Function at 0x45b620
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x133c
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x207
lea eax, [ebp - 0x20b]
push ebx
push eax
mov dword [ebp - 0x133c], esi
mov dword [ebp - 0x1338], edi
mov dword [ebp - 0x1314], ebx
mov byte [ebp - 0x20c], bl
call fcn.005dfd60
push 0x3ff
lea ecx, [ebp - 0x130f]
push ebx
push ecx
mov byte [ebp - 0x1310], bl
call fcn.005dfd60
push 0x3ff
lea edx, [ebp - 0xf0f]
push ebx
push edx
mov byte [ebp - 0xf10], bl
call fcn.005dfd60
add esp, 0x24
cmp esi, ebx
je 0x45bcb7
cmp edi, ebx
je 0x45bcb7
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSetServicesWinSock2
mov byte [esi], bl
push eax
mov dword [edi], 1
call fcn.005dfb23
lea ecx, [ebp - 0x1314]
push ecx
push 9
push ebx
lea edx, [ebp - 0x20c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x1c
cmp eax, ebx
je 0x45b705
xor ecx, ecx
cmp eax, 2
setne cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x1314]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSetServicesWinSock2Parameters
push eax
call fcn.005dfb23
lea ecx, [ebp - 0x1314]
push ecx
push 9
push ebx
lea edx, [ebp - 0x20c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x1c
cmp eax, ebx
jne 0x45b6ea
mov ecx, dword [ebp - 0x1314]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x1328]
push edx
lea eax, [ebp - 0x1310]
push eax
push ebx
push ebx
push str.Current_NameSpace_Catalog
push ecx
mov byte [ebp - 0x1310], bl
mov dword [ebp - 0x1328], 0x400
call esi
mov edx, dword [ebp - 0x1314]
mov dword [ebp - 0x131c], eax
cmp eax, ebx
je 0x45b7ab
push edx
call edi
xor eax, eax
cmp dword [ebp - 0x131c], 2
pop edi
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1328]
push eax
lea ecx, [ebp - 0xf10]
push ecx
push ebx
push ebx
push str.Current_Protocol_Catalog
push edx
mov byte [ebp - 0xf10], bl
mov dword [ebp - 0x1328], 0x400
call esi
mov dword [ebp - 0x131c], eax
mov eax, dword [ebp - 0x1314]
push eax
call edi
mov eax, dword [ebp - 0x131c]
cmp eax, ebx
jne 0x45b6ea
lea edx, [ebp - 0x1310]
push edx
lea eax, [ebp - 0x20c]
push str.SYSTEMCurrentControlSetServicesWinSock2Parameters_s
push eax
call fcn.005dfb23
lea ecx, [ebp - 0x1314]
push ecx
push 9
push ebx
lea edx, [ebp - 0x20c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x20
cmp eax, ebx
jne 0x45b6ea
mov ecx, dword [ebp - 0x1314]
lea edx, [ebp - 0x1324]
push edx
lea eax, [ebp - 0x1318]
push eax
push ebx
push ebx
push str.Num_Catalog_Entries
push ecx
mov dword [ebp - 0x1318], ebx
mov dword [ebp - 0x1320], ebx
mov dword [ebp - 0x1324], 4
call esi
mov edx, dword [ebp - 0x1314]
push edx
mov esi, eax
call edi
cmp esi, ebx
jne 0x45bc94
cmp dword [ebp - 0x1318], ebx
je 0x45bcb7
lea eax, [ebp - 0x1310]
push eax
lea ecx, [ebp - 0x20c]
push str.SYSTEMCurrentControlSetServicesWinSock2Parameters_sCatalog_Entries
push ecx
call fcn.005dfb23
lea edx, [ebp - 0x1314]
push edx
push 9
push ebx
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x20
cmp eax, ebx
jne 0x45b6ea
push 0x103
lea edx, [ebp - 0x30f]
push ebx
push edx
xor esi, esi
mov byte [ebp - 0x310], bl
call fcn.005dfd60
push 0x3ff
lea eax, [ebp - 0xb0f]
push ebx
push eax
mov dword [ebp - 0x132c], 0x104
mov byte [ebp - 0xb10], bl
call fcn.005dfd60
push 0x3ff
lea ecx, [ebp - 0x70f]
push ebx
push ecx
mov byte [ebp - 0x710], bl
call fcn.005dfd60
mov ecx, dword [ebp - 0x1314]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
add esp, 0x24
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x131c]
push edx
lea eax, [ebp - 0x710]
push eax
push ebx
push ecx
mov dword [ebp - 0x131c], 0x400
call edi
test eax, eax
jne 0x45bac4
lea ebx, [ebx]
lea edx, [ebp - 0x710]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0xb10]
push 0x612438
push ecx
call fcn.005dfb23
add esp, 0x10
lea edx, [ebp - 0x132c]
push edx
lea eax, [ebp - 0x310]
push eax
push str.LibraryPath
lea ecx, [ebp - 0xb10]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
push ebx
lea edx, [ebp - 0x310]
push str.mswsock.dll
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x45ba3a
lea eax, [ebp - 0x1330]
push eax
push str.SupportedNameSpace
lea ecx, [ebp - 0xb10]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1330], ebx
mov dword [ebp - 0x1334], 1
call fcn.004d5820
cmp dword [ebp - 0x1330], 0xc
jne 0x45ba3a
mov eax, dword [ebp - 0x133c]
lea edx, [ebp - 0xb10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x1334]
push ecx
push 0x61726c
lea edx, [ebp - 0xb10]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x7330b4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [ebp - 0x1338]
xor eax, eax
cmp dword [ebp - 0x1334], 1
sete al
mov dword [ecx], eax
inc dword [ebp - 0x1320]
push 0x103
lea edx, [ebp - 0x30f]
push ebx
push edx
inc esi
mov byte [ebp - 0x310], bl
call fcn.005dfd60
push 0x3ff
lea eax, [ebp - 0xb0f]
push ebx
push eax
mov dword [ebp - 0x132c], 0x104
mov byte [ebp - 0xb10], bl
call fcn.005dfd60
push 0x3ff
lea ecx, [ebp - 0x70f]
push ebx
push ecx
mov byte [ebp - 0x710], bl
call fcn.005dfd60
mov ecx, dword [ebp - 0x1314]
add esp, 0x24
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x131c]
push edx
lea eax, [ebp - 0x710]
push eax
push esi
push ecx
mov dword [ebp - 0x131c], 0x400
call edi
test eax, eax
je 0x45b950
mov edx, dword [ebp - 0x1314]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1320]
cmp eax, dword [ebp - 0x1318]
jne 0x45bcb7
lea ecx, [ebp - 0xf10]
push ecx
lea edx, [ebp - 0x20c]
push str.SYSTEMCurrentControlSetServicesWinSock2Parameters_s
push edx
call fcn.005dfb23
lea eax, [ebp - 0x1314]
push eax
push 9
push ebx
lea ecx, [ebp - 0x20c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x20
cmp eax, ebx
je 0x45bb38
xor edx, edx
cmp eax, 2
setne dl
pop edi
pop esi
pop ebx
mov eax, edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x1314]
lea eax, [ebp - 0x1324]
push eax
lea ecx, [ebp - 0x1318]
push ecx
push ebx
push ebx
push str.Num_Catalog_Entries
push edx
mov dword [ebp - 0x1318], ebx
xor edi, edi
mov dword [ebp - 0x1324], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebp - 0x1314]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x45bc94
cmp dword [ebp - 0x1318], ebx
je 0x45bcb7
lea ecx, [ebp - 0xf10]
push ecx
lea edx, [ebp - 0x20c]
push str.SYSTEMCurrentControlSetServicesWinSock2Parameters_sCatalog_Entries
push edx
call fcn.005dfb23
lea eax, [ebp - 0x1314]
push eax
push 9
push ebx
lea ecx, [ebp - 0x20c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x20
cmp eax, ebx
jne 0x45bb1d
push 0x3ff
lea eax, [ebp - 0x70f]
push ebx
push eax
xor esi, esi
mov byte [ebp - 0x710], bl
call fcn.005dfd60
mov eax, dword [ebp - 0x1314]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x1320]
push ecx
lea edx, [ebp - 0x710]
push edx
push ebx
push eax
mov dword [ebp - 0x1320], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x45bc6b
jmp 0x45bc20
push 0x3ff
lea ecx, [ebp - 0x70f]
push ebx
push ecx
inc edi
inc esi
mov byte [ebp - 0x710], bl
call fcn.005dfd60
mov ecx, dword [ebp - 0x1314]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x1320]
push edx
lea eax, [ebp - 0x710]
push eax
push esi
push ecx
mov dword [ebp - 0x1320], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x45bc20
mov edx, dword [ebp - 0x1314]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, dword [ebp - 0x1318]
pop edi
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
cmp esi, 2
je 0x45bcb7
cmp dword [ebp - 0x1318], ebx
je 0x45bcb7
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret