Function at 0x10009b92
Capabilities:
Query or enumerate registry value
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x52c
push ebx
lea eax, [ebp - 0x53c]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
je 0x10009de3
cmp eax, esi
jne 0x10009de3
lea eax, [ebp - 0x53c]
push eax
call fcn.10009b13
cmp eax, ebx
pop ecx
je 0x10009de3
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x51c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, dword [sym.imp.WS2_32.dll_send]
test eax, eax
je 0x10009c27
push ebx
lea eax, [ebp - 0x53c]
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x31c], 0x3039
mov dword [ebp - 0x18], 0xd431
call edi
cmp eax, ebx
je 0x10009de3
cmp eax, esi
jne 0x10009de3
push esi
lea eax, [ebp - 0x53c]
push ebx
push eax
mov dword [ebp - 0xc], 0x100
mov dword [ebp - 4], 0x200
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x31c]
push eax
push ebx
push 0x1008e5f0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10009c99
lea eax, [ebp - 0x218]
push 0x100945dc
push eax
call sub.MSVCRT.dll_strcpy
push 0x100945dc
call sub.MSVCRT.dll_strlen
add esp, 0xc
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x31c], 1
jmp 0x10009c9f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x318]
push 0x100945d4
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x53c]
pop ecx
push ebx
push esi
push eax
push dword [ebp + 8]
call edi
cmp eax, ebx
je 0x10009de3
cmp eax, esi
jne 0x10009de3
push esi
lea eax, [ebp - 0x53c]
push ebx
push eax
mov dword [ebp - 0xc], 0x100
mov dword [ebp - 4], 0x200
mov dword [ebp - 0x10], ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x10009daf
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x318]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x10009d67
push ebx
lea eax, [ebp - 0x53c]
push esi
push eax
push dword [ebp + 8]
call edi
cmp eax, ebx
je 0x10009de3
cmp eax, esi
jne 0x10009de3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xf5555555
je 0x10009daf
push esi
lea eax, [ebp - 0x53c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
inc dword [ebp - 0x10]
mov dword [ebp - 0xc], 0x100
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x318]
mov dword [ebp - 4], 0x200
push eax
push dword [ebp - 0x10]
jmp 0x10009d11
push ebx
lea eax, [ebp - 0x53c]
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 0x31c], 0x3039
mov dword [ebp - 0x18], 0xd431
call edi
cmp eax, ebx
je 0x10009de3
cmp eax, esi
jne 0x10009de3
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x10009de5
xor al, al
pop edi
pop esi
pop ebx
leave
ret