Function at 0x5d8ee0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x950
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x94c], eax
mov eax, dword [esp + 0x95c]
mov ecx, dword [esp + 0x960]
mov edx, dword [esp + 0x968]
push ebx
push ebp
mov ebp, dword [esp + 0x95c]
push esi
mov esi, dword [esp + 0x964]
push edi
xor ebx, ebx
push 0x103
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x655]
push ebx
push eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x24], esi
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], edx
mov byte [esp + 0x65c], bl
call fcn.005dfd60
push 0x207
lea ecx, [esp + 0x765]
push ebx
push ecx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x76c], bl
call fcn.005dfd60
add esp, 0x18
lea edx, [esp + 0x14]
push edx
push str.DebugPP
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebx
call fcn.004d5820
cmp dword [esp + 0x14], ebx
je 0x5d8faf
mov eax, dword [esp + 0x974]
mov ecx, dword [esp + 0x97c]
push esi
push ebp
push eax
push ecx
push str._PP__FW:_u__AddRemovePortProxy__u_:_ListenAdd:__s___ListenPort:__s_
push ebx
call fcn.004f0f30
add esp, 0x18
mov ecx, 0xd
mov esi, str.SYSTEMCurrentControlSet_servicesPortProxy_v4tov4_tcp
lea edi, [esp + 0x650]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x1c]
push edx
push 1
movsw word es:[edi], word [esi]
push ebx
lea eax, [esp + 0x65c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
movsb byte es:[edi], byte [esi]
call fcn.004dc0a0
add esp, 0x14
test eax, eax
jne 0x5d9208
push 0x103
lea ecx, [esp + 0x551]
push ebx
push ecx
mov byte [esp + 0x558], bl
call fcn.005dfd60
push 0x103
lea edx, [esp + 0x251]
push ebx
push edx
mov byte [esp + 0x258], bl
call fcn.005dfd60
add esp, 0x18
cmp ebp, ebx
je 0x5d9044
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x5d9044
push eax
push ebp
lea eax, [esp + 0x554]
push 0x66833c
push eax
call fcn.005dfb23
add esp, 0x10
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x5d906b
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x5d906b
push eax
push ecx
lea ecx, [esp + 0x248]
push 0x66833c
push ecx
call fcn.005dfb23
add esp, 0x10
push 0x103
lea edx, [esp + 0x3d]
push ebx
push edx
call fcn.005dfd60
push 0x103
lea eax, [esp + 0x14d]
push ebx
push eax
call fcn.005dfd60
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
add esp, 0x18
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x140]
push edx
mov edx, dword [esp + 0x24]
push ebx
push ebx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x4c]
push ecx
push ebx
mov ebp, 0x104
push edx
xor esi, esi
mov byte [esp + 0x58], bl
mov byte [esp + 0x15c], bl
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebp
call edi
test eax, eax
jne 0x5d91f1
lea ebx, [ebx]
cmp dword [esp + 0x14], ebx
je 0x5d9101
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x3c]
push ecx
push str._PP__ValueName:__s___ValueData:__s_
push ebx
call fcn.004f0f30
add esp, 0x10
mov eax, dword [esp + 0x974]
cmp eax, 2
jne 0x5d916b
lea edx, [esp + 0x38]
push 0x2f
push edx
call fcn.005e0940
add esp, 8
cmp eax, ebx
je 0x5d918e
mov ecx, dword [esp + 0x18]
push ecx
inc eax
push eax
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x5d918e
cmp dword [esp + 0x14], ebx
je 0x5d914c
lea edx, [esp + 0x38]
push edx
push str._PP__VALUE_TO_BE_DELETED:___s_
push ebx
call fcn.004f0f30
add esp, 0xc
push ebx
push 0x2c
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x760]
push ecx
mov dword [esp + 0x20], 1
call fcn.004e56c0
jmp 0x5d918e
cmp eax, 1
je 0x5d9175
cmp eax, 4
jne 0x5d918e
lea edx, [esp + 0x54c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x5d91cd
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x140]
push edx
mov edx, dword [esp + 0x24]
push ebx
push ebx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x4c]
push ecx
inc esi
push esi
push edx
mov byte [esp + 0x58], bl
mov byte [esp + 0x15c], bl
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebp
call edi
test eax, eax
je 0x5d90e0
jmp 0x5d91f1
lea eax, [esp + 0x240]
push eax
lea ecx, [esp + 0x140]
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x5d91f1
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x5d9204
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], ebx
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x974]
cmp eax, 4
jne 0x5d921d
mov eax, dword [esp + 0x10]
jmp 0x5d947d
cmp eax, 2
jne 0x5d93ae
cmp dword [esp + 0x10], ebx
je 0x5d93a7
cmp byte [esp + 0x754], bl
je 0x5d93a7
push 1
push ebx
push 0x2c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x250]
push eax
lea ecx, [esp + 0x768]
push ecx
mov dword [esp + 0x28], ebx
call fcn.004e1380
or edi, 0xffffffff
add esp, 0x18
cmp dword [esp + 0x10], edi
je 0x5d9342
lea edx, [esp + 0x240]
push 0x2f
push edx
call fcn.005e0940
add esp, 8
cmp eax, ebx
je 0x5d9316
lea ecx, [eax + 1]
lea esi, [esp + 0x54c]
sub esi, ecx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
cmp dl, bl
jne 0x5d9296
mov byte [eax], bl
xor ecx, ecx
jmp 0x5d92b0
mov dl, byte [esp + ecx + 0x240]
mov byte [esp + ecx + 0x13c], dl
inc ecx
cmp dl, bl
jne 0x5d92b0
mov byte [eax], 0x2f
lea eax, [esp + 0x54c]
push eax
lea ecx, [esp + 0x140]
push ecx
lea edx, [esp + 0x34c]
push str.netsh_interface_portproxy_delete_v4tov4_listenaddress_s_listenport_s
push edx
call fcn.005dfb23
lea eax, [esp + 0x354]
push 1
push eax
call fcn.0050cdf0
add esp, 0x18
cmp dword [esp + 0x14], ebx
je 0x5d9316
lea ecx, [esp + 0x344]
push ecx
push str._PP__A_Exec:__s_
push ebx
call fcn.004f0f30
add esp, 0xc
push 1
push ebx
push 0x2c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x250]
push eax
lea ecx, [esp + 0x768]
push ecx
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 0x10], edi
jne 0x5d9270
call fcn.004d9b00
test eax, eax
je 0x5d935f
mov edx, dword [esp + 0x18]
push edx
push str.netsh_advfirewall_firewall_delete_rule_nameall_protocoltcp_localport_s
lea eax, [esp + 0x34c]
push eax
jmp 0x5d9371
mov ecx, dword [esp + 0x18]
push ecx
push str.netsh_firewall_delete_portopening_protocol__TCP_port___s_profile__ALL
lea edx, [esp + 0x34c]
push edx
call fcn.005dfb23
add esp, 0xc
lea eax, [esp + 0x344]
push 1
push eax
call fcn.0050cdf0
add esp, 8
cmp dword [esp + 0x14], ebx
je 0x5d9478
lea ecx, [esp + 0x344]
push ecx
push str._PP__B_Exec:__s_
jmp 0x5d946f
xor eax, eax
jmp 0x5d947d
cmp eax, 1
jne 0x5d9478
cmp dword [esp + 0x10], ebx
jne 0x5d9478
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
push esi
push edx
push eax
push ebp
lea ecx, [esp + 0x354]
push str.netsh_interface_portproxy_add_v4tov4_listenaddress_s_listenport_s_connectaddress_s_connectport_s
push ecx
call fcn.005dfb23
lea edx, [esp + 0x35c]
push 1
push edx
call fcn.0050cdf0
add esp, 0x20
cmp dword [esp + 0x14], ebx
je 0x5d9411
lea eax, [esp + 0x344]
push eax
push str._PP__C_Exec:__s_
push ebx
call fcn.004f0f30
add esp, 0xc
call fcn.004d9b00
test eax, eax
je 0x5d942f
mov ecx, dword [esp + 0x30]
push esi
push ecx
push str.netsh_advfirewall_firewall_add_rule_name__s__dirin_profileany_actionallow_protocoltcp_localport_s
lea edx, [esp + 0x350]
push edx
jmp 0x5d9442
mov eax, dword [esp + 0x30]
push eax
push esi
push str.netsh_firewall_set_portopening_protocol__TCP_port___s_name___s_mode__ENABLE_scope__ALL
lea ecx, [esp + 0x350]
push ecx
call fcn.005dfb23
add esp, 0x10
lea edx, [esp + 0x344]
push 1
push edx
call fcn.0050cdf0
add esp, 8
cmp dword [esp + 0x14], ebx
je 0x5d9478
lea eax, [esp + 0x344]
push eax
push str._PP__D_Exec:__s_
push ebx
call fcn.004f0f30
add esp, 0xc
mov eax, 1
mov ecx, dword [esp + 0x95c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x950
ret