Function at 0x10069010
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov eax, 1
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push edi
xor ebp, ebp
push eax
lea ebx, [esp + 0x20]
lea esi, [esp + 0x24]
mov dword [esp + 0x18], ebp
call fcn.10068f80
xor ebx, ebx
add esp, 4
cmp dword [esp + 0x20], ebx
jne 0x1006905a
mov ecx, str.bl.spamcop.net
mov edi, str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
call fcn.10089220
cmp dword [esp + 0x1c], ebx
jne 0x1006906f
mov ecx, str.b.barracudacentral.org
mov edi, str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
call fcn.10089220
cmp dword [esp + 0x18], ebx
jne 0x10069084
mov ecx, str.zen.spamhaus.org
mov edi, str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
call fcn.10089220
mov ecx, dword [esp + 0x28]
cmp dword [ecx], ebx
jne 0x100693ce
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
push str.SOFTWAREMicroWorldMailScan_for_SMTPSmtpServer1
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, ebx
jne 0x1006913c
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push ebx
push str.RBLServer
push ecx
mov dword [esp + 0x2c], ebx
call edi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x10069131
add eax, 0x200
push eax
call fcn.1006a7b0
mov ebp, eax
add esp, 4
cmp ebp, ebx
jne 0x100690f9
mov edx, dword [esp + 0x10]
push edx
jmp 0x10069136
lea eax, [esp + 0x14]
push eax
push ebp
push ebx
push ebx
mov byte [ebp], bl
mov ecx, dword [esp + 0x20]
push str.RBLServer
push ecx
call edi
cmp byte [ebp], bl
jne 0x100691c1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.10128243
add esp, 4
xor ebp, ebp
jmp 0x1006913c
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push str.SOFTWAREMicroWorld
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x1006938c
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push ebx
push str.RBLServer
push eax
mov dword [esp + 0x2c], ebx
call edi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x10069343
add eax, 0x200
push eax
call fcn.1006a7b0
mov ebp, eax
add esp, 4
cmp ebp, ebx
jne 0x100691aa
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x10069329
lea edx, [esp + 0x14]
push edx
push ebp
push ebx
push ebx
mov byte [ebp], bl
mov eax, dword [esp + 0x20]
push str.RBLServer
push eax
call edi
lea eax, [esp + 0x20]
push eax
push str.KeepRBLValues
mov ecx, str.SOFTWAREMicroWorld
mov edx, reloc.WS2_32.dll_bind
xor esi, esi
mov dword [esp + 0x28], ebx
call fcn.10059e30
cmp dword [esp + 0x20], 1
je 0x10069249
cmp dword [esp + 0x18], ebx
je 0x100691ff
push 1
push 0x2c
mov edx, str.zen.spamhaus.org
mov ecx, ebp
call fcn.1006c030
mov esi, eax
cmp dword [esp + 0x1c], ebx
je 0x10069217
push 1
push 0x2c
mov edx, str.b.barracudacentral.org
mov ecx, ebp
call fcn.1006c030
or esi, eax
mov ecx, str.sbl_xbl.spamhaus.org
mov edi, ebp
call fcn.10089220
mov ecx, str.xbl.spamhaus.org
or esi, eax
call fcn.10089220
mov ecx, str.sbl.spamhaus.org
or esi, eax
call fcn.10089220
mov ecx, str.combined_HIB.dnsiplists.completewhois.com
or esi, eax
call fcn.10089220
or esi, eax
mov ecx, str.dynablock.njabl.org
mov edi, ebp
call fcn.10089220
mov ecx, str.list.dsbl.org
or esi, eax
call fcn.10089220
or eax, esi
je 0x100692a2
mov eax, ebp
cmp byte [ebp], bl
je 0x10069275
lea esp, [esp]
inc eax
cmp byte [eax], bl
jne 0x10069270
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, ebp
inc eax
mov esi, eax
push esi
push ebp
push 1
push ebx
push str.RBLServerX
push ecx
call edi
mov edx, dword [esp + 0x10]
push esi
push ebp
push 1
push ebx
push str.RBLServer
push edx
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push str.SOFTWAREMicroWorld
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x1006932f
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push ebx
push str.RBLServerX
push eax
mov dword [esp + 0x38], ebx
call edi
cmp dword [esp + 0x20], ebx
jne 0x10069324
mov eax, str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
mov edi, edi
inc eax
cmp byte [eax], bl
jne 0x10069300
mov ecx, dword [esp + 0x10]
sub eax, str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
inc eax
push eax
push str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
push 1
push ebx
push str.RBLServerX
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, ebx
je 0x1006938c
mov eax, dword [esp + 0x28]
pop edi
pop esi
mov dword [eax], ebp
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov eax, str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
inc eax
cmp byte [eax], bl
jne 0x10069348
mov ecx, dword [esp + 0x10]
sub eax, str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
inc eax
mov esi, eax
push esi
push str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
push 1
push ebx
push str.RBLServerX
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push esi
push str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
push 1
push ebx
push str.RBLServer
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x100692a8
mov eax, str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
inc eax
cmp byte [eax], bl
jne 0x10069391
sub eax, str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
add eax, 0x200
push eax
call fcn.1006a7b0
mov ecx, dword [esp + 0x2c]
add esp, 4
mov dword [ecx], eax
cmp eax, ebx
jne 0x100693be
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x14
ret
mov byte [eax], bl
mov ecx, dword [ecx]
push str.bl.spamcop.net_b.barracudacentral.org_zen.spamhaus.org
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret