Function at 0x404370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d1ab
mov eax, dword fs:[0]
push eax
sub esp, 0x6d0
mov eax, dword [0x427050]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x6ac]
xor esi, esi
push ecx
mov dword [ebp - 0x668], eax
mov dword [ebp - 0x670], esi
call fcn.00405a80
mov dword [ebp - 4], esi
mov dword [ebp - 0x630], esi
lea edx, [ebp - 0x66c]
push edx
push 0x20019
xor esi, esi
push esi
push esi
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404a03
push 4
call fcn.00409671
add esp, 4
cmp eax, esi
je 0x4043ff
lea ecx, [ebp - 0x660]
mov dword [eax], ecx
jmp 0x404401
xor eax, eax
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x654], esi
mov dword [ebp - 0x650], esi
mov dword [ebp - 0x64c], esi
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x66c]
lea edx, [ebp - 0x660]
call fcn.004041a0
mov esi, dword [ebp - 0x654]
cmp esi, dword [ebp - 0x650]
jbe 0x404441
call fcn.00409501
mov ebx, dword [ebp - 0x660]
mov dword [ebp - 0x6b4], ebx
mov edi, esi
mov esi, dword [ebp - 0x650]
mov dword [ebp - 0x6b0], edi
cmp dword [ebp - 0x654], esi
jbe 0x404468
call fcn.00409501
test ebx, ebx
je 0x404474
cmp ebx, dword [ebp - 0x660]
je 0x404479
call fcn.00409501
cmp edi, esi
je 0x40498a
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x62a]
push eax
mov word [ebp - 0x62c], dx
call fcn.00410740
add esp, 0xc
test ebx, ebx
jne 0x404515
call fcn.00409501
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x4044b4
call fcn.00409501
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
jb 0x4044bf
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x62c]
push str._lsPrintersConnections
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x664]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x62c]
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40495c
push 4
call fcn.00409671
add esp, 4
test eax, eax
je 0x404519
lea ecx, [ebp - 0x648]
mov dword [eax], ecx
jmp 0x40451b
mov eax, dword [ebx]
jmp 0x4044aa
xor eax, eax
mov dword [ebp - 0x648], eax
xor eax, eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x634], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x664]
lea edx, [ebp - 0x648]
call fcn.004041a0
mov esi, dword [ebp - 0x63c]
cmp esi, dword [ebp - 0x638]
jbe 0x40455d
call fcn.00409501
mov ebx, dword [ebp - 0x648]
mov dword [ebp - 0x6bc], ebx
mov edi, dword [ebp - 0x638]
mov dword [ebp - 0x6b8], esi
cmp dword [ebp - 0x63c], edi
jbe 0x404582
call fcn.00409501
test ebx, ebx
je 0x40458e
cmp ebx, dword [ebp - 0x648]
je 0x404593
call fcn.00409501
cmp esi, edi
je 0x4048d2
push 0x206
xor edi, edi
lea eax, [ebp - 0x21a]
xor edx, edx
push edi
push eax
mov word [ebp - 0x21c], dx
call fcn.00410740
add esp, 0xc
cmp ebx, edi
jne 0x404713
call fcn.00409501
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x4045d4
call fcn.00409501
lea eax, [esi + 4]
mov ebx, 8
cmp dword [eax + 0x14], ebx
jb 0x4045e3
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x62c]
push ecx
lea edx, [ebp - 0x21c]
push str._ls_ls
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x6c8]
push eax
push 0x20019
push edi
lea ecx, [ebp - 0x21c]
push ecx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4048a5
mov ecx, dword [ebp - 0x6c8]
lea edx, [ebp - 0x6cc]
push edx
lea eax, [ebp - 0x424]
push eax
push edi
push edi
push str.Server
push ecx
mov dword [ebp - 0x6cc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x670], edi
jne 0x40471a
lea edx, [ebp - 0x21c]
push edx
push str.GetRemoteHostFromRegistry_Added_into_hosts__ls
call fcn.004029a0
add esp, 8
xor eax, eax
mov word [ebp - 0x688], ax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x674], 7
mov dword [ebp - 0x678], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x404695
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
lea esi, [ebp - 0x68c]
call fcn.00405f90
mov ecx, esi
push ecx
lea edx, [ebp - 0x6ac]
push edx
mov byte [ebp - 4], 5
call fcn.00405580
mov esi, eax
lea eax, [ebp - 0x424]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4046d4
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x424]
call fcn.00405f90
mov byte [ebp - 4], 4
cmp dword [ebp - 0x674], ebx
jb 0x4048a5
mov eax, dword [ebp - 0x688]
push eax
call fcn.0040957d
add esp, 4
jmp 0x4048a5
mov eax, dword [ebx]
jmp 0x4045ca
lea ecx, [ebp - 0x21c]
push ecx
push str.GetRemoteHostFromRegistry_Searching__ls
call fcn.004029a0
add esp, 8
xor edx, edx
lea eax, [ebp - 0x21c]
mov word [ebp - 0x688], dx
mov dword [ebp - 0x674], 7
mov dword [ebp - 0x678], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x404750
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
lea esi, [ebp - 0x68c]
call fcn.00405f90
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x694]
mov ecx, dword [ebp - 0x6ac]
mov dword [ebp - 0x6c0], eax
mov dword [ebp - 0x6c4], ecx
mov ecx, esi
lea eax, [ebp - 0x6ac]
call fcn.00406ce0
mov ebx, dword [ebp - 0x6ac]
mov edi, dword [ebp - 0x694]
mov esi, eax
mov dword [ebp - 0x6d8], esi
mov dword [ebp - 0x6dc], ebx
test ebx, ebx
jne 0x4047c3
call fcn.00409501
mov ebx, dword [ebp - 0x6ac]
cmp esi, edi
je 0x40484a
mov edi, dword [esi + 0x20]
mov eax, 8
cmp dword [esi + 0x24], eax
jb 0x4047dd
mov esi, dword [esi + 0x10]
jmp 0x4047e0
add esi, 0x10
mov edx, dword [ebp - 0x678]
cmp edx, edi
jb 0x4047ec
mov edx, edi
mov ecx, dword [ebp - 0x688]
cmp dword [ebp - 0x674], eax
jae 0x404800
lea ecx, [ebp - 0x688]
mov eax, esi
test edx, edx
jbe 0x40482b
mov si, word [ecx]
cmp si, word [eax]
jne 0x40481b
add ecx, 2
add eax, 2
sub edx, 1
jne 0x404806
jmp 0x40482b
mov dx, si
cmp dx, word [eax]
sbb eax, eax
and eax, 0xfffffffe
add eax, 1
jne 0x40483e
mov eax, dword [ebp - 0x678]
cmp eax, edi
jb 0x40484a
xor ecx, ecx
cmp eax, edi
setne cl
mov eax, ecx
test eax, eax
jl 0x40484a
lea eax, [ebp - 0x6dc]
jmp 0x404862
mov edx, dword [ebp - 0x694]
mov dword [ebp - 0x6d0], edx
mov dword [ebp - 0x6d4], ebx
lea eax, [ebp - 0x6d4]
mov ecx, dword [eax]
mov esi, dword [eax + 4]
test ecx, ecx
je 0x404873
cmp ecx, dword [ebp - 0x6c4]
je 0x404878
call fcn.00409501
cmp esi, dword [ebp - 0x6c0]
mov byte [ebp - 4], 4
sete bl
cmp dword [ebp - 0x674], 8
jb 0x40489d
mov eax, dword [ebp - 0x688]
push eax
call fcn.0040957d
add esp, 4
test bl, bl
jne 0x404ba3
mov ebx, dword [ebp - 0x6bc]
test ebx, ebx
jne 0x4048ce
call fcn.00409501
xor eax, eax
mov esi, dword [ebp - 0x6b8]
cmp esi, dword [eax + 0x10]
jb 0x4048c6
call fcn.00409501
add esi, 0x1c
jmp 0x404569
mov eax, dword [ebx]
jmp 0x4048b6
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x63c]
test esi, esi
je 0x40492d
mov edi, dword [ebp - 0x638]
cmp esi, edi
je 0x40491e
add esi, 0x18
lea ecx, [ecx]
cmp dword [esi], 8
jb 0x404901
mov ecx, dword [esi - 0x14]
push ecx
call fcn.0040957d
add esp, 4
xor edx, edx
mov dword [esi], 7
mov dword [esi - 4], 0
mov word [esi - 0x14], dx
add esi, 0x1c
lea eax, [esi - 0x18]
cmp eax, edi
jne 0x4048f0
mov ecx, dword [ebp - 0x63c]
push ecx
call fcn.0040957d
add esp, 4
mov edx, dword [ebp - 0x648]
xor eax, eax
push edx
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x634], eax
call fcn.0040957d
mov ebx, dword [ebp - 0x6b4]
mov edi, dword [ebp - 0x6b0]
add esp, 4
mov eax, dword [ebp - 0x664]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x404986
call fcn.00409501
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x40497e
call fcn.00409501
add edi, 0x1c
jmp 0x40444f
mov eax, dword [ebx]
jmp 0x404974
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x654]
test esi, esi
je 0x4049e0
mov edi, dword [ebp - 0x650]
cmp esi, edi
je 0x4049d1
add esi, 0x18
xor ebx, ebx
cmp dword [esi], 8
jb 0x4049b8
mov eax, dword [esi - 0x14]
push eax
call fcn.0040957d
add esp, 4
xor ecx, ecx
mov dword [esi], 7
mov dword [esi - 4], ebx
mov word [esi - 0x14], cx
add esi, 0x1c
lea edx, [esi - 0x18]
cmp edx, edi
jne 0x4049a7
mov eax, dword [ebp - 0x654]
push eax
call fcn.0040957d
add esp, 4
mov ecx, dword [ebp - 0x660]
xor eax, eax
push ecx
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x64c], eax
call fcn.0040957d
add esp, 4
mov edx, dword [ebp - 0x66c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x630], 0x1e
mov dword [ebp - 0x670], 1
jl 0x404b37
mov eax, dword [ebp - 0x694]
mov esi, dword [eax]
mov ebx, dword [ebp - 0x6ac]
mov edi, dword [ebp - 0x694]
test ebx, ebx
je 0x404a47
cmp ebx, dword [ebp - 0x6ac]
je 0x404a4c
call fcn.00409501
cmp esi, edi
je 0x404b37
test ebx, ebx
jne 0x404a74
call fcn.00409501
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x404a69
call fcn.00409501
cmp dword [esi + 0x40], 8
jb 0x404a78
mov eax, dword [esi + 0x2c]
jmp 0x404a7b
mov eax, dword [ebx]
jmp 0x404a5f
lea eax, [esi + 0x2c]
push eax
push str.CreateConnection__s
call fcn.004029a0
add esp, 8
test ebx, ebx
jne 0x404aad
call fcn.00409501
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x404a9e
call fcn.00409501
mov edi, 8
cmp dword [esi + 0x40], edi
jb 0x404ab1
mov ecx, dword [esi + 0x2c]
jmp 0x404ab4
mov eax, dword [ebx]
jmp 0x404a94
lea ecx, [esi + 0x2c]
call fcn.00403920
test eax, eax
je 0x404ac6
cmp eax, 0xffffffff
jne 0x404ce7
mov edi, dword [ebp - 0x630]
cmp edi, 0x3c
jge 0x404d4b
test ebx, ebx
jne 0x404ade
call fcn.00409501
cmp byte [esi + 0x45], 0
je 0x404aee
call fcn.00409501
jmp 0x404a35
mov eax, dword [esi + 8]
cmp byte [eax + 0x45], 0
jne 0x404b14
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x45], 0
jne 0x404a35
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x45], 0
je 0x404b05
jmp 0x404a35
mov eax, dword [esi + 4]
cmp byte [eax + 0x45], 0
jne 0x404b30
lea ecx, [ecx]
cmp esi, dword [eax + 8]
jne 0x404b30
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x45], 0
je 0x404b20
mov esi, eax
jmp 0x404a35
mov esi, dword [ebp - 0x630]
inc esi
push 0x3e8
mov dword [ebp - 0x630], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push str.unable_to_find_host_name_try_count__d
call fcn.004029a0
add esp, 8
cmp esi, 0x3c
jl 0x4043c4
mov dword [ebp - 4], 0xa
lea esi, [ebp - 0x6ac]
call fcn.00405ce0
mov ecx, dword [ebp - 0x6ac]
push ecx
call fcn.0040957d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040845c
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x21c]
push edx
push str.GetRemoteHostFromRegistry_New_key__ls_is_found_not_in_hosts__value__ls
call fcn.004029a0
mov edx, dword [ebp - 0x668]
lea eax, [ebp - 0x420]
mov ecx, eax
add esp, 0xc
sub edx, ecx
xor ebx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x404bd0
mov edx, dword [ebp - 0x664]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [ebp - 0x66c]
push eax
call esi
mov esi, dword [ebp - 0x63c]
cmp esi, ebx
je 0x404c49
mov edi, dword [ebp - 0x638]
cmp esi, edi
je 0x404c40
add esi, 0x18
mov edi, edi
cmp dword [esi], 8
jb 0x404c21
mov eax, dword [esi - 0x14]
push eax
call fcn.0040957d
add esp, 4
xor ecx, ecx
mov dword [esi], 7
mov dword [esi - 4], ebx
mov word [esi - 0x14], cx
add esi, 0x1c
lea edx, [esi - 0x18]
cmp edx, edi
jne 0x404c10
mov esi, dword [ebp - 0x63c]
push esi
call fcn.0040957d
add esp, 4
mov eax, dword [ebp - 0x648]
push eax
mov dword [ebp - 0x63c], ebx
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], ebx
call fcn.0040957d
mov esi, dword [ebp - 0x654]
add esp, 4
cmp esi, ebx
je 0x404cba
mov edi, dword [ebp - 0x650]
cmp esi, edi
je 0x404cb1
add esi, 0x18
cmp dword [esi], 8
jb 0x404c92
mov eax, dword [esi - 0x14]
push eax
call fcn.0040957d
add esp, 4
xor ecx, ecx
mov dword [esi], 7
mov dword [esi - 4], ebx
mov word [esi - 0x14], cx
add esi, 0x1c
lea edx, [esi - 0x18]
cmp edx, edi
jne 0x404c81
mov esi, dword [ebp - 0x654]
push esi
call fcn.0040957d
add esp, 4
mov eax, dword [ebp - 0x660]
push eax
mov dword [ebp - 0x654], ebx
mov dword [ebp - 0x650], ebx
mov dword [ebp - 0x64c], ebx
call fcn.0040957d
add esp, 4
mov dword [ebp - 4], 7
jmp 0x404b6d
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
test ebx, ebx
jne 0x404d0d
call fcn.00409501
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x404d03
call fcn.00409501
cmp dword [esi + 0x40], edi
jb 0x404d11
mov esi, dword [esi + 0x2c]
jmp 0x404d14
mov eax, dword [ebx]
jmp 0x404cf9
add esi, 0x2c
mov ecx, dword [ebp - 0x668]
lea ebx, [ebx]
movzx eax, word [esi]
mov word [ecx], ax
add esi, 2
add ecx, 2
test ax, ax
jne 0x404d20
lea esi, [ebp - 0x6ac]
mov dword [ebp - 4], edi
call fcn.00405ce0
mov edx, dword [ebp - 0x6ac]
push edx
jmp 0x404b7f
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
test ebx, ebx
jne 0x404d72
call fcn.00409501
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x404d67
call fcn.00409501
cmp dword [esi + 0x40], 8
jb 0x404d76
mov esi, dword [esi + 0x2c]
jmp 0x404d79
mov eax, dword [ebx]
jmp 0x404d5d
add esi, 0x2c
mov ecx, dword [ebp - 0x668]
nop
movzx eax, word [esi]
mov word [ecx], ax
add esi, 2
add ecx, 2
test ax, ax
jne 0x404d80
push edi
push str.Unable_to_find_host_name_Maxcount__d_kdsinst_exiting
call fcn.004029a0
add esp, 8
lea esi, [ebp - 0x6ac]
mov dword [ebp - 4], 9
call fcn.00405ce0
mov eax, dword [ebp - 0x6ac]
push eax
jmp 0x404b7f