Function at 0x10009ed0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xe30
lea eax, [esp + 0x628]
lea ecx, [esp + 0x224]
lea edx, [esp + 0xa2c]
push ebx
mov ebx, dword [esp + 0xe48]
push ebp
mov ebp, dword [esp + 0xe3c]
push esi
push edi
push ebx
push eax
push ecx
lea eax, [esp + 0x24]
push edx
push eax
push ebp
call fcn.10008980
add esp, 0x18
test eax, eax
je 0x10009f20
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xe30
ret
cmp dword [esp + 0x18], 4
jne 0x10009f75
push ebx
push 0
push ebp
call fcn.100046b0
add esp, 0xc
test eax, eax
jne 0x10009f42
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe30
ret
mov edx, dword [esp + 0xe50]
mov ecx, dword [esp + 0xe48]
mov dword [eax + 8], edx
mov edx, dword [esp + 0xe4c]
mov dword [eax + 0x10], ecx
xor ecx, ecx
test edx, edx
pop edi
pop esi
setne cl
pop ebp
mov dword [eax + 0x1ec], ecx
pop ebx
add esp, 0xe30
ret
call sym.wpcap.dll_wsockinit
push 0x200
call fcn.100169d2
mov esi, eax
add esp, 4
test esi, esi
jne 0x10009fbb
call fcn.10016b7f
mov edx, dword [eax]
push edx
call sym.wpcap.dll_pcap_strerror
push eax
push str.malloc:__s
push 0x100
push ebx
call fcn.10016898
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe30
ret
mov ecx, 0x80
xor eax, eax
mov edi, esi
push ebp
rep stosd dword es:[edi], eax
mov dword [esi], eax
call sub.packet.dll_PacketOpenAdapter
xor edi, edi
add esp, 4
cmp eax, edi
mov dword [esi], eax
jne 0x10009fff
call fcn.10008980
push eax
push str.Error_opening_adapter:__s
push 0x100
push ebx
call fcn.10016898
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe30
ret
lea ecx, [esp + 0x24]
push ecx
push eax
call sub.packet.dll_PacketGetNetType
add esp, 8
test al, al
jne 0x1000a021
call fcn.10008980
push eax
push str.Cannot_determine_the_network_type:__s
jmp 0x1000a1cc
mov eax, dword [esp + 0x24]
mov ecx, 7
cmp eax, ecx
ja 0x1000a091
je case.0x1000a039.6
cmp eax, 6
ja case.0x1000a039.3
jmp dword [eax*4 + 0x1000a360]
push 8
mov dword [esi + 0x14], 1
call fcn.100169d2
add esp, 4
cmp eax, edi
mov dword [esi + 0x1cc], eax
je 0x1000a0ce
mov dword [eax], 1
mov edx, dword [esi + 0x1cc]
mov dword [edx + 4], 0x8f
mov dword [esi + 0x1c8], 2
jmp 0x1000a0ce
mov dword [esi + 0x14], 0xa
jmp 0x1000a0ce
mov dword [esi + 0x14], 6
jmp 0x1000a0ce
mov dword [esi + 0x14], ecx
jmp 0x1000a0ce
cmp eax, 0xfffffffe
ja 0x1000a0bd
je 0x1000a0b4
cmp eax, 8
je 0x1000a0ab
cmp eax, 0xfffffffd
jne case.0x1000a039.3
mov dword [esi + 0x14], 0x32
jmp 0x1000a0ce
mov dword [esi + 0x14], 0xb
jmp 0x1000a0ce
mov dword [esi + 0x14], 0x68
jmp 0x1000a0ce
cmp eax, 0xffffffff
je 0x1000a0cb
mov dword [esi + 0x14], 1
jmp 0x1000a0ce
mov dword [esi + 0x14], edi
cmp dword [esp + 0xe4c], edi
je 0x1000a0de
mov eax, dword [esi]
push 0x20
push eax
jmp 0x1000a0e6
mov ecx, dword [esi]
push 0x80
push ecx
call sub.packet.dll_PacketSetHwFilter
add esp, 8
mov dword [esi + 0x8c], 0x3e800
call sub.packet.dll_PacketAllocatePacket
cmp eax, edi
mov dword [esi + 4], eax
jne 0x1000a11c
push str.failed_to_allocate_the_PACKET_structure
push 0x100
push ebx
call fcn.10016898
add esp, 0xc
jmp 0x1000a1da
mov edx, dword [esi]
test byte [edx + 0x160], 2
jne 0x1000a235
push 0x3e800
call fcn.100169d2
add esp, 4
cmp eax, edi
mov dword [esi + 0x90], eax
jne 0x1000a165
call fcn.10016b7f
mov eax, dword [eax]
push eax
call sym.wpcap.dll_pcap_strerror
push eax
push str.malloc:__s
push 0x100
push ebx
call fcn.10016898
add esp, 0x14
jmp 0x1000a1da
mov ecx, dword [esi + 0x8c]
mov edx, dword [esi + 4]
push ecx
push eax
push edx
call sub.packet.dll_PacketInitPacket
mov ecx, dword [esi]
mov eax, dword [esp + 0xe54]
push 0xf4240
push ecx
mov dword [esi + 0x10], eax
call sub.packet.dll_PacketSetBuff
add esp, 0x14
test al, al
jne 0x1000a1a9
push str.driver_error:_not_enough_memory_to_allocate_the_kernel_buffer_n
push 0x100
push ebx
call fcn.10016898
add esp, 0xc
jmp 0x1000a1da
mov edx, dword [esi]
push 0x3e80
push edx
call sub.packet.dll_PacketSetMinToCopy
add esp, 8
test al, al
jne 0x1000a2dd
call fcn.10008980
push eax
push str.Error_calling_PacketSetMinToCopy:__s_n
push 0x100
push ebx
call fcn.10016898
add esp, 0x10
mov eax, dword [esi]
cmp eax, edi
je 0x1000a1e9
push eax
call sub.packet.dll_PacketCloseAdapter
add esp, 4
mov eax, dword [esi + 0x90]
cmp eax, edi
je 0x1000a1fc
push eax
call fcn.100168e9
add esp, 4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x1000a20c
push eax
call sub.packet.dll_PacketFreePacket
add esp, 4
mov eax, dword [esi + 0x1cc]
cmp eax, edi
je 0x1000a21f
push eax
call fcn.100168e9
add esp, 4
push esi
call fcn.100168e9
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe30
ret
push 0x1002e458
push ebp
mov dword [esp + 0x1c], edi
call fcn.10017ce6
add esp, 4
push eax
call fcn.10016f50
push eax
push str.SYSTEMCurrentControlSetServicesDAG
push str._sCardParams_s
lea eax, [esp + 0x48]
push 0x200
push eax
call fcn.10016898
add esp, 0x1c
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
push ecx
push 0x20019
push edi
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000a2bc
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
push edx
push edi
push str.PosType
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000a2b1
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0xe48]
mov eax, dword [esi]
push edx
push eax
call sub.packet.dll_PacketSetSnapLen
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
add esp, 8
mov edx, dword [ecx + 0x174]
mov dword [esi + 0x7c], edx
mov eax, dword [esp + 0xe50]
mov ecx, dword [esi]
push eax
push ecx
call sub.packet.dll_PacketSetReadTimeout
mov edx, dword [esi]
add esp, 8
test byte [edx + 0x160], 2
je 0x1000a311
mov dword [esi + 0xa0], 0x1000a5c0
mov dword [esi + 0xa4], 0x1000a890
jmp 0x1000a325
mov dword [esi + 0xa0], 0x1000a3d0
mov dword [esi + 0xa4], 0x1000a840
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], 0x1000a910
mov dword [esi + 0xb0], 0x1000a920
mov dword [esi + 0xb4], 0x1000a380
mov dword [esi + 0xb8], 0x1000a810
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe30
ret