Function at 0x1005b040
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x48], 0
push 0x31
push 0
lea eax, [ebp - 0x47]
push eax
call fcn.100139b0
add esp, 0xc
mov byte [ebp - 0xf0], 0
push 0x63
push 0
lea ecx, [ebp - 0xef]
push ecx
call fcn.100139b0
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.10001af0
mov byte [ebp - 0x214], 0
xor edx, edx
mov dword [ebp - 0x213], edx
mov dword [ebp - 0x20f], edx
mov dword [ebp - 0x20b], edx
mov word [ebp - 0x207], dx
mov byte [ebp - 0x205], dl
lea eax, [ebp - 0x80]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 4], 0x10079278
mov dword [ebp - 0x1f4], 2
cmp dword [ebp + 8], 0
jne 0x1005b5a0
lea ecx, [ebp - 0x10]
push ecx
push 0x10079280
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp + 0xc], 0
jne 0x1005b133
cmp dword [ebp - 0x10], 0xffffffff
je 0x1005b12e
lea edx, [ebp - 0x214]
push edx
call fcn.10013a30
add esp, 4
push eax
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x100792bc
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x100792d4
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1005b1be
cmp dword [ebp - 0x10], 0xffffffff
je 0x1005b1be
mov eax, dword [ebp + 0x10]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
push 0x100792e8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 0x10]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
push 0x100792f8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x214]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x214]
push ecx
push 1
push 0
push 0x1007930c
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x10079324
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x10]
push edx
push 0x10079338
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp + 0xc], 0
jne 0x1005b217
cmp dword [ebp - 0x10], 0xffffffff
je 0x1005b212
lea eax, [ebp - 0x214]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x214]
push ecx
push 1
push 0
push 0x10079370
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1005b2a2
cmp dword [ebp - 0x10], 0xffffffff
je 0x1005b2a2
mov eax, dword [ebp + 0x10]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
push 0x10079388
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 0x10]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
push 0x10079398
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x214]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x214]
push ecx
push 1
push 0
push 0x100793ac
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x100793c4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x10]
push edx
push 0x100793d8
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp + 0xc], 0
jne 0x1005b2fb
cmp dword [ebp - 0x10], 0xffffffff
je 0x1005b2f6
lea eax, [ebp - 0x214]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x214]
push ecx
push 1
push 0
push 0x10079410
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1005b386
cmp dword [ebp - 0x10], 0xffffffff
je 0x1005b386
mov eax, dword [ebp + 0x10]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
push 0x10079428
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp + 0x10]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0
push 0x10079438
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x214]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x214]
push ecx
push 1
push 0
push 0x1007944c
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push str.StandaloneDhcpGuid
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call sym.RtlLib.dll_RT_ACM_SoftAP_GetGUID
mov dword [ebp - 0x22c], eax
mov edx, dword [ebp - 0x22c]
push edx
call fcn.10013a30
add esp, 4
test eax, eax
je 0x1005b3d5
mov eax, dword [ebp - 0x22c]
push eax
call fcn.1002b12f
add esp, 4
mov ecx, dword [ebp - 0x22c]
push ecx
push 0x10079478
lea edx, [ebp - 0x48]
push edx
call fcn.10016875
add esp, 0xc
push 0x10
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.100139b0
add esp, 0xc
push 0x10079480
lea ecx, [ebp - 0x1f0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x4c]
push ecx
push 0x20006
push 0
lea edx, [ebp - 0x1f0]
push edx
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1005b446
mov byte [ebp - 0x22d], 0
lea ecx, [ebp - 8]
call fcn.10001850
mov al, byte [ebp - 0x22d]
jmp 0x1005b9fa
mov dword [ebp - 0xc], 0
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x100794c0
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push 0
push 0x100794d4
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10013a30
add esp, 4
add eax, 2
mov dword [ebp - 0x84], eax
mov edx, dword [ebp + 0x14]
push edx
call fcn.10013a30
add esp, 4
add eax, 2
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 7
push 0
push 0x100794e0
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 7
push 0
push 0x100794ec
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, byte [ebp + 0x18]
test ecx, ecx
je 0x1005b4fc
call sym.RtlLib.dll_RT_ACM_SoftAP_Start
lea edx, [ebp - 0x250]
push edx
call sub.RtlIhvOid.dll_Ordinal_28
add esp, 4
mov ecx, dword [eax]
mov dword [ebp - 0x240], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x23c], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x238], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x234], edx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x200], ecx
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x1fc], edx
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x1f8], eax
push 0x1006fa99
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x204]
mov dword [eax], ecx
mov edx, dword [ebp - 0x200]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1fc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x1f8]
mov dword [eax + 0xc], edx
call fcn.10040410
add esp, 0x1c
jmp 0x1005b9e5
lea eax, [ebp - 0x10]
push eax
push 0x100794f8
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x10], 0xffffffff
je 0x1005b664
push 0x10079534
lea ecx, [ebp - 0x214]
push ecx
call fcn.10016875
add esp, 8
lea edx, [ebp - 0x214]
push edx
call fcn.10013a30
add esp, 4
push eax
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x10079544
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp - 0x214]
push edx
call fcn.10013a30
add esp, 4
push eax
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x10079554
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x10079568
lea edx, [ebp - 0x214]
push edx
call fcn.10016875
add esp, 8
lea eax, [ebp - 0x214]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x214]
push ecx
push 1
push 0
push 0x10079578
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
push ecx
push 0x10079590
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x10], 0xffffffff
je 0x1005b732
push 0x100795c8
lea edx, [ebp - 0x214]
push edx
call fcn.10016875
add esp, 8
lea eax, [ebp - 0x214]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x214]
push ecx
push 1
push 0
push 0x100795d8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x214]
push eax
call fcn.10013a30
add esp, 4
push eax
lea ecx, [ebp - 0x214]
push ecx
push 1
push 0
push 0x100795e8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x100795fc
lea eax, [ebp - 0x214]
push eax
call fcn.10016875
add esp, 8
lea ecx, [ebp - 0x214]
push ecx
call fcn.10013a30
add esp, 4
push eax
lea edx, [ebp - 0x214]
push edx
push 1
push 0
push 0x1007960c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x10]
push edx
push 0x10079624
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x10], 0xffffffff
je 0x1005b800
push 0x1007965c
lea eax, [ebp - 0x214]
push eax
call fcn.10016875
add esp, 8
lea ecx, [ebp - 0x214]
push ecx
call fcn.10013a30
add esp, 4
push eax
lea edx, [ebp - 0x214]
push edx
push 1
push 0
push 0x1007966c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x214]
push ecx
call fcn.10013a30
add esp, 4
push eax
lea edx, [ebp - 0x214]
push edx
push 1
push 0
push 0x1007967c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x10079690
lea ecx, [ebp - 0x214]
push ecx
call fcn.10016875
add esp, 8
lea edx, [ebp - 0x214]
push edx
call fcn.10013a30
add esp, 4
push eax
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x100796a0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.100139b0
add esp, 0xc
push 0x100796b8
lea ecx, [ebp - 0x1f0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x1f0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x4c]
push ecx
push 0x20006
push 0
lea edx, [ebp - 0x1f0]
push edx
push reloc.RtlIhvOid.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1005b87b
mov byte [ebp - 0x251], 0
lea ecx, [ebp - 8]
call fcn.10001850
mov al, byte [ebp - 0x251]
jmp 0x1005b9fa
mov dword [ebp - 0xc], 1
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
push 0x100796f8
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push 0
push 0x1007970c
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x10079718
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x10079724
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1005b8df
call sym.RtlLib.dll_RT_ACM_SoftAP_Start
call sym.RtlLib.dll_RT_ACM_SoftAP_GetGUID
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.10013a30
add esp, 4
test eax, eax
je 0x1005b924
mov edx, dword [ebp - 0x22c]
push edx
call fcn.1002b12f
add esp, 4
mov eax, dword [ebp - 0x22c]
push eax
push 0x10079730
lea ecx, [ebp - 0x48]
push ecx
call fcn.10016875
add esp, 0xc
lea edx, [ebp - 0x278]
push edx
call sub.RtlIhvOid.dll_Ordinal_28
add esp, 4
mov ecx, dword [eax]
mov dword [ebp - 0x264], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x260], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x25c], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x258], edx
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x200], ecx
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0x1fc], edx
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x1f8], eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x204]
mov dword [ecx], edx
mov eax, dword [ebp - 0x200]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1fc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x1f8]
mov dword [ecx + 0xc], eax
call fcn.10040360
add esp, 0x10
push 0x1006fa9a
push 0x1006fa9b
push 0x1006fabf
push 0x1006faca
push 1
lea ecx, [ebp - 0x48]
push ecx
call sym.RtlLib.dll_RT_SetNicTcpipAddr
add esp, 0x18
movzx edx, byte [ebp + 0x18]
test edx, edx
je 0x1005b9e5
call sym.RtlLib.dll_RT_ACM_SoftAP_Stop
mov byte [ebp - 0x279], 1
lea ecx, [ebp - 8]
call fcn.10001850
mov al, byte [ebp - 0x279]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret