Function at 0x79d96df0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x68]
push ebx
sub esp, 0x94
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SystemCurrentControlSetControlNetworkProviderOrder
mov dword [esp], 0x80000002
call sym._RegOpenKeyExW_20
sub esp, 0x14
test eax, eax
je 0x79d96e60
mov edx, dword [section..bss]
test edx, edx
je 0x79d96e52
lea eax, [ebp - 0x64]
mov dword [esp], 0xf003f
mov dword [esp + 4], eax
call sym._RegOpenCurrentUser_8
sub esp, 8
test eax, eax
je 0x79d96ec0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x68]
lea esi, [ebp - 0x44]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProviderOrder
mov dword [esp], eax
mov dword [ebp - 0x44], 0
call sym._RegQueryValueExW_24
mov ebx, dword [ebp - 0x44]
sub esp, 0x18
test ebx, ebx
jne 0x79d97180
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x79d96e2e
lea eax, [ebp - 0x60]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x64]
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [ebp - 0x40], 0x65004e
mov dword [ebp - 0x3c], 0x770074
mov dword [ebp - 0x38], 0x72006f
mov dword [ebp - 0x34], 0x6b
call sym._RegOpenKeyExW_20
sub esp, 0x14
test eax, eax
jne 0x79d9716a
test byte [0x79d9e050], 8
jne 0x79d97380
lea eax, [ebp - 0x5c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._RegQueryInfoKeyA_48
sub esp, 0x30
test eax, eax
jne 0x79d9715c
test byte [0x79d9e050], 8
jne 0x79d97400
mov eax, dword [ebp - 0x5c]
lea ebx, [eax + eax + 2]
call sym._GetProcessHeap_0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x79d9715c
mov eax, dword [ebp - 0x58]
xor ebx, ebx
lea esi, [ebp - 0x54]
test eax, eax
jne 0x79d970ec
jmp 0x79d97140
mov eax, dword [ebp - 0x60]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._RegEnumKeyExW_32
sub esp, 0x20
test eax, eax
jne 0x79d970e4
test byte [0x79d9e050], 8
jne 0x79d97341
lea eax, [ebp - 0x50]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._RegOpenKeyExW_20
sub esp, 0x14
test eax, eax
jne 0x79d970e4
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x20], 0
test byte [0x79d9e050], 8
jne 0x79d973c0
lea eax, [ebp - 0x44]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], 0x79d9fb88
mov dword [esp], eax
mov dword [ebp - 0x44], 4
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x79d970d6
cmp dword [ebp - 0x4c], 4
jne 0x79d970d6
cmp dword [ebp - 0x44], 4
je 0x79d9744f
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
add ebx, 1
cmp dword [ebp - 0x58], ebx
jbe 0x79d97140
mov eax, dword [ebp - 0x5c]
add eax, 1
mov dword [ebp - 0x54], eax
test byte [0x79d9e050], 8
je 0x79d96fe0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], str.Trying_connection__lu_n
mov dword [esp + 0x10], 0x1d1
mov dword [esp + 0xc], str.wnetInit
mov dword [esp + 8], 0x79d9f71d
mov dword [esp + 4], 0x79d9e050
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79d96fe0
call sym._GetProcessHeap_0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapFree_12
sub esp, 0xc
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sym._GetProcessHeap_0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapAlloc_12
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x79d96ea7
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x40]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x68]
mov dword [esp + 0x14], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProviderOrder
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x79d97320
mov esi, dword [ebp - 0x40]
cmp esi, 1
jne 0x79d97320
test byte [0x79d9e050], 8
jne 0x79d975e9
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
mov eax, ebx
lea esi, [esi]
mov dword [esp + 4], 0x2c
mov dword [esp], eax
call edi
test eax, eax
je 0x79d97220
add esi, 1
add eax, 2
jne 0x79d97200
lea esi, [esi]
call sym._GetProcessHeap_0
imul edx, esi, 0x38
mov dword [esp + 4], 8
mov dword [esp], eax
add edx, 0xc
mov dword [esp + 8], edx
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [section..bss], eax
test eax, eax
je 0x79d97320
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._LoadStringW_16
sub esp, 0x10
lea eax, [eax + eax + 2]
mov dword [ebp - 0x6c], eax
call sym._GetProcessHeap_0
mov ecx, dword [ebp - 0x6c]
mov dword [esp + 4], 0
mov dword [esp], eax
mov edx, dword [section..bss]
mov dword [esp + 8], ecx
mov dword [ebp - 0x70], edx
call sym._HeapAlloc_12
mov edx, dword [ebp - 0x70]
sub esp, 0xc
mov dword [edx], eax
mov edx, dword [section..bss]
mov eax, dword [edx]
test eax, eax
je 0x79d972df
mov ecx, dword [ebp - 0x6c]
mov dword [esp], eax
mov dword [ebp - 0x70], edx
sub ecx, 2
mov dword [esp + 8], ecx
mov ecx, dword [ebp - 0x30]
mov dword [esp + 4], ecx
call sym._memmove
mov edx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
mov eax, dword [edx]
mov word [eax + ecx - 2], 0
mov dword [ebp - 0x6c], ebx
mov dword [edx + 4], esi
mov esi, ebx
lea esi, [esi]
nop
mov dword [esp + 4], 0x2c
mov dword [esp], esi
call edi
test eax, eax
je 0x79d97440
xor ecx, ecx
lea ebx, [eax + 2]
mov word [eax], cx
mov eax, esi
call sym.__tryLoadProvider
test ebx, ebx
je 0x79d9731c
mov esi, ebx
jmp 0x79d972f0
mov ebx, dword [ebp - 0x6c]
nop
call sym._GetProcessHeap_0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._HeapFree_12
sub esp, 0xc
jmp 0x79d96ea7
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], str.It_is__S_n
mov dword [esp + 0x10], 0x1d6
mov dword [esp + 0xc], str.wnetInit
mov dword [esp + 8], 0x79d9f71d
mov dword [esp + 4], 0x79d9e050
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79d9702f
mov dword [esp + 0x14], str.Enumerating_remembered_connections_n
mov dword [esp + 0x10], 0x1bf
mov dword [esp + 0xc], str.wnetInit
mov dword [esp + 8], 0x79d9f71d
mov dword [esp + 4], 0x79d9e050
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79d96f1d
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], str.Restoring:__S_n
mov dword [esp + 0x10], 0x11d
mov dword [esp + 0xc], str._restoreSavedConnection
mov dword [esp + 8], 0x79d9f71d
mov dword [esp + 4], 0x79d9e050
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79d97088
mov eax, dword [ebp - 0x58]
mov dword [esp + 0x14], str.There_are__lu_connections_n
mov dword [esp + 0x10], 0x1c5
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], str.wnetInit
mov dword [esp + 8], 0x79d9f71d
mov dword [esp + 4], 0x79d9e050
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79d96f96
mov eax, esi
mov ebx, dword [ebp - 0x6c]
call sym.__tryLoadProvider
jmp 0x79d97320
lea eax, [ebp - 0x44]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x79d9fba6
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x79d970d6
cmp dword [ebp - 0x4c], 1
jne 0x79d970d6
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x70], edx
call sym._GetProcessHeap_0
mov edx, dword [ebp - 0x70]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], edx
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
test eax, eax
je 0x79d970d6
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x44]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x79d9fba6
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x79d97575
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x44]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0x14], ecx
lea ecx, [ebp - 0x4c]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0x79d9fbc0
mov dword [esp], eax
mov dword [ebp - 0x44], 4
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x79d97575
cmp dword [ebp - 0x4c], 4
jne 0x79d97575
cmp dword [ebp - 0x44], 4
jne 0x79d97575
mov eax, dword [section..bss]
test eax, eax
je 0x79d97575
cmp dword [eax + 8], 0
je 0x79d97575
mov eax, dword [ebp - 0x14]
call sym.__findProviderIndexW.part.2
cmp eax, 0xffffffff
je 0x79d97575
imul eax, eax, 0x38
add eax, dword [section..bss]
mov ecx, dword [ebp - 0x48]
cmp dword [eax + 0x1c], ecx
je 0x79d97636
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x6c], edx
call sym._GetProcessHeap_0
mov edx, dword [ebp - 0x6c]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], edx
call sym._HeapFree_12
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [ebp - 0x6c], edx
call sym._GetProcessHeap_0
mov edx, dword [ebp - 0x6c]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], edx
call sym._HeapFree_12
mov edx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [ebp - 0x6c], edx
call sym._GetProcessHeap_0
mov edx, dword [ebp - 0x6c]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], edx
call sym._HeapFree_12
sub esp, 0xc
jmp 0x79d970d6
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call sym._wine_dbgstr_wn
mov dword [esp + 0x14], str.provider_order_is__s_n
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x181
mov dword [esp + 0xc], str.wnetInit
mov dword [esp + 8], 0x79d9f71d
mov dword [esp + 4], 0x79d9e050
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79d971f4
lea eax, [ebp - 0x44]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x79d9fbda
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x79d97575
cmp dword [ebp - 0x4c], 1
jne 0x79d97575
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x70], edx
call sym._GetProcessHeap_0
mov edx, dword [ebp - 0x70]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], edx
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x79d97575
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x44]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x79d9fbda
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
jne 0x79d97575
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_wcslen]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x6c], eax
call sym._GetProcessHeap_0
mov edx, dword [ebp - 0x6c]
mov dword [esp + 4], 0
mov dword [esp], eax
add edx, 2
add edx, edx
mov dword [esp + 8], edx
call sym._HeapAlloc_12
sub esp, 0xc
mov dword [ebp - 0x20], eax
test eax, eax
je 0x79d97575
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov word [eax + edx*2], 0x3a
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov word [eax + edx*2 + 2], 0
test byte [0x79d9e050], 8
jne 0x79d9779d
lea eax, [ebp - 0x30]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.mpr.dll_WNetUseConnectionW
sub esp, 0x20
jmp 0x79d97575
mov dword [esp + 0x14], str.Attempting_connection_n
mov dword [esp + 0x10], 0x157
mov dword [esp + 0xc], str._restoreSavedConnection
mov dword [esp + 8], 0x79d9f71d
mov dword [esp + 4], 0x79d9e050
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x79d97752