Function at 0x10018770
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
lea eax, [ebp - 8]
mov dword [ebp - 0x14], edx
push eax
mov edx, str.iSafeNetFilter
xor ecx, ecx
mov dword [ebp - 8], 0
xor edi, edi
call fcn.10018a30
add esp, 4
lea eax, [ebp - 0xc]
push eax
push 3
push edi
push str.SYSTEMCurrentControlSetControlGroupOrderList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10018a20
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push str.PNP_TDI
push dword [ebp - 0xc]
call ebx
mov esi, eax
test esi, esi
jne 0x1001881a
mov eax, dword [ebp - 4]
add eax, 4
push eax
call dword [sym.imp.MSVCR110.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x10018815
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push esi
push str.PNP_TDI
push dword [ebp - 0xc]
call ebx
mov esi, eax
test esi, esi
je 0x1001881a
push edi
call dword [sym.imp.MSVCR110.dll_free]
add esp, 4
xor edi, edi
jmp 0x1001881a
mov esi, 0xe
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
test eax, eax
je 0x10018a1e
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
or esi, 0xffffffff
shr ebx, 2
cmp dword [ebp - 0x14], 0
je 0x1001889c
test ecx, ecx
je 0x10018a10
mov eax, 1
cmp ebx, eax
jbe 0x10018a10
lea esp, [esp]
cmp dword [edi + eax*4], ecx
je 0x1001886f
inc eax
cmp eax, ebx
jb 0x10018860
jmp 0x10018a10
cmp eax, 0xffffffff
je 0x10018a10
sub ebx, eax
lea ecx, [edi + eax*4]
lea eax, [ebx*4 - 4]
push eax
lea eax, [ecx + 4]
push eax
push ecx
call dword [sym.imp.MSVCR110.dll_memmove]
add esp, 0xc
sub dword [ebp - 4], 4
jmp 0x100189c1
mov eax, 1
test ecx, ecx
jne 0x100188da
cmp ebx, eax
jbe 0x100188c2
lea esp, [esp]
mov edx, dword [edi + eax*4]
cmp edx, ecx
jb 0x100188bd
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
inc eax
cmp eax, ebx
jb 0x100188b0
lea eax, [ebp - 8]
push eax
mov edx, str.iSafeNetFilter
mov ecx, 1
call fcn.10018a30
add esp, 4
jmp 0x100188ee
cmp ebx, 1
jbe 0x100188ee
nop
cmp dword [edi + eax*4], ecx
je 0x100188ec
inc eax
cmp eax, ebx
jb 0x100188e0
jmp 0x100188ee
mov esi, eax
lea eax, [ebp - 0x10]
push eax
mov edx, 0x10028df8
xor ecx, ecx
mov dword [ebp - 0x10], 0
call fcn.10018a30
add esp, 4
test eax, eax
jne 0x1001891f
lea eax, [ebp - 0x10]
push eax
mov edx, str.Tcpip
xor ecx, ecx
call fcn.10018a30
add esp, 4
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1001893a
mov eax, 1
cmp ebx, eax
jbe 0x1001893a
nop
cmp dword [edi + eax*4], ecx
je 0x10018986
inc eax
cmp eax, ebx
jb 0x10018930
or ecx, 0xffffffff
cmp esi, 0xffffffff
je 0x1001898a
cmp ecx, 0xffffffff
je 0x100189c1
cmp ecx, esi
jae 0x10018a10
sub esi, ecx
mov dword [ebp - 0x14], esi
cmp esi, 1
jbe 0x10018a10
mov eax, dword [ebp - 0x14]
lea esi, [ecx + 1]
lea eax, [eax*4 - 4]
push eax
lea eax, [ecx + 2]
lea esi, [edi + esi*4]
lea eax, [edi + eax*4]
push esi
push eax
call dword [sym.imp.MSVCR110.dll_memmove]
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [esi], eax
jmp 0x100189c1
mov ecx, eax
jmp 0x1001893d
cmp ecx, 0xffffffff
je 0x100189b7
sub ebx, ecx
lea esi, [ecx + 1]
lea eax, [ebx*4 - 4]
push eax
lea eax, [ecx + 2]
lea esi, [edi + esi*4]
lea eax, [edi + eax*4]
push esi
push eax
call dword [sym.imp.MSVCR110.dll_memmove]
mov eax, dword [ebp - 8]
add esp, 0xc
mov dword [esi], eax
jmp 0x100189bd
mov eax, dword [ebp - 8]
mov dword [edi + ebx*4], eax
add dword [ebp - 4], 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 3
push 0
push str.SYSTEMCurrentControlSetControlGroupOrderList
push 0x80000002
call eax
test eax, eax
jne 0x10018a10
mov eax, dword [ebp - 4]
cmp eax, 4
jbe 0x100189ec
shr eax, 2
dec eax
jmp 0x100189ee
xor eax, eax
mov dword [edi], eax
push dword [ebp - 4]
push edi
push 3
push 0
push str.PNP_TDI
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
test edi, edi
je 0x10018a1e
push edi
call dword [sym.imp.MSVCR110.dll_free]
add esp, 4
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret