Function at 0x402960
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x338
mov eax, dword [0x441778]
push ebx
push ebp
push esi
lea eax, [eax + eax*4]
push edi
lea ecx, [eax*4 + 0xa]
push ecx
call sub.MFC42.DLL_operatornew
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
mov dword [esp + 0x18], eax
mov byte [eax], 0
mov eax, dword [0x441778]
add esp, 4
xor ebx, ebx
test eax, eax
jle 0x402a07
test ebx, ebx
mov esi, str.__d._d._d._d
jg 0x4029a8
mov esi, 0x4365b4
mov eax, dword [0x44177c]
xor edx, edx
xor ecx, ecx
mov dl, byte [eax + ebx*4 + 3]
mov cl, byte [eax + ebx*4 + 2]
push edx
push ecx
xor edx, edx
xor ecx, ecx
mov dl, byte [eax + ebx*4 + 1]
mov cl, byte [eax + ebx*4]
push edx
push ecx
lea edx, [esp + 0x2c]
push esi
push edx
call ebp
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp ebx, dword [0x441778]
jl 0x40299a
mov eax, dword [0x441ff4]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x402a9c
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 3
je 0x402a36
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x402a9c
cmp eax, 3
jle 0x402a9c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x402a57
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x402a8e
mov eax, dword [0x436030]
push 3
push eax
push 0x310
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
mov ecx, dword [esp + 0x24]
push ecx
push str.DNS__s_n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40315f
push str.SystemCurrentControlSetServicesVxDMSTCP
lea edx, [esp + 0x13c]
push 0x43657c
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x138]
push eax
push 0x20006
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402ba5
push 0x27
mov ecx, 0x442408
call fcn.0042053a
push 0
push 0
push 0
push 0
push 2
push 0x11
call fcn.0041e7ec
mov eax, dword [0x441ff4]
add esp, 0x18
test eax, eax
je 0x4030b3
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 1
je 0x402b40
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x4030b3
cmp eax, 1
jle 0x4030b3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x402b61
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x4030a5
mov eax, dword [0x436030]
push 1
push eax
push 0x318
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call ebx
lea ecx, [esp + 0x138]
push eax
push ecx
push str.Failed_to_open_reg:_s__error_d_n
call fcn.0041c506
add esp, 0xc
jmp 0x4030a0
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x240]
push edx
push eax
push 0
push 0
mov ebx, 0x104
push str.EnableDNS
push ecx
mov dword [esp + 0x30], ebx
call ebp
test eax, eax
je 0x402caf
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x27
mov ecx, 0x442408
call fcn.0042053a
push 0
push 0
push 0
push 0
push 2
push 0x11
call fcn.0041e7ec
mov eax, dword [0x441ff4]
add esp, 0x18
test eax, eax
je 0x4030b3
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 1
je 0x402c35
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x4030b3
cmp eax, 1
jle 0x4030b3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x402c5c
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x402c94
mov eax, dword [0x436030]
push 1
push eax
push 0x321
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call ebx
push eax
push str.Failed_to_get_reg_EnableDNS__error_d_n
call fcn.0041c506
add esp, 8
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x338
ret
mov eax, dword [0x441ff4]
test eax, eax
je 0x402d45
mov ecx, dword [0x441fd4]
mov eax, dword [ecx]
cmp eax, 3
je 0x402cd9
mov edx, dword [0x441fdc]
cmp dword [edx], 0
jne 0x402d45
cmp eax, 3
jle 0x402d45
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x402cfc
mov eax, dword [0x441fa0]
mov dword [0x436030], eax
call fcn.0041c4b1
test eax, eax
je 0x402d37
mov ecx, dword [0x436030]
push 3
push ecx
push 0x324
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
lea edx, [esp + 0x250]
push edx
push str.dwEnableDNS_s_n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 0x436510
lea eax, [esp + 0x240]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402d75
test cl, cl
je 0x402d71
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402d75
add eax, 2
add esi, 2
test cl, cl
jne 0x402d51
xor eax, eax
jmp 0x402d7a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40315f
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x30]
push eax
push ecx
push 0
push 0
push str.NameServer
push edx
mov dword [esp + 0x30], ebx
call ebp
test eax, eax
je 0x402e7e
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x26
mov ecx, 0x442408
call fcn.0042053a
push 0
push 0
push 0
push 0
push 2
push 0x11
call fcn.0041e7ec
mov eax, dword [0x441ff4]
add esp, 0x18
test eax, eax
je 0x4030b3
mov ecx, dword [0x441fd4]
mov eax, dword [ecx]
cmp eax, 1
je 0x402e05
mov edx, dword [0x441fdc]
cmp dword [edx], 0
jne 0x4030b3
cmp eax, 1
jle 0x4030b3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x402e2a
mov eax, dword [0x441fa0]
mov dword [0x436030], eax
call fcn.0041c4b1
test eax, eax
je 0x402e63
mov ecx, dword [0x436030]
push 1
push ecx
push 0x32c
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call ebx
push eax
push str.Failed_to_set_DNS__error_d_n
call fcn.0041c506
add esp, 8
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x338
ret
mov eax, dword [0x441ff4]
test eax, eax
je 0x402f12
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 3
je 0x402ea8
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x402f12
cmp eax, 3
jle 0x402f12
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x402ecd
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x402f04
mov eax, dword [0x436030]
push 3
push eax
push 0x330
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
lea ecx, [esp + 0x40]
push ecx
push str.OLD_Name_Servers:__s_n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x30]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x402fc2
mov esi, 0x441e2c
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x402f5e
test cl, cl
je 0x402f5a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x402f5e
add eax, 2
add esi, 2
test cl, cl
jne 0x402f36
xor eax, eax
jmp 0x402f63
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402f95
mov edi, 0x4364c8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push 1
push 0
push str.NameServer
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4030c0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x26
mov ecx, 0x442408
call fcn.0042053a
push 0
push 0
push 0
push 0
push 2
push 0x11
call fcn.0041e7ec
mov eax, dword [0x441ff4]
add esp, 0x18
test eax, eax
je 0x4030b3
mov eax, dword [0x441fd4]
mov eax, dword [eax]
cmp eax, 1
je 0x403046
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x4030b3
cmp eax, 1
jle 0x4030b3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40306d
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x4030a5
mov eax, dword [0x436030]
push 1
push eax
push 0x33c
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
add esp, 0x10
call ebx
push eax
push str.Failed_to_set_DNS_NameServer__error_d_n
call fcn.0041c506
add esp, 8
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x338
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x441ff4]
test eax, eax
je 0x40315f
mov edx, dword [0x441fd4]
mov eax, dword [edx]
cmp eax, 3
je 0x4030f5
mov ecx, dword [0x441fdc]
cmp dword [ecx], 0
jne 0x40315f
cmp eax, 3
jle 0x40315f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x436030]
test eax, eax
jge 0x40311a
mov edx, dword [0x441fa0]
mov dword [0x436030], edx
call fcn.0041c4b1
test eax, eax
je 0x403151
mov eax, dword [0x436030]
push 3
push eax
push 0x340
push str.C:_build_rel_sp_8_4_6_2_srcwindows_atpclient_arr_srvsAdaptCof.cpp
call fcn.0041c4e1
lea ecx, [esp + 0x40]
push ecx
push str.Name_Servers:__s_n
call fcn.0041c506
add esp, 0x18
call fcn.0041c4cc
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x338
ret