Function at 0x1001a0ea
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x870
mov eax, dword [0x1007ef24]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
lea eax, [ebp - 0x7ec]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7fc], ecx
mov dword [ebp - 0x7ec], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001a136
xor al, al
jmp 0x1001a39c
push esi
push edi
push 0x104
lea eax, [ebp - 0x16c]
push eax
mov dword [ebp - 0x7f0], ebx
push ebx
jmp 0x1001a384
lea eax, [ebp - 0x7f4]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x16c]
push eax
push dword [ebp - 0x7ec]
mov esi, 0x378
mov dword [ebp - 0x7f4], ebx
mov dword [ebp - 0x7f8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001a3ae
lea eax, [ebp - 0x7f8]
push eax
lea eax, [ebp - 0x7e8]
push eax
push ebx
push ebx
push str.PackedCatalogItem
push dword [ebp - 0x7f4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001a3ae
cmp dword [ebp - 0x7f8], esi
jne 0x1001a3ae
push 0x3f
lea eax, [ebp + 0x19]
push ebx
push eax
mov byte [ebp + 0x18], bl
call fcn.10042a90
add esp, 0xc
cmp dword [ebp - 0x6bc], 1
jne 0x1001a36c
cmp dword [ebp - 0x698], 2
jne 0x1001a36c
push 0x1fe
lea eax, [ebp - 0x36a]
push ebx
push eax
mov word [ebp - 0x36c], bx
call fcn.10042a90
push 0x3e
lea eax, [ebp - 0x66]
push ebx
push eax
mov word [ebp - 0x68], bx
call fcn.10042a90
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 0x18
push 0x1a
pop edi
push edi
lea eax, [ebp - 0x68]
push eax
push edi
push str.rsvp_udp_service_provider
push ebx
push ebx
call esi
push 0x3e
lea eax, [ebp - 0x26]
push ebx
push eax
mov word [ebp - 0x28], bx
call fcn.10042a90
add esp, 0xc
push edi
lea eax, [ebp - 0x28]
push eax
push edi
push str.rsvp_tcp_service_provider
push ebx
push ebx
call esi
xor eax, eax
movzx ecx, word [ebp + eax - 0x670]
mov word [ebp + eax - 0x36c], cx
inc eax
inc eax
cmp cx, bx
jne 0x1001a252
mov ecx, dword [ebp - 0x7fc]
lea eax, [ebp - 0x36c]
push eax
call fcn.10019e18
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x36c]
push eax
call fcn.100451e1
test eax, eax
pop ecx
pop ecx
jne 0x1001a2b8
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x36c]
push eax
call fcn.100451e1
test eax, eax
pop ecx
pop ecx
jne 0x1001a2b8
push 8
pop ecx
mov esi, str._SystemRoot__system32mswsock.dll
lea edi, [ebp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x1001a2c6
push 8
pop ecx
mov esi, str._SystemRoot__system32_rsvpsp.dll
lea edi, [ebp + 0x18]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push dword [ebp - 0x6c0]
lea eax, [ebp + 0x58]
push 0x10065b4c
push eax
call fcn.100436a6
mov ecx, dword [ebp - 0x7fc]
add esp, 0xc
push 1
push str.SYSTEMCurrentControlSetServicesWinSock2_speednet_sph
push reloc.OLEAUT32.dll_SysReAllocString
push 0x104
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp + 0x58]
push eax
call fcn.10019e56
test eax, eax
je 0x1001a3ae
mov esi, dword [ebp + 0x7c]
lea eax, [ebp - 0x7e8]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1001a333
cmp cl, bl
je 0x1001a32f
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1001a333
inc eax
inc eax
inc esi
inc esi
cmp cl, bl
jne 0x1001a315
xor eax, eax
jmp 0x1001a338
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1001a3ae
lea esi, [ebp + 0x18]
lea eax, [ebp - 0x470]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1001a363
cmp cl, bl
je 0x1001a35f
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1001a363
inc eax
inc eax
inc esi
inc esi
cmp cl, bl
jne 0x1001a345
xor eax, eax
jmp 0x1001a368
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1001a3ae
inc dword [ebp - 0x7f0]
push 0x104
lea eax, [ebp - 0x16c]
push eax
push dword [ebp - 0x7f0]
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1001a150
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
pop ebx
call fcn.10042977
add ebp, 0x74
leave
ret 4
xor al, al
jmp 0x1001a39a