Function at 0x1006f940
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x23c
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x238], eax
mov eax, dword [esp + 0x240]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
push eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], edi
xor esi, esi
mov dword [esp + 0x1c], ebx
call fcn.10069e60
add esp, 8
test eax, eax
jne 0x1006f987
or eax, 0xffffffff
jmp 0x1006fdb8
cmp dword [edi], ebx
jne 0x1006fda9
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push str.SOFTWAREMicroWorldMailScan_for_SMTPSmtpServer1
push reloc.WS2_32.dll_bind
mov dword [esp + 0x3c], 5
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp edi, ebx
jne 0x1006fa41
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push str.LocalIPList
push edx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x1006fa36
add eax, 0x104
push eax
call fcn.1006a7b0
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x1006fa00
mov eax, dword [esp + 0x10]
push eax
jmp 0x1006fa3b
lea ecx, [esp + 0x14]
push ecx
push esi
push ebx
push ebx
mov byte [esi], bl
mov edx, dword [esp + 0x20]
push str.LocalIPList
push edx
call ebp
cmp byte [esi], bl
jne 0x1006fb78
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.10128243
add esp, 4
xor esi, esi
jmp 0x1006fa41
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
push str.SOFTWAREMicroWorld
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x1006fd6a
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push ebx
push str.LocalIPList
push ecx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x1006fac4
add eax, 0x104
push eax
call fcn.1006a7b0
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x1006faab
mov edx, dword [esp + 0x10]
push edx
jmp 0x1006fd58
lea eax, [esp + 0x14]
push eax
push esi
push ebx
push ebx
mov byte [esi], bl
mov ecx, dword [esp + 0x20]
push str.LocalIPList
push ecx
jmp 0x1006fb76
mov eax, str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
cmp byte [str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...], bl
je 0x1006fad6
inc eax
cmp byte [eax], bl
jne 0x1006fad1
mov edx, dword [esp + 0x10]
sub eax, str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
inc eax
mov edi, eax
push edi
push str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
push 1
push ebx
push str.LocalIPListX
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push edi
push str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
push 1
push ebx
push str.LocalIPList
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push str.ZSetup
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push ebx
push str.LocalIPList
push eax
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x1006fd53
add eax, 0x104
push eax
call fcn.1006a7b0
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x1006fb62
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x1006fd58
lea edx, [esp + 0x14]
push edx
push esi
push ebx
push ebx
mov byte [esi], bl
mov eax, dword [esp + 0x20]
push str.LocalIPList
push eax
call ebp
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x38]
push eax
push ebx
push str.ZSetup
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], 4
call ebp
cmp dword [esp + 0x20], 5
je 0x1006fd53
push 0x103
lea edx, [esp + 0x39]
push ebx
push edx
xor ebp, ebp
mov byte [esp + 0x40], bl
call fcn.1012e060
push 0x103
lea eax, [esp + 0x14d]
push ebx
push eax
mov byte [esp + 0x154], bl
call fcn.1012e060
mov edx, dword [esp + 0x28]
add esp, 0x18
push 4
lea ecx, [esp + 0x2c]
push ecx
push 4
push ebx
push str.ZSetup
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push 0x2c
lea eax, [esp + 0x20]
lea ecx, [esp + 0x3c]
push eax
push ecx
xor cl, cl
mov edx, str.1..._2..._5..._7..._23..._27..._31..._36..._37..._39..._41..._42..._58..._59..._70..._71..._72..._73..._74..._75..._76..._77..._78..._79..._83..._84..._85..._86..._87..._88..._89..._90..._91..._92..._93..._94..._95..._96..._97..._98..._99..._100..._101..._102..._103..._104..._105..._106..._107..._108..._109..._110..._111..._112..._113..._114..._115..._116..._117..._118..._119..._120..._121..._122..._123..._124..._125..._126..._169.254.._173..._174..._175..._176..._178..._179..._180..._181..._182..._183..._185..._186..._187..._189..._190..._197..._223..._224..._225..._226..._227..._228..._229..._230..._231..._232..._233..._234..._235..._236..._237..._238..._239..._240..._241..._242..._243..._244..._245..._246..._247..._248..._249..._250..._251..._252..._253..._254...
mov dword [esp + 0x28], ebx
mov byte [esp + 0x44], bl
call fcn.10061f00
or edi, 0xffffffff
add esp, 0x10
cmp dword [esp + 0x18], edi
je 0x1006fc74
cmp byte [esp + 0x34], bl
je 0x1006fc4a
lea edx, [esp + 0x34]
push edx
call fcn.10089150
test eax, eax
je 0x1006fc4a
lea ecx, [esp + 0x34]
mov edi, esi
mov ebp, 1
call fcn.10089220
push 1
push 0x2c
lea eax, [esp + 0x20]
lea ecx, [esp + 0x3c]
push eax
push ecx
xor cl, cl
mov edx, str.1..._2..._5..._7..._23..._27..._31..._36..._37..._39..._41..._42..._58..._59..._70..._71..._72..._73..._74..._75..._76..._77..._78..._79..._83..._84..._85..._86..._87..._88..._89..._90..._91..._92..._93..._94..._95..._96..._97..._98..._99..._100..._101..._102..._103..._104..._105..._106..._107..._108..._109..._110..._111..._112..._113..._114..._115..._116..._117..._118..._119..._120..._121..._122..._123..._124..._125..._126..._169.254.._173..._174..._175..._176..._178..._179..._180..._181..._182..._183..._185..._186..._187..._189..._190..._197..._223..._224..._225..._226..._227..._228..._229..._230..._231..._232..._233..._234..._235..._236..._237..._238..._239..._240..._241..._242..._243..._244..._245..._246..._247..._248..._249..._250..._251..._252..._253..._254...
mov byte [esp + 0x44], bl
call fcn.10061f00
or edi, 0xffffffff
add esp, 0x10
cmp dword [esp + 0x18], edi
jne 0x1006fc26
cmp byte [esi], bl
je 0x1006fd0e
push 1
push 0x2c
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x148]
push eax
xor cl, cl
mov edx, str.0..._192.2.._
mov dword [esp + 0x28], ebx
mov byte [esp + 0x14c], bl
call fcn.10061f00
add esp, 0x10
cmp dword [esp + 0x18], edi
je 0x1006fd0e
lea ecx, [ecx]
cmp byte [esp + 0x13c], bl
je 0x1006fce1
lea ecx, [esp + 0x13c]
push ecx
call fcn.10089150
cmp eax, 1
je 0x1006fce1
push ebx
push 0x2c
lea edx, [esp + 0x144]
mov ecx, esi
mov ebp, 1
call fcn.1006c030
push 1
push 0x2c
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x148]
push eax
xor cl, cl
mov edx, str.0..._192.2.._
mov byte [esp + 0x14c], bl
call fcn.10061f00
add esp, 0x10
cmp dword [esp + 0x18], edi
jne 0x1006fcb0
cmp ebp, ebx
je 0x1006fd53
push esi
call fcn.1005d770
add esp, 4
mov eax, esi
cmp byte [esi], bl
je 0x1006fd26
inc eax
cmp byte [eax], bl
jne 0x1006fd21
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, esi
inc eax
mov edi, eax
push edi
push esi
push 1
push ebx
push str.LocalIPListX
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edi
push esi
push 1
push ebx
push str.LocalIPList
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x1006fd6a
mov ecx, dword [esp + 0x1c]
mov dword [ecx], esi
jmp 0x1006fda9
mov eax, str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
cmp byte [str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...], bl
je 0x1006fd7c
inc eax
cmp byte [eax], bl
jne 0x1006fd77
sub eax, str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
inc eax
push eax
call fcn.1006a7b0
mov ecx, dword [esp + 0x20]
add esp, 4
mov dword [ecx], eax
cmp eax, ebx
je 0x1006f97f
mov byte [eax], bl
mov edx, dword [ecx]
push str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov edi, dword [eax]
call fcn.1006fde0
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10127db1
add esp, 0x23c
ret