Function at 0x8aea10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x91c
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.00972700
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor ebx, ebx
test eax, eax
je 0x8aeb94
lea eax, [ebp - 0x90c]
push eax
push 9
push ebx
push str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push 0x80000002
mov dword [ebp - 0x910], ebx
mov byte [ebp - 0x108], bl
call edi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x8aeb94
mov edx, dword [ebp - 0x90c]
push 0x800
lea ecx, [ebp - 0x908]
push ecx
push ebx
push edx
mov dword [ebp - 0x914], ebx
mov byte [ebp - 0x908], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x8aeb7a
lea esp, [esp]
lea eax, [ebp - 0x908]
push eax
lea ecx, [ebp - 0x108]
push str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries_s
push ecx
call fcn.00a78f30
add esp, 0xc
lea edx, [ebp - 0x918]
push edx
push 1
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x80000002
call edi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x8aeb39
mov eax, dword [ebp - 0x918]
lea ecx, [ebp - 0x91c]
push ecx
lea edx, [ebp - 0x908]
push edx
push ebx
push ebx
push str.PackedCatalogItem
push eax
mov dword [ebp - 0x91c], 0x800
mov byte [ebp - 0x908], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x918]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea edx, [ebp - 0x908]
push str.mwtsp.dll
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8aeb70
mov eax, dword [ebp - 0x914]
mov edx, dword [ebp - 0x90c]
push 0x800
lea ecx, [ebp - 0x908]
inc eax
push ecx
push eax
push edx
mov dword [ebp - 0x914], eax
mov byte [ebp - 0x908], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x8aeaa0
jmp 0x8aeb7a
mov dword [ebp - 0x910], 1
mov eax, dword [ebp - 0x90c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x910], ebx
jne 0x8aeb94
call fcn.009724a0
call fcn.00968110
test eax, eax
je 0x8aed04
call fcn.00972890
test eax, eax
je 0x8aed04
lea ecx, [ebp - 0x90c]
push ecx
push 9
push ebx
push str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries64
push 0x80000002
mov dword [ebp - 0x918], ebx
mov byte [ebp - 0x108], bl
call edi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x8aed04
mov eax, dword [ebp - 0x90c]
push 0x800
lea edx, [ebp - 0x908]
push edx
push ebx
push eax
mov dword [ebp - 0x914], ebx
mov byte [ebp - 0x908], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x8aecea
nop
lea ecx, [ebp - 0x908]
push ecx
lea edx, [ebp - 0x108]
push str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries64_s
push edx
call fcn.00a78f30
add esp, 0xc
lea eax, [ebp - 0x910]
push eax
push 1
push ebx
lea ecx, [ebp - 0x108]
push ecx
push 0x80000002
call edi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x8aeca9
mov ecx, dword [ebp - 0x910]
lea edx, [ebp - 0x91c]
push edx
lea eax, [ebp - 0x908]
push eax
push ebx
push ebx
push str.PackedCatalogItem
push ecx
mov dword [ebp - 0x91c], 0x800
mov byte [ebp - 0x908], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x910]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x908]
push str.mwtsp.dll
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8aece0
mov eax, dword [ebp - 0x914]
mov edx, dword [ebp - 0x90c]
push 0x800
lea ecx, [ebp - 0x908]
inc eax
push ecx
push eax
push edx
mov dword [ebp - 0x914], eax
mov byte [ebp - 0x908], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x8aec10
jmp 0x8aecea
mov dword [ebp - 0x918], 1
mov eax, dword [ebp - 0x90c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x918], ebx
jne 0x8aed04
call fcn.009725d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret