Function at 0x406c50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Query or enumerate registry value
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x41a0ab
push eax
mov eax, 0x1434
mov dword fs:[0], esp
call fcn.00419af0
mov eax, dword [0x423764]
push ebx
push ebp
mov ebp, dword [esp + 8]
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x2c], ebx
or edi, 0xffffffff
cmp eax, edi
jne 0x406dc1
xor esi, esi
mov dword [esp + 0x40], esi
lea eax, [esp + 0x18]
push eax
push 1
push ebx
push str.SystemCurrentControlSetServices_netshsvc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1460], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x406cf0
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
push ebx
push str.ServicePort
mov esi, eax
push eax
mov dword [esp + 0x58], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x406cf8
mov dword [esp + 0x14], 0x1f41
mov eax, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edx
push eax
mov dword [esp + 0x40], edx
mov word [esp + 0x34], 2
call dword [sym.imp.WS2_32.dll_htons]
push str.127.0.0.1
mov word [esp + 0x36], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push ebx
push ebx
push ebx
push 6
push 1
push 2
mov dword [esp + 0x4c], eax
call dword [sym.imp.WS2_32.dll_WSASocketA]
push ebx
push ebx
push ebx
push ebx
push 0x10
lea ecx, [esp + 0x44]
push ecx
push eax
mov dword [0x423764], eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, edi
je 0x406ed6
mov eax, dword [0x423764]
push ebx
push 0xa
lea edx, [esp + 0x24]
push edx
push eax
mov byte [esp + 0x2c], 0x1f
mov byte [esp + 0x2d], 0xc
mov byte [esp + 0x2e], 2
mov byte [esp + 0x2f], 0x11
mov byte [esp + 0x30], 7
mov byte [esp + 0x31], 0
mov byte [esp + 0x32], 0x1b
mov byte [esp + 0x33], 9
mov byte [esp + 0x34], 0x1a
mov byte [esp + 0x35], 0x48
call dword [sym.imp.WS2_32.dll_send]
mov ebp, eax
cmp ebp, 0xa
jne 0x406f16
cmp esi, ebx
mov dword [esp + 0x144c], edi
je 0x406dc1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x1454]
lea ecx, [esp + 0x1458]
push ecx
push edx
lea eax, [esp + 0x44c]
push 0x1000
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_time]
mov edi, eax
call ebx
add esp, 0x14
lea ecx, [esp + 0x444]
push ecx
push str._SendCmdToNetsh__Send_Netsh_cmd___s
push 2
push 1
mov dword [esp + 0x20], eax
xor esi, esi
call fcn.004195d0
push eax
call fcn.00419410
add esp, 0x14
push 0
call ebx
sub eax, dword [esp + 0x14]
add esp, 4
cmp eax, 0xf
jge 0x406f55
push edi
push esi
push str._SendCmdToNetsh__Send_Netsh_cmd__sent__d__total__d
push 2
push 1
call fcn.004195d0
push eax
call fcn.00419410
add esp, 0x18
cmp esi, edi
je 0x406f55
mov edx, dword [0x423764]
push 2
push edx
call fcn.00406bc0
add esp, 8
test eax, eax
je 0x406e17
mov edx, dword [0x423764]
push 0
mov eax, edi
sub eax, esi
push eax
lea ecx, [esp + esi + 0x44c]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
mov ebp, eax
test ebp, ebp
jge 0x406ec8
push esi
push ebp
push edi
lea eax, [esp + 0x450]
push eax
push str._SendCmdToNetsh__send_error__cmd__s__len___d__sent__d__total_sent__d
push 5
push 1
call fcn.004195d0
push eax
call fcn.00419410
mov ecx, dword [0x423764]
add esp, 0x20
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x2c]
or eax, 0xffffffff
inc ecx
cmp ecx, 3
mov dword [0x423764], eax
mov dword [esp + 0x2c], ecx
jl 0x406ecf
add esi, ebp
jmp 0x406e17
xor ebx, ebx
jmp 0x406c82
mov edx, dword [esp + 0x14]
push edx
push str._SendCmdToNetsh__connect_to_netshsvc_port__d_fail
push 5
push 1
call fcn.004195d0
push eax
call fcn.00419410
mov eax, dword [0x423764]
add esp, 0x14
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
cmp esi, ebx
mov dword [0x423764], edi
je 0x406f0f
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x406fff
push ebp
push str._SendCmdToNetsh__send_password_fail__sent__d
push 5
push 1
call fcn.004195d0
push eax
call fcn.00419410
mov ecx, dword [0x423764]
add esp, 0x14
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
cmp esi, ebx
mov dword [0x423764], edi
je 0x406ffd
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406ffd
push 0
call ebx
push 0
mov edi, eax
call ebx
sub eax, edi
add esp, 8
cmp eax, 0xf
jge 0x406fe6
mov ebx, dword [sym.imp.WS2_32.dll_recv]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
mov edx, dword [0x423764]
push 2
push edx
call fcn.00406b30
add esp, 8
test eax, eax
je 0x406fd4
mov ecx, dword [0x423764]
push 0
push 0x400
lea eax, [esp + 0x4c]
push eax
push ecx
call ebx
test eax, eax
jle 0x406fe6
lea edx, [esp + 0x44]
push edx
push str._SendCmdToNetsh__Recv_Netsh___s
push 2
push 1
mov byte [esp + eax + 0x54], 0
call fcn.004195d0
push eax
call fcn.00419410
lea eax, [esp + 0x58]
push str.netsh_
push eax
call esi
add esp, 0x1c
test eax, eax
jne 0x406fe6
push 0
call dword [sym.imp.MSVCRT.dll_time]
sub eax, edi
add esp, 4
cmp eax, 0xf
jl 0x406f75
mov ecx, dword [0x423764]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x423764], 0xffffffff
mov eax, ebp
mov ecx, dword [esp + 0x1444]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1440
ret