Function at 0x10120300
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x948
mov eax, dword [0x10189710]
xor eax, esp
mov dword [esp + 0x944], eax
mov eax, dword [esp + 0x950]
push ebx
push ebp
mov ebp, dword [esp + 0x954]
push esi
push edi
mov esi, edx
xor ebx, ebx
push 0x103
lea edx, [esp + 0x549]
push ebx
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov byte [esp + 0x550], bl
call fcn.1012e060
push 0x207
lea eax, [esp + 0x75d]
push ebx
push eax
mov dword [esp + 0x44], ebx
mov byte [esp + 0x764], bl
call fcn.1012e060
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
push str.DebugPP
mov ecx, str.SoftwareMicroWorldeScan_for_WindowsMwMonitor
mov edx, reloc.WS2_32.dll_bind
mov dword [esp + 0x18], ebx
call fcn.10059e30
cmp dword [esp + 0x10], ebx
je 0x101203a8
push esi
push ebp
push 1
push 0xd
push str._PP__FW:_u__AddRemovePortProxy__u_:_ListenAdd:__s___ListenPort:__s_
push ebx
call fcn.1006ed90
add esp, 0x18
mov ecx, 0xd
mov esi, str.SYSTEMCurrentControlSet_servicesPortProxy_v4tov4_tcp
lea edi, [esp + 0x544]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x14]
push edx
push 1
push ebx
movsw word es:[edi], word [esi]
lea eax, [esp + 0x550]
push eax
push reloc.WS2_32.dll_bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x1012059b
push 0x103
lea ecx, [esp + 0x445]
push ebx
push ecx
mov byte [esp + 0x44c], bl
call fcn.1012e060
push 0x103
lea edx, [esp + 0x659]
push ebx
push edx
mov byte [esp + 0x660], bl
call fcn.1012e060
add esp, 0x18
cmp ebp, ebx
je 0x10120444
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x10120444
push eax
push ebp
lea eax, [esp + 0x448]
push str._s__s
push eax
call fcn.10127dc0
add esp, 0x10
mov ecx, dword [esp + 0x24]
cmp ecx, ebx
je 0x1012046b
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x1012046b
push eax
push ecx
lea ecx, [esp + 0x650]
push str._s__s
push ecx
call fcn.10127dc0
add esp, 0x10
push 0x103
lea edx, [esp + 0x139]
push ebx
push edx
call fcn.1012e060
push 0x103
lea eax, [esp + 0x41]
push ebx
push eax
call fcn.1012e060
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
add esp, 0x18
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x1c]
push ebx
mov eax, 0x104
push ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x148]
push ecx
push ebx
push edx
xor esi, esi
mov byte [esp + 0x154], bl
mov byte [esp + 0x50], bl
call edi
test eax, eax
jne 0x1012057e
lea ebx, [ebx]
cmp dword [esp + 0x10], ebx
je 0x10120501
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x138]
push ecx
push str._PP__ValueName:__s___ValueData:__s_
push ebx
call fcn.1006ed90
add esp, 0x10
lea edx, [esp + 0x440]
push edx
lea eax, [esp + 0x138]
push eax
call fcn.10135887
add esp, 8
test eax, eax
je 0x1012055d
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x1c]
push ebx
mov eax, 0x104
push ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x148]
push ecx
inc esi
push esi
push edx
mov byte [esp + 0x154], bl
mov byte [esp + 0x50], bl
call edi
test eax, eax
je 0x101204e0
jmp 0x1012057e
lea eax, [esp + 0x648]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.10135887
add esp, 8
test eax, eax
jne 0x1012057e
mov dword [esp + 0x2c], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x10120591
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x2c], ebx
jne 0x101206a1
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
push edi
push edx
push esi
push ebp
lea eax, [esp + 0x248]
push str.netsh_interface_portproxy_add_v4tov4_listenaddress_s_listenport_s_connectaddress_s_connectport_s
push eax
call fcn.10127dc0
add esp, 0x18
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
xor ecx, ecx
lea edx, [esp + 0x24c]
call fcn.10063a90
cmp dword [esp + 0x10], ebx
je 0x101205f2
lea ecx, [esp + 0x238]
push ecx
push str._PP__C_Exec:__s_
push ebx
call fcn.1006ed90
add esp, 0xc
call fcn.1006bbf0
push esi
test eax, eax
je 0x1012060b
push str.netsh_advfirewall_firewall_delete_rule_nameall_protocoltcp_localport_s
lea edx, [esp + 0x240]
push edx
jmp 0x10120618
push str.netsh_firewall_delete_portopening_protocol__TCP_port___s_profile__ALL
lea eax, [esp + 0x240]
push eax
call fcn.10127dc0
add esp, 0xc
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
xor ecx, ecx
lea edx, [esp + 0x24c]
call fcn.10063a90
call fcn.1006bbf0
test eax, eax
je 0x10120654
push edi
push str.eScanLiveConnect
push str.netsh_advfirewall_firewall_add_rule_name__s__dirin_profileany_actionallow_protocoltcp_localport_s
lea ecx, [esp + 0x244]
push ecx
jmp 0x10120667
push str.eScanLiveConnect
push edi
push str.netsh_firewall_set_portopening_protocol__TCP_port___s_name___s_mode__ENABLE_scope__ALL
lea edx, [esp + 0x244]
push edx
call fcn.10127dc0
add esp, 0x10
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
xor ecx, ecx
lea edx, [esp + 0x24c]
call fcn.10063a90
cmp dword [esp + 0x10], ebx
je 0x101206a1
lea eax, [esp + 0x238]
push eax
push str._PP__D_Exec:__s_
push ebx
call fcn.1006ed90
add esp, 0xc
mov ecx, dword [esp + 0x954]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10127db1
add esp, 0x948
ret