Function at 0x719c829d
Capabilities:
Get local ipv4 addresses
Query or enumerate registry key
Query or enumerate registry value
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3a0
mov eax, dword [0x719f7264]
push esi
push edi
push 0x719f7420
mov dword [ebp - 4], eax
xor esi, esi
mov byte [ebp - 0x381], 0
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
lea eax, [ebp - 0x394]
push eax
push esi
mov dword [ebp - 0x36c], esi
mov dword [ebp - 0x394], esi
mov dword [ebp - 0x368], esi
mov dword [ebp - 0x388], esi
mov dword [ebp - 0x390], esi
mov dword [ebp - 0x3a0], esi
mov dword [ebp - 0x378], esi
mov dword [ebp - 0x398], esi
mov dword [ebp - 0x38c], esi
call sub.iphlpapi.dll_GetAdaptersInfo
mov edi, dword [sym.imp._CKERNEL.DLL_HeapAlloc]
cmp eax, 0x6f
je 0x719c8a0a
cmp eax, esi
jne 0x719d4c4d
cmp dword [ebp - 0x36c], esi
mov dword [ebp - 0x368], esi
je 0x719c8340
mov eax, dword [ebp - 0x36c]
mov eax, dword [eax]
inc dword [ebp - 0x368]
cmp eax, esi
jne 0x719c8334
push ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x388]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [0x719f7468]
mov dword [ebp - 0x388], esi
call dword [sym.imp._CADVAPI.DLL_RegQueryInfoKeyA]
mov ecx, dword [ebp - 0x388]
cmp ecx, esi
ja 0x719d4c77
mov eax, dword [ebp - 0x368]
push 8
add ecx, eax
cmp eax, esi
pop edx
mov dword [ebp - 0x37c], ecx
mov dword [ebp - 0x364], edx
jbe 0x719c851c
imul eax, eax, 0x418
push eax
push edx
push dword [0x719f73f8]
mov dword [ebp - 0x380], esi
mov dword [ebp - 0x3a0], eax
call dword [sym.imp._CKERNEL.DLL_HeapAlloc]
cmp eax, esi
mov dword [ebp - 0x390], eax
je 0x719c87ed
lea eax, [ebp - 0x380]
push eax
push 0x20019
push esi
push 0x719c8904
push reloc.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_2
call dword [sym.imp._CADVAPI.DLL_RegOpenKeyExA]
cmp dword [ebp - 0x380], esi
je 0x719d4efa
mov eax, dword [ebp - 0x36c]
cmp eax, esi
mov dword [ebp - 0x378], eax
je 0x719c8508
mov ebx, dword [ebp - 0x390]
add ebx, 0x208
mov esi, dword [ebp - 0x378]
and dword [ebp - 0x370], 0
add esi, 0x1b0
push 8
mov edi, 0x719c88fc
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x719d4d58
lea eax, [ebp - 0x370]
push eax
mov eax, dword [ebp - 0x378]
push 0x20019
push 0
add eax, 8
push eax
push dword [ebp - 0x380]
call dword [sym.imp._CADVAPI.DLL_RegOpenKeyExA]
cmp dword [ebp - 0x370], 0
je 0x719d4de8
mov edi, dword [sym.imp._CADVAPI.DLL_RegQueryValueExW]
push ebx
lea esi, [ebx - 0x200]
push esi
push 0
push 0
push 0x719c88ec
push dword [ebp - 0x370]
mov dword [ebx - 0x208], 1
mov dword [ebx], 0x200
call edi
test eax, eax
jne 0x719c8496
cmp dword [ebx], 2
ja 0x719c84c0
push ebx
push esi
push 0
push 0
push 0x719c88d4
push dword [ebp - 0x370]
mov dword [ebx], 0x200
call edi
test eax, eax
jne 0x719d4d69
cmp dword [ebx], 2
jbe 0x719d4d69
push dword [ebp - 0x370]
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
xor edi, edi
cmp dword [ebx - 0x208], edi
je 0x719c84ec
mov eax, dword [ebx]
add dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x38c]
cmp eax, edi
jne 0x719d4e6d
mov eax, dword [ebp - 0x378]
mov eax, dword [eax]
add ebx, 0x418
test eax, eax
mov dword [ebp - 0x378], eax
jne 0x719c8408
push dword [ebp - 0x380]
call dword [sym.imp._CADVAPI.DLL_RegCloseKey]
mov ecx, dword [ebp - 0x37c]
xor esi, esi
mov edx, dword [ebp - 0x388]
cmp edx, esi
ja 0x719d4f11
cmp dword [ebp - 0x368], esi
lea eax, [ecx + ecx*8]
mov ecx, dword [ebp - 0x364]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x364], eax
jbe 0x719c85f4
mov ecx, dword [ebp - 0x36c]
cmp ecx, esi
je 0x719c8583
mov eax, dword [ebp - 0x390]
add eax, 0x208
cmp dword [eax - 0x208], esi
je 0x719c8578
mov edx, dword [eax + 0x204]
add edx, dword [eax]
neg edx
and edx, 3
add dword [ebp - 0x364], edx
mov ecx, dword [ecx]
add eax, 0x418
cmp ecx, esi
jne 0x719c855d
mov eax, dword [ebp - 0x368]
imul eax, eax, 0x118
add dword [ebp - 0x364], eax
push 0x719f7488
call dword [sym.imp._CKERNEL.DLL_EnterCriticalSection]
mov eax, dword [0x719f74b0]
mov ecx, 0x719f74b0
cmp eax, ecx
jne 0x719c8a4b
mov ebx, dword [ebp - 0x36c]
cmp ebx, esi
je 0x719c85f4
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
cmp dword [eax], esi
je 0x719c85e4
mov edi, dword [0x719f74b0]
cmp edi, 0x719f74b0
jne 0x719d4f50
mov ebx, dword [ebx]
add dword [ebp - 0x374], 0x418
cmp ebx, esi
jne 0x719c85c8
mov eax, dword [ebp - 0x38c]
cmp eax, esi
jne 0x719d4f91
push esi
push dword [ebp - 0x364]
push esi
push 0x8000004
push esi
push 0xffffffffffffffff
call dword [sym.imp._CKERNEL.DLL_CreateFileMappingA]
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x378], edi
je 0x719d4fd5
push dword [ebp - 0x364]
push esi
push esi
push 6
push edi
call dword [sym.imp._CKERNEL.DLL_MapViewOfFile]
mov edx, eax
cmp edx, esi
mov dword [ebp - 0x398], edx
je 0x719d4ff1
mov ecx, dword [ebp - 0x364]
mov ebx, ecx
shr ecx, 2
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x37c]
mov ecx, ebx
add ecx, 0xfffffff8
cmp eax, esi
mov dword [edx], eax
mov dword [edx + 4], ecx
jbe 0x719c87cb
mov ebx, dword [ebp - 0x398]
add ebx, 8
cmp dword [ebp - 0x368], 0
push 0x24
pop edi
jbe 0x719c87bd
mov eax, dword [ebp - 0x36c]
test eax, eax
mov dword [ebp - 0x374], eax
je 0x719c87b2
mov esi, dword [ebp - 0x390]
add esi, 0x40c
mov dword [ebp - 0x370], esi
cmp dword [esi - 0x40c], 0
je 0x719c8790
mov ecx, dword [esi]
mov eax, dword [esi - 0x204]
lea eax, [eax + ecx + 0x24]
mov ecx, eax
neg ecx
and ecx, 3
add ecx, eax
mov dword [ebx], ecx
mov dword [ebx + 4], edi
mov eax, dword [esi - 0x204]
mov dword [ebx + 8], eax
lea eax, [esi - 0x404]
push eax
lea eax, [ebx + 0x24]
push eax
call sub._Cmvrt.DLL_wcscpy
cmp dword [esi], 0
pop ecx
pop ecx
ja 0x719d5000
mov eax, dword [ebx]
mov dword [ebx + 0x14], eax
lea esi, [eax + ebx]
mov eax, 0x118
add dword [ebx], eax
mov dword [ebx + 0x18], eax
mov dword [esi], 1
mov eax, dword [ebx + 0x18]
mov dword [esi + 4], eax
xor eax, eax
mov ecx, 0xd7
lea edi, [ebp - 0x360]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x374]
mov eax, dword [edi + 0x19c]
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x360]
push eax
mov dword [ebp - 0x39c], esi
call sub.iphlpapi.dll_GetIfEntry
mov eax, dword [ebp - 0x15c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x154]
mov dword [esi + 0x10], eax
lea eax, [edi + 8]
lea edi, [esi + 0x14]
push 0x41
pop ecx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov esi, dword [0x719f74b0]
cmp esi, 0x719f74b0
jne 0x719d5026
add ebx, dword [ebx]
mov esi, dword [ebp - 0x370]
push 0x24
pop edi
mov eax, dword [ebp - 0x374]
mov eax, dword [eax]
add esi, 0x418
test eax, eax
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x370], esi
jne 0x719c86b8
push 0x719f7488
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
mov esi, dword [ebp - 0x38c]
test esi, esi
jne 0x719d508b
inc dword [0x719f7438]
je 0x719d5135
mov eax, dword [0x719f7470]
mov ecx, dword [0x719f7438]
mov dword [eax], ecx
mov byte [ebp - 0x381], 1
xor esi, esi
pop ebx
mov eax, dword [0x719f7474]
cmp eax, esi
mov edi, dword [sym.imp._CKERNEL.DLL_HeapFree]
je 0x719c880d
push eax
push esi
push dword [0x719f73f8]
call edi
mov dword [0x719f7474], esi
mov eax, dword [0x719f747c]
cmp eax, esi
je 0x719c8826
push eax
push esi
push dword [0x719f73f8]
call edi
mov dword [0x719f747c], esi
mov eax, dword [0x719f7440]
cmp eax, esi
je 0x719c884e
push eax
call dword [sym.imp._CKERNEL.DLL_UnmapViewOfFile]
push dword [0x719f743c]
mov dword [0x719f7440], esi
call dword [sym.imp._CKERNEL.DLL_CloseHandle]
mov dword [0x719f743c], esi
mov eax, dword [ebp - 0x378]
cmp eax, esi
je 0x719d5144
mov ecx, dword [ebp - 0x36c]
mov dword [0x719f7474], ecx
mov ecx, dword [ebp - 0x394]
mov dword [0x719f7478], ecx
mov ecx, dword [ebp - 0x390]
mov dword [0x719f747c], ecx
mov ecx, dword [ebp - 0x3a0]
mov dword [0x719f7480], ecx
mov ecx, dword [ebp - 0x368]
mov dword [0x719f743c], eax
mov eax, dword [ebp - 0x398]
mov dword [0x719f7484], ecx
mov dword [0x719f7440], eax
cmp dword [ebp - 0x38c], esi
jne 0x719d5195
push 0x719f7420
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x381]
pop edi
pop esi
call fcn.719c15f6
leave
ret
cmp dword [ebp - 0x36c], esi
jne 0x719d4c35
push dword [ebp - 0x394]
push 8
push dword [0x719f73f8]
call edi
cmp eax, esi
mov dword [ebp - 0x36c], eax
je 0x719c87ee
lea eax, [ebp - 0x394]
push eax
push dword [ebp - 0x36c]
call sub.iphlpapi.dll_GetAdaptersInfo
jmp 0x719c830f
mov dword [eax + 0x110c], esi
mov eax, dword [eax]
jmp 0x719c85aa
push dword [ebp - 0x36c]
push esi
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapFree]
jmp 0x719c8a16
cmp dword [ebp - 0x36c], esi
je 0x719c8320
push dword [ebp - 0x36c]
push esi
push dword [0x719f73f8]
call dword [sym.imp._CKERNEL.DLL_HeapFree]
mov dword [ebp - 0x36c], esi
jmp 0x719c8320
imul ecx, ecx, 0x418
push ecx
push 8
push dword [0x719f73f8]
call edi
cmp eax, esi
mov dword [ebp - 0x38c], eax
je 0x719c87ed
mov ecx, dword [ebp - 0x388]
cmp ecx, esi
mov dword [ebp - 0x370], esi
jbe 0x719c8372
mov edi, eax
add edi, 0x208
push esi
push esi
lea ecx, [ebp - 0x380]
push ecx
push esi
push edi
lea eax, [edi - 0x200]
push eax
push dword [ebp - 0x370]
mov dword [edi], 0xff
push dword [0x719f7468]
mov dword [ebp - 0x380], esi
call dword [sym.imp._CADVAPI.DLL_RegEnumValueW]
test eax, eax
jne 0x719d4d35
cmp dword [ebp - 0x380], 1
jne 0x719d4d35
mov eax, dword [edi]
lea eax, [eax + eax + 2]
mov dword [edi], eax
lea ebx, [edi + 0x204]
push ebx
lea eax, [edi + 4]
push eax
push esi
push esi
lea eax, [edi - 0x200]
push eax
mov dword [edi - 0x208], 1
mov dword [ebx], 0x200
push dword [0x719f7468]
call dword [sym.imp._CADVAPI.DLL_RegQueryValueExW]
test eax, eax
je 0x719d4d35
mov word [edi + 4], si
mov dword [ebx], 1
mov ecx, dword [ebp - 0x388]
inc dword [ebp - 0x370]
add edi, 0x418
cmp dword [ebp - 0x370], ecx
jae 0x719c8372
jmp 0x719d4cb2
dec dword [ebp - 0x37c]
dec dword [ebp - 0x368]
jmp 0x719c84ec
mov eax, dword [ebp - 0x378]
and dword [ebx], 0
add eax, 0x1c0
push eax
call dword [sym.imp.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_11]
mov edi, eax
mov eax, dword [ebp - 0x378]
add eax, 0x1b0
push eax
call dword [sym.imp.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_11]
push 0x100
push esi
and edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_12]
push eax
push 0
push 0
call dword [sym.imp._CKERNEL.DLL_MultiByteToWideChar]
push esi
call sub._Cmvrt.DLL_wcslen
lea eax, [eax + eax + 2]
mov dword [esp], 0x719d51ac
push esi
mov dword [ebx], eax
call sub._Cmvrt.DLL_wcscmp
test eax, eax
pop ecx
pop ecx
jne 0x719c84c0
and dword [ebx - 0x208], eax
dec dword [ebp - 0x37c]
dec dword [ebp - 0x368]
jmp 0x719c84c0
mov eax, dword [ebp - 0x378]
mov esi, dword [sym.imp.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_11]
add eax, 0x1c0
push eax
call esi
mov edi, eax
mov eax, dword [ebp - 0x378]
add eax, 0x1b0
push eax
call esi
push 0x100
lea esi, [ebx - 0x200]
push esi
and edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.WS2__32_Coverage_C_WINDOWS_system32.DLL_Ordinal_12]
push eax
push 0
push 0
call dword [sym.imp._CKERNEL.DLL_MultiByteToWideChar]
push esi
call sub._Cmvrt.DLL_wcslen
lea eax, [eax + eax + 2]
mov dword [esp], 0x719d51ac
push esi
mov dword [ebx], eax
call sub._Cmvrt.DLL_wcscmp
test eax, eax
pop ecx
pop ecx
jne 0x719d4e5e
dec dword [ebp - 0x37c]
dec dword [ebp - 0x368]
jmp 0x719c84cc
mov dword [ebx - 0x208], 1
jmp 0x719c84cc
mov ecx, dword [ebp - 0x388]
cmp ecx, edi
mov dword [ebp - 0x39c], ecx
jbe 0x719c84ec
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
cmp dword [eax], 0
je 0x719d4ea2
add eax, 8
push esi
push eax
call sub._Cmvrt.DLL_wcscmp
test eax, eax
pop ecx
pop ecx
je 0x719d4ebb
add dword [ebp - 0x374], 0x418
inc edi
cmp edi, dword [ebp - 0x39c]
jae 0x719c84ec
jmp 0x719d4e87
mov eax, dword [ebp - 0x38c]
imul edi, edi, 0x418
lea esi, [edi + eax]
lea eax, [esi + 0x20c]
push eax
lea eax, [ebx + 4]
push eax
mov dword [esi + 4], 1
call sub._Cmvrt.DLL_wcscpy
mov esi, dword [esi + 0x40c]
add dword [ebp - 0x364], esi
pop ecx
pop ecx
mov dword [ebx + 0x204], esi
jmp 0x719c84ec
mov eax, dword [ebp - 0x368]
sub dword [ebp - 0x37c], eax
mov dword [ebp - 0x368], esi
jmp 0x719c8508
mov eax, dword [ebp - 0x38c]
add eax, 0x40c
cmp dword [eax - 0x40c], esi
je 0x719d4f3d
cmp dword [eax - 0x408], esi
jne 0x719d4f3c
mov edi, dword [eax - 0x204]
add edi, dword [eax]
add dword [ebp - 0x364], edi
jmp 0x719d4f3d
dec ecx
add eax, 0x418
dec edx
jne 0x719d4f1c
mov dword [ebp - 0x37c], ecx
jmp 0x719c852a
cmp dword [edi + 0x110c], esi
jne 0x719d4f71
push 0x104
lea eax, [ebx + 8]
push eax
lea eax, [edi + 8]
push eax
call sub._Cmvrt.DLL_strncmp
add esp, 0xc
test eax, eax
je 0x719d4f78
mov edi, dword [edi]
jmp 0x719c85d8
add dword [ebp - 0x364], 0x100c
mov dword [edi + 0x110c], 1
jmp 0x719c85e4
mov ecx, dword [ebp - 0x388]
cmp ecx, esi
jbe 0x719c8602
add eax, 0x40c
cmp dword [eax - 0x40c], esi
je 0x719d4fc7
cmp dword [eax - 0x408], esi
jne 0x719d4fc7
mov edx, dword [eax - 0x204]
add edx, dword [eax]
neg edx
and edx, 3
add dword [ebp - 0x364], edx
add eax, 0x418
dec ecx
je 0x719c8602
jmp 0x719d4fa4
cmp dword [ebp - 0x368], esi
jbe 0x719c87ed
push 0x719f7488
call dword [sym.imp._CKERNEL.DLL_LeaveCriticalSection]
jmp 0x719c87ed
push edi
call dword [sym.imp._CKERNEL.DLL_CloseHandle]
mov dword [ebp - 0x378], esi
jmp 0x719d4fd5
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 4]
add eax, ecx
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
add esi, 0xfffffe00
add eax, ebx
push esi
push eax
mov dword [ebx + 0x10], ecx
call sub._Cmvrt.DLL_wcscpy
pop ecx
pop ecx
jmp 0x719c8703
cmp dword [esi + 0x110c], 0
je 0x719d504e
mov eax, dword [ebp - 0x374]
add eax, 8
push 0x104
push eax
lea eax, [esi + 8]
push eax
call sub._Cmvrt.DLL_strncmp
add esp, 0xc
test eax, eax
je 0x719d5055
mov esi, dword [esi]
jmp 0x719c8779
mov eax, dword [ebp - 0x39c]
mov ecx, dword [eax + 4]
mov dword [eax + 8], ecx
add eax, ecx
mov ecx, 0x100c
add dword [ebx + 0x18], ecx
add dword [ebx], ecx
mov dword [eax + 4], ecx
mov ecx, 0x400
add esi, 0x10c
lea edi, [eax + 0xc]
mov dword [eax], 2
rep movsd dword es:[edi], dword [esi]
jmp 0x719c8785
and dword [ebp - 0x380], 0
cmp dword [ebp - 0x388], 0
jbe 0x719c87cb
add esi, 0x208
cmp dword [esi - 0x208], 0
je 0x719d5112
cmp dword [esi - 0x204], 0
jne 0x719d5112
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov eax, dword [esi]
mov dword [ebx + 8], eax
add eax, 0x24
mov dword [ebx], eax
lea eax, [esi - 0x200]
push eax
lea eax, [ebx + 0x24]
push eax
call sub._Cmvrt.DLL_wcscpy
lea eax, [esi + 0x204]
cmp dword [eax], 0
pop ecx
pop ecx
jbe 0x719d5103
mov ecx, dword [ebx + 4]
add ecx, dword [ebx + 8]
mov dword [ebx + 0xc], ecx
mov eax, dword [eax]
add dword [ebx], eax
mov dword [ebx + 0x10], eax
lea eax, [esi + 4]
push eax
mov eax, ecx
add eax, ebx
push eax
call sub._Cmvrt.DLL_wcscpy
pop ecx
pop ecx
mov eax, dword [ebx]
mov ecx, eax
neg ecx
and ecx, 3
add eax, ecx
mov dword [ebx], eax
add ebx, eax
inc dword [ebp - 0x380]
mov eax, dword [ebp - 0x380]
add esi, 0x418
cmp eax, dword [ebp - 0x388]
jae 0x719c87cb
jmp 0x719d50a5
mov dword [0x719f7438], 1
jmp 0x719c87d7
cmp dword [ebp - 0x36c], esi
je 0x719d515b
push dword [ebp - 0x36c]
push esi
push dword [0x719f73f8]
call edi
cmp dword [ebp - 0x390], esi
mov dword [0x719f7474], esi
mov dword [0x719f7478], esi
je 0x719d517e
push dword [ebp - 0x390]
push esi
push dword [0x719f73f8]
call edi
mov dword [0x719f747c], esi
mov dword [0x719f7480], esi
mov dword [0x719f7484], esi
jmp 0x719c88a8
push dword [ebp - 0x38c]
push esi
push dword [0x719f73f8]
call edi
jmp 0x719c88b4