Function at 0x508cf0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x230
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x22c], eax
mov eax, dword [esp + 0x234]
push ebx
push esi
push edi
mov edi, dword [esp + 0x244]
xor ebx, ebx
push ebx
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], edi
xor esi, esi
mov dword [esp + 0x18], ebx
call fcn.00508760
add esp, 8
test eax, eax
jne 0x508d4e
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.005dfbbe
add esp, 0x230
ret
push ebp
cmp dword [edi], ebx
jne 0x509174
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push str.SOFTWAREMicroWorldMailScan_for_SMTPSmtpServer1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], 5
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp edi, ebx
jne 0x508e0b
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push str.LocalIPList
push edx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x508e00
add eax, 0x114
push 1
push eax
call fcn.005e34ab
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x508dca
mov eax, dword [esp + 0x10]
push eax
jmp 0x508e05
lea ecx, [esp + 0x14]
push ecx
push esi
push ebx
push ebx
mov byte [esi], bl
mov edx, dword [esp + 0x20]
push str.LocalIPList
push edx
call ebp
cmp byte [esi], bl
jne 0x508f3d
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.005e0865
add esp, 4
xor esi, esi
jmp 0x508e0b
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, ebx
jne 0x509138
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push ebx
push str.LocalIPList
push ecx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x508e8e
add eax, 0x104
push eax
call fcn.004d9470
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x508e75
mov edx, dword [esp + 0x10]
push edx
jmp 0x509126
lea eax, [esp + 0x14]
push eax
push esi
push ebx
push ebx
mov byte [esi], bl
mov ecx, dword [esp + 0x20]
push str.LocalIPList
push ecx
jmp 0x508f3b
mov edx, dword [str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...]
push edx
call fcn.004dd6c0
mov ecx, dword [esp + 0x14]
add esp, 4
mov edi, eax
mov eax, dword [str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...]
inc edi
push edi
push eax
push 1
push ebx
push str.LocalIPListX
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...]
mov eax, dword [esp + 0x10]
push edi
push edx
push 1
push ebx
push str.LocalIPList
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push str.ZSetup
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push ebx
push str.LocalIPList
push eax
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x509121
add eax, 0x104
push eax
call fcn.004d9470
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x508f27
mov ecx, dword [esp + 0x10]
push ecx
jmp 0x509126
lea edx, [esp + 0x14]
push edx
push esi
push ebx
push ebx
mov byte [esi], bl
mov eax, dword [esp + 0x20]
push str.LocalIPList
push eax
call ebp
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x38]
push eax
push ebx
push str.ZSetup
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], 4
call ebp
cmp dword [esp + 0x20], 5
je 0x509121
push 0x103
lea edx, [esp + 0x39]
push ebx
push edx
xor edi, edi
mov byte [esp + 0x40], bl
call fcn.005dfd60
push 0x103
lea eax, [esp + 0x149]
push ebx
push eax
mov byte [esp + 0x150], bl
call fcn.005dfd60
mov edx, dword [esp + 0x28]
add esp, 0x18
push 4
lea ecx, [esp + 0x2c]
push ecx
push 4
push ebx
push str.ZSetup
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [str.1..._2..._5..._7..._23..._27..._31..._36..._37..._39..._41..._42..._58..._59..._70..._71..._72..._73..._74..._75..._76..._77..._78..._79..._83..._84..._85..._86..._87..._88..._89..._90..._91..._92..._93..._94..._95..._96..._97..._98..._99..._100..._101..._102..._103..._104..._105..._106..._107..._108..._109..._110..._111..._112..._113..._114..._115..._116..._117..._118..._119..._120..._121..._122..._123..._124..._125..._126..._169.254.._173..._174..._175..._176..._178..._179..._180..._181..._182..._183..._185..._186..._187..._189..._190..._197..._223..._224..._225..._226..._227..._228..._229..._230..._231..._232..._233..._234..._235..._236..._237..._238..._239..._240..._241..._242..._243..._244..._245..._246..._247..._248..._249..._250..._251..._252..._253..._254...]
push 1
push ebx
push 0x2c
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
push ecx
push edx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x4c], bl
call fcn.004e1380
or ebp, 0xffffffff
add esp, 0x18
cmp dword [esp + 0x18], ebp
je 0x509041
lea esp, [esp]
cmp byte [esp + 0x34], bl
je 0x509019
push 0x2c
lea eax, [esp + 0x38]
push eax
push esi
call fcn.004e5460
test eax, eax
je 0x509019
push 0x2c
lea ecx, [esp + 0x38]
push ecx
push esi
mov edi, 1
call fcn.004e5560
mov ecx, dword [str.1..._2..._5..._7..._23..._27..._31..._36..._37..._39..._41..._42..._58..._59..._70..._71..._72..._73..._74..._75..._76..._77..._78..._79..._83..._84..._85..._86..._87..._88..._89..._90..._91..._92..._93..._94..._95..._96..._97..._98..._99..._100..._101..._102..._103..._104..._105..._106..._107..._108..._109..._110..._111..._112..._113..._114..._115..._116..._117..._118..._119..._120..._121..._122..._123..._124..._125..._126..._169.254.._173..._174..._175..._176..._178..._179..._180..._181..._182..._183..._185..._186..._187..._189..._190..._197..._223..._224..._225..._226..._227..._228..._229..._230..._231..._232..._233..._234..._235..._236..._237..._238..._239..._240..._241..._242..._243..._244..._245..._246..._247..._248..._249..._250..._251..._252..._253..._254...]
push 1
push ebx
push 0x2c
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x44]
push eax
push ecx
mov byte [esp + 0x4c], bl
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 0x18], ebp
jne 0x508ff0
cmp byte [esi], bl
je 0x5090e1
mov ecx, dword [str.0..._192.2.._]
push 1
push ebx
push 0x2c
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x148]
push eax
push ecx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x150], bl
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 0x18], ebp
je 0x5090e1
jmp 0x509080
cmp byte [esp + 0x138], bl
je 0x5090b4
push 0x2c
lea edx, [esp + 0x13c]
push edx
push esi
call fcn.004e5460
cmp eax, 1
je 0x5090b4
push ebx
push 0x2c
lea eax, [esp + 0x140]
push eax
push esi
mov edi, 1
call fcn.004e56c0
mov eax, dword [str.0..._192.2.._]
push 1
push ebx
push 0x2c
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x148]
push edx
push eax
mov byte [esp + 0x150], bl
call fcn.004e1380
add esp, 0x18
cmp dword [esp + 0x18], ebp
jne 0x509080
cmp edi, ebx
je 0x509121
push 0x2c
push esi
call fcn.004e80b0
push esi
call fcn.004dd6c0
mov ecx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0xc
mov edi, eax
inc edi
push edi
push esi
push 1
push ebx
push str.LocalIPListX
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edi
push esi
push 1
push ebx
push str.LocalIPList
push edx
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x509138
mov ecx, dword [esp + 0x1c]
mov dword [ecx], esi
jmp 0x509174
mov esi, dword [str.10..._127..._128.0.._169.254.._172.16.._172.17.._172.18.._172.19.._172.20.._172.21.._172.22.._172.23.._172.24.._172.25.._172.26.._172.27.._172.28.._172.29.._172.30.._172.31.._191.255.._192.0.0._192.0.2._192.2.._192.88.99._192.168.._198.18.._198.19.._223.255.255._255...]
mov eax, esi
cmp byte [esi], bl
je 0x509149
inc eax
cmp byte [eax], bl
jne 0x509144
sub eax, esi
add eax, 0x11
push 1
push eax
call fcn.005e34ab
mov ecx, dword [esp + 0x24]
add esp, 8
mov dword [ecx], eax
cmp eax, ebx
jne 0x509168
or eax, 0xffffffff
jmp 0x509188
mov byte [eax], bl
mov edx, dword [ecx]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
push eax
push edx
call fcn.004e3060
add esp, 8
mov ecx, dword [esp + 0x23c]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x230
ret