Function at 0x10084440
Capabilities:
Query or enumerate registry key
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x32c]
sub esp, 0x32c
push 0xfffffffffffffffe
push 0x1016dd90
push 0x10118480
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1017455c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x328], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov byte [ebp + 0x104], 0
push 0x103
push 0
lea eax, [ebp + 0x105]
push eax
call fcn.10116880
add esp, 0xc
call fcn.1006c2f0
mov edi, 1
test eax, eax
je 0x100844bc
mov dword [0x101951c8], edi
push 0x10195808
push 0x104
lea ecx, [ebp + 0x104]
push ecx
push 0x1013f817
push str.SecServer
push str.Config
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
mov al, byte [ebp + 0x104]
mov bl, 0x31
cmp al, bl
jne 0x100844f8
mov dword [0x10194cbc], edi
jmp 0x10084506
cmp al, 0x30
jne 0x10084506
mov dword [0x10194cbc], 0
push 0x10195808
push 0x104
lea edx, [ebp + 0x104]
push edx
push 0x1013f817
push str.DownloadFromAnotherServer
push str.Config
call esi
cmp byte [ebp + 0x104], bl
jne 0x10084536
mov dword [0x101951c4], edi
cmp dword [0x101951c8], 0
je 0x10084562
lea eax, [ebp + 0x104]
mov ecx, 0x1013f817
mov edx, str.server
call fcn.10043050
cmp byte [ebp + 0x104], bl
jne 0x10084562
mov dword [0x101951cc], edi
mov eax, 2
mov edi, str.FilterARPPacketsEx
mov ebx, 0x101482cc
call fcn.10031430
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp], bl
push 0x103
push ebx
lea eax, [ebp + 1]
push eax
call fcn.10116880
add esp, 0xc
mov ecx, 7
mov esi, str.SoftwareMicroWorldDevices
lea edi, [ebp + 0x30c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x20]
push ecx
push 8
push ebx
lea edx, [ebp + 0x30c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1008472f
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], 0x104
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1008470b
mov byte [ebp + 0x208], bl
push 0x103
push ebx
lea ecx, [ebp + 0x209]
push ecx
call fcn.10116880
add esp, 0xc
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp + 0x30c]
lea edx, [ebp + 0x208]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x10084620
lea ecx, [ebp + 0x208]
call fcn.10049c40
lea eax, [ebp]
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10084640
sub eax, edx
lea edi, [ebp + 0x208]
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x10084650
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10084670
sub eax, edx
cmp eax, 0x11
jne 0x100846ad
mov al, 0x2d
lea edx, [ebp]
call fcn.1005a900
cmp eax, 5
jne 0x100846ad
lea edi, [ebp + 0x208]
mov eax, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10048ba0
test eax, eax
je 0x100846ad
mov dword [ebp - 0x2c], 1
jmp 0x100845c9
cmp ebx, ebx
jne 0x100845c9
cmp dword [0x10194cbc], ebx
jne 0x100846fb
cmp dword [0x101951c4], ebx
jne 0x100846fb
mov dword [ebp - 0x28], ebx
lea edx, [ebp - 0x28]
push edx
push str.EventSent
lea ecx, [ebp + 0x208]
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10031670
cmp dword [ebp - 0x28], ebx
je 0x100846fb
mov esi, str.EventSent
lea ecx, [ebp + 0x208]
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10048b60
cmp ebx, ebx
jne 0x100845c9
inc dword [ebp - 0x1c]
jmp 0x100845c9
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1008472f
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x328]
xor ecx, ebp
call fcn.1010d699
add ebp, 0x32c
mov esp, ebp
pop ebp
ret