Function at 0x3737164b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x698
push ebx
xor ebx, ebx
cmp dword [0x3737ad10], ebx
mov byte [ebp - 0x98], bl
je 0x373717bb
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x3737184e
push esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ebx
push eax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x14], 0xff
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
call esi
test eax, eax
jne 0x373717ac
lea eax, [ebp - 0x198]
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x198]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 8]
push eax
push 0xf003f
lea eax, [ebp - 0x198]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3737174c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x400
push eax
lea eax, [ebp - 0x698]
push eax
push ebx
push ebx
push str.NameServer
push dword [ebp - 8]
mov byte [ebp - 0x698], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x698]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jne 0x37371770
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xc]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x298]
push eax
mov dword [ebp - 0x14], 0xff
push dword [ebp - 0xc]
push dword [ebp - 4]
jmp 0x373716b9
lea eax, [ebp - 0x698]
push 0x2c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x37371787
mov byte [eax], bl
lea eax, [ebp - 0x698]
push 0x80
push eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
jmp 0x3737184e
lea eax, [ebp - 4]
push eax
push 0xf003f
push ebx
push str.SystemCurrentControlSetServicesVxDMSTCP
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3737184e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x400
push eax
lea eax, [ebp - 0x698]
push eax
push ebx
push ebx
push str.NameServer
push dword [ebp - 4]
mov byte [ebp - 0x698], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x698]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x37371845
lea eax, [ebp - 0x698]
push 0x2c
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x37371829
mov byte [eax], bl
lea eax, [ebp - 0x698]
push 0x80
push eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x98], bl
pop ebx
je 0x37371869
lea eax, [ebp - 0x98]
push eax
call dword [0x3737ac88]
mov dword [0x3737a470], eax
push 1
pop eax
leave
ret