [ebp - 0x8844]
mov dword [ebp - 0x8848], edx
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x8848]
push eax
lea ecx, [ebp - 0x861c]
call fcn.00408030
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x87b0]
call fcn.004060d0
push 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x87b4], esp
lea edx, [ebp - 0x861c]
push edx
call fcn.00406090
mov dword [ebp - 0x884c], eax
call fcn.00415f10
add esp, 0x20
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x861c]
call fcn.004060d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x85ac]
call fcn.00404750
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x85c8]
call fcn.0040e6b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x8490]
call fcn.004060d0
jmp 0x4996dc
mov byte [ebp - 0x87b5], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004060d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404750
mov al, byte [ebp - 0x87b5]
jmp 0x499713
jmp 0x498aad
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x87b6], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004060d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.00404750
mov al, byte [ebp - 0x87b6]
lea esp, [ebp - 0x8850]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00560c61
mov esp, ebp
pop ebp
ret