Function at 0x8caee0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1344
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x207
lea eax, [ebp - 0x20f]
mov esi, ecx
mov edi, edx
push ebx
push eax
mov dword [ebp - 0x1344], esi
mov dword [ebp - 0x1340], edi
mov dword [ebp - 0x131c], ebx
mov byte [ebp - 0x210], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea ecx, [ebp - 0x1317]
push ebx
push ecx
mov byte [ebp - 0x1318], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea edx, [ebp - 0xf17]
push ebx
push edx
mov byte [ebp - 0xf18], bl
call fcn.00a7ffb0
add esp, 0xc
cmp esi, ebx
je 0x8cb57e
cmp edi, ebx
je 0x8cb57e
lea eax, [ebp - 0x210]
push str.SYSTEMCurrentControlSetServicesWinSock2
mov byte [esi], bl
push eax
mov dword [edi], 1
call fcn.00a78f30
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 8
lea ecx, [ebp - 0x131c]
push ecx
push 9
push ebx
lea edx, [ebp - 0x210]
push edx
push 0x80000002
call esi
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x8cb049
mov eax, dword [ebp - 0x131c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x210]
push str.SYSTEMCurrentControlSetServicesWinSock2Parameters
push ecx
call fcn.00a78f30
add esp, 8
lea edx, [ebp - 0x131c]
push edx
push 9
push ebx
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call esi
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x8cb049
mov eax, dword [ebp - 0x131c]
lea ecx, [ebp - 0x1330]
push ecx
lea edx, [ebp - 0x1318]
push edx
push ebx
push ebx
push str.Current_NameSpace_Catalog
push eax
mov byte [ebp - 0x1318], bl
mov dword [ebp - 0x1330], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x131c]
mov edi, eax
cmp edi, ebx
je 0x8cb062
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp edi, 2
setne al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1330]
push edx
lea eax, [ebp - 0xf18]
push eax
push ebx
push ebx
push str.Current_Protocol_Catalog
push ecx
mov byte [ebp - 0xf18], bl
mov dword [ebp - 0x1330], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x131c]
push edx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x8cb049
lea eax, [ebp - 0x1318]
push eax
lea ecx, [ebp - 0x210]
push str.SYSTEMCurrentControlSetServicesWinSock2Parameters_s
push ecx
call fcn.00a78f30
add esp, 0xc
lea edx, [ebp - 0x131c]
push edx
push 9
push ebx
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call esi
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x8cb049
mov eax, dword [ebp - 0x131c]
lea ecx, [ebp - 0x132c]
push ecx
lea edx, [ebp - 0x1320]
push edx
push ebx
push ebx
push str.Num_Catalog_Entries
push eax
mov dword [ebp - 0x1320], ebx
mov dword [ebp - 0x1324], ebx
mov dword [ebp - 0x132c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x131c]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x8cb55b
cmp dword [ebp - 0x1320], ebx
je 0x8cb57e
lea edx, [ebp - 0x1318]
push edx
lea eax, [ebp - 0x210]
push str.SYSTEMCurrentControlSetServicesWinSock2Parameters_sCatalog_Entries
push eax
call fcn.00a78f30
add esp, 0xc
lea ecx, [ebp - 0x131c]
push ecx
push 9
push ebx
lea edx, [ebp - 0x210]
push edx
push 0x80000002
call esi
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x8cb049
push 0x103
lea eax, [ebp - 0x317]
push ebx
push eax
xor esi, esi
mov byte [ebp - 0x318], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea ecx, [ebp - 0xb17]
push ebx
push ecx
mov dword [ebp - 0x1334], 0x104
mov byte [ebp - 0xb18], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea edx, [ebp - 0x717]
push ebx
push edx
mov byte [ebp - 0x718], bl
call fcn.00a7ffb0
mov edx, dword [ebp - 0x131c]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1328]
push eax
lea ecx, [ebp - 0x718]
push ecx
push ebx
push edx
mov dword [ebp - 0x1328], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x8cb385
lea eax, [ebp - 0x718]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0xb18]
push 0xaac2e4
push edx
call fcn.00a78f30
add esp, 0x10
push str.LibraryPath
lea eax, [ebp - 0x1334]
lea edi, [ebp - 0x318]
lea ecx, [ebp - 0xb18]
mov edx, 0x80000002
call fcn.0094c020
push ebx
mov eax, edi
push str.mswsock.dll
push eax
call fcn.0095c8c0
add esp, 0xc
mov edi, 1
cmp eax, 0xffffffff
je 0x8cb2f0
lea ecx, [ebp - 0x1338]
push ecx
push str.SupportedNameSpace
lea ecx, [ebp - 0xb18]
mov edx, 0x80000002
mov dword [ebp - 0x1338], ebx
mov dword [ebp - 0x133c], edi
call fcn.0094c0d0
cmp dword [ebp - 0x1338], 0xc
jne 0x8cb2f0
mov eax, dword [ebp - 0x1344]
lea edx, [ebp - 0xb18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x133c]
push ecx
push str.Enabled
lea ecx, [ebp - 0xb18]
mov edx, 0x80000002
call fcn.0094c0d0
push 0xbd62ec
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp - 0x1340]
xor edx, edx
cmp dword [ebp - 0x133c], edi
sete dl
mov dword [eax], edx
add dword [ebp - 0x1324], edi
push 0x103
lea ecx, [ebp - 0x317]
push ebx
push ecx
add esi, edi
mov byte [ebp - 0x318], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea edx, [ebp - 0xb17]
push ebx
push edx
mov dword [ebp - 0x1334], 0x104
mov byte [ebp - 0xb18], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x717]
push ebx
push eax
mov byte [ebp - 0x718], bl
call fcn.00a7ffb0
mov eax, dword [ebp - 0x131c]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x1328]
push ecx
lea edx, [ebp - 0x718]
push edx
push esi
push eax
mov dword [ebp - 0x1328], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x8cb213
mov ecx, dword [ebp - 0x131c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x1324]
cmp edx, dword [ebp - 0x1320]
jne 0x8cb57e
lea eax, [ebp - 0xf18]
push eax
lea ecx, [ebp - 0x210]
push str.SYSTEMCurrentControlSetServicesWinSock2Parameters_s
push ecx
call fcn.00a78f30
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea edx, [ebp - 0x131c]
push edx
push 9
push ebx
lea eax, [ebp - 0x210]
push eax
push 0x80000002
call esi
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x8cb049
mov eax, dword [ebp - 0x131c]
lea ecx, [ebp - 0x132c]
push ecx
lea edx, [ebp - 0x1320]
push edx
push ebx
push ebx
push str.Num_Catalog_Entries
push eax
mov dword [ebp - 0x1320], ebx
mov dword [ebp - 0x1324], ebx
mov dword [ebp - 0x132c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x131c]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x8cb55b
cmp dword [ebp - 0x1320], ebx
je 0x8cb57e
lea edx, [ebp - 0xf18]
push edx
lea eax, [ebp - 0x210]
push str.SYSTEMCurrentControlSetServicesWinSock2Parameters_sCatalog_Entries
push eax
call fcn.00a78f30
add esp, 0xc
lea ecx, [ebp - 0x131c]
push ecx
push 9
push ebx
lea edx, [ebp - 0x210]
push edx
push 0x80000002
call esi
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x8cb049
push 0x3ff
lea eax, [ebp - 0x717]
push ebx
push eax
xor edi, edi
mov byte [ebp - 0x718], bl
call fcn.00a7ffb0
mov eax, dword [ebp - 0x131c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x1328]
push ecx
lea edx, [ebp - 0x718]
push edx
push ebx
push eax
mov dword [ebp - 0x1328], 0x400
call esi
test eax, eax
jne 0x8cb52c
lea ebx, [ebx]
inc dword [ebp - 0x1324]
push 0x3ff
lea ecx, [ebp - 0x717]
push ebx
push ecx
inc edi
mov byte [ebp - 0x718], bl
call fcn.00a7ffb0
mov ecx, dword [ebp - 0x131c]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x1328]
push edx
lea eax, [ebp - 0x718]
push eax
push edi
push ecx
mov dword [ebp - 0x1328], 0x400
call esi
test eax, eax
je 0x8cb4e0
mov edx, dword [ebp - 0x131c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1324]
xor eax, eax
cmp ecx, dword [ebp - 0x1320]
sete al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
cmp edi, 2
je 0x8cb57e
cmp dword [ebp - 0x1320], ebx
je 0x8cb57e
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret