Function at 0x96b690
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x240
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x23c], eax
mov eax, dword [esp + 0x244]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], edi
xor esi, esi
mov dword [esp + 0x20], ebx
call fcn.00965e80
add esp, 8
test eax, eax
jne 0x96b6d7
or eax, 0xffffffff
jmp 0x96bb09
cmp dword [edi], ebx
jne 0x96baf6
lea eax, [esp + 0x14]
push eax
push 0xf003f
push ebx
push str.SOFTWAREMicroWorldMailScan_for_SMTPSmtpServer1
push 0x80000002
mov dword [esp + 0x40], 5
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp edi, ebx
jne 0x96b793
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push ebx
push str.LocalIPList
push edx
mov dword [esp + 0x30], ebx
call ebp
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x96b788
add eax, 0x114
push 1
push eax
call fcn.00a7b9f8
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x96b752
mov eax, dword [esp + 0x14]
push eax
jmp 0x96b78d
lea ecx, [esp + 0x18]
push ecx
push esi
push ebx
push ebx
mov byte [esi], bl
mov edx, dword [esp + 0x24]
push str.LocalIPList
push edx
call ebp
cmp byte [esi], bl
jne 0x96b8c9
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00a78fec
add esp, 4
xor esi, esi
jmp 0x96b793
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x14]
push edx
push 0xf003f
push ebx
push str.SOFTWAREMicroWorld
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x96bab1
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push ebx
push str.LocalIPList
push ecx
mov dword [esp + 0x30], ebx
call ebp
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x96b812
add eax, 0x114
push 1
push eax
call fcn.00a7b9f8
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x96ba9a
lea eax, [esp + 0x18]
push eax
push esi
push ebx
push ebx
mov byte [esi], bl
mov ecx, dword [esp + 0x24]
push str.LocalIPList
push ecx
jmp 0x96b8c7
mov eax, str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
cmp byte [str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...], bl
je 0x96b825
nop
inc eax
cmp byte [eax], bl
jne 0x96b820
mov edx, dword [esp + 0x14]
sub eax, str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
inc eax
mov edi, eax
push edi
push str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
push 1
push ebx
push str.LocalIPListX
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x14]
push edi
push str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
push 1
push ebx
push str.LocalIPList
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
push str.ZSetup
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push ebx
push str.LocalIPList
push eax
mov dword [esp + 0x30], ebx
call ebp
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x96ba9a
add eax, 0x114
push 1
push eax
call fcn.00a7b9f8
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x96b8b3
mov ecx, dword [esp + 0x14]
push ecx
jmp 0x96ba9f
lea edx, [esp + 0x18]
push edx
push esi
push ebx
push ebx
mov byte [esi], bl
mov eax, dword [esp + 0x24]
push str.LocalIPList
push eax
call ebp
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push eax
push ebx
push str.ZSetup
push ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 4
call ebp
cmp dword [esp + 0x24], 5
je 0x96ba9a
push 0x103
lea edx, [esp + 0x3d]
push ebx
push edx
xor ebp, ebp
mov byte [esp + 0x44], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [esp + 0x145]
push ebx
push eax
mov byte [esp + 0x14c], bl
call fcn.00a7ffb0
mov edx, dword [esp + 0x20]
add esp, 0xc
push 4
lea ecx, [esp + 0x30]
push ecx
push 4
push ebx
push str.ZSetup
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0x3c], bl
push str.1..._2..._5..._7..._23..._27..._31..._36..._37..._39..._41..._42..._58..._59..._70..._71..._72..._73..._74..._75..._76..._77..._78..._79..._83..._84..._85..._86..._87..._88..._89..._90..._91..._92..._93..._94..._95..._96..._97..._98..._99..._100..._101..._102..._103..._104..._105..._106..._107..._108..._109..._110..._111..._112..._113..._114..._115..._116..._117..._118..._119..._120..._121..._122..._123..._124..._125..._126..._169.254.._173..._174..._175..._176..._178..._179..._180..._181..._182..._183..._185..._186..._187..._189..._190..._197..._223..._224..._225..._226..._227..._228..._229..._230..._231..._232..._233..._234..._235..._236..._237..._238..._239..._240..._241..._242..._243..._244..._245..._246..._247..._248..._249..._250..._251..._252..._253..._254...
mov bl, 0x2c
lea edi, [esp + 0x40]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x1c], 0xffffffff
je 0x96b9bd
cmp byte [esp + 0x38], 0
je 0x96b999
lea ecx, [esp + 0x38]
push ecx
call fcn.0098d400
test eax, eax
je 0x96b999
push 0x2c
push esi
lea ecx, [esp + 0x40]
mov ebp, 1
call fcn.0098d4d0
lea edx, [esp + 0x1c]
push edx
push str.1..._2..._5..._7..._23..._27..._31..._36..._37..._39..._41..._42..._58..._59..._70..._71..._72..._73..._74..._75..._76..._77..._78..._79..._83..._84..._85..._86..._87..._88..._89..._90..._91..._92..._93..._94..._95..._96..._97..._98..._99..._100..._101..._102..._103..._104..._105..._106..._107..._108..._109..._110..._111..._112..._113..._114..._115..._116..._117..._118..._119..._120..._121..._122..._123..._124..._125..._126..._169.254.._173..._174..._175..._176..._178..._179..._180..._181..._182..._183..._185..._186..._187..._189..._190..._197..._223..._224..._225..._226..._227..._228..._229..._230..._231..._232..._233..._234..._235..._236..._237..._238..._239..._240..._241..._242..._243..._244..._245..._246..._247..._248..._249..._250..._251..._252..._253..._254...
mov bl, 0x2c
lea edi, [esp + 0x40]
mov byte [esp + 0x40], 0
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x1c], 0xffffffff
jne 0x96b973
xor eax, eax
cmp byte [esi], al
je 0x96ba51
mov dword [esp + 0x1c], eax
mov byte [esp + 0x140], al
lea eax, [esp + 0x1c]
push eax
push str.0..._192.2.._
mov bl, 0x2c
lea edi, [esp + 0x148]
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x1c], 0xffffffff
je 0x96ba51
cmp byte [esp + 0x140], 0
je 0x96ba27
lea ecx, [esp + 0x140]
push ecx
call fcn.0098d400
cmp eax, 1
je 0x96ba27
push 0
push 0x2c
lea edx, [esp + 0x148]
mov ecx, esi
mov ebp, 1
call fcn.009694d0
lea edx, [esp + 0x1c]
push edx
push str.0..._192.2.._
mov bl, 0x2c
lea edi, [esp + 0x148]
mov byte [esp + 0x148], 0
call fcn.0095ae80
add esp, 8
cmp dword [esp + 0x1c], 0xffffffff
jne 0x96b9f4
test ebp, ebp
je 0x96ba98
mov ecx, esi
call fcn.00954f10
cmp byte [esi], 0
mov eax, esi
je 0x96ba69
inc eax
cmp byte [eax], 0
jne 0x96ba63
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, esi
inc eax
mov edi, eax
mov eax, dword [esp + 0x14]
push edi
push esi
push 1
push 0
push str.LocalIPListX
push eax
call ebx
mov ecx, dword [esp + 0x14]
push edi
push esi
push 1
push 0
push str.LocalIPList
push ecx
call ebx
xor ebx, ebx
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x96bab1
mov eax, dword [esp + 0x20]
mov dword [eax], esi
jmp 0x96baf6
mov eax, str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
cmp byte [str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...], bl
je 0x96bac5
mov edi, edi
inc eax
cmp byte [eax], bl
jne 0x96bac0
sub eax, str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
add eax, 0x11
push 1
push eax
call fcn.00a7b9f8
mov ecx, dword [esp + 0x28]
add esp, 8
mov dword [ecx], eax
cmp eax, ebx
je 0x96b6cf
mov byte [eax], bl
mov ecx, dword [ecx]
push str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
mov ecx, dword [esp + 0x30]
push eax
call fcn.0096bb30
add esp, 4
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x240
ret