Function at 0x4376f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a26c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x194
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1a0], esi
push edi
mov dword [ebp - 0x64], 0
mov dword [ebp - 4], 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x43774d
mov eax, dword [esi]
jmp 0x43774f
mov eax, esi
mov byte [eax], 0
xor edi, edi
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
push 0xffffffffffffffff
mov byte [ebp - 4], 3
lea eax, [ebp + 8]
push edi
push eax
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x140], 0xf
mov dword [ebp - 0x144], edi
mov byte [ebp - 0x154], 0
call fcn.00409700
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x128], 0xf
mov dword [ebp - 0x12c], edi
mov byte [ebp - 0x13c], 0
mov dword [ebp - 0x110], 0xf
mov dword [ebp - 0x114], edi
mov byte [ebp - 0x124], 0
push 0xffffffffffffffff
mov byte [ebp - 4], 6
lea eax, [ebp - 0x154]
push edi
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x3c], 0
call fcn.00409700
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x10c]
push 0x11
push str.HKEY_CLASSES_ROOT
mov dword [ebp - 0xf8], 0xf
mov dword [ebp - 0xfc], edi
mov byte [ebp - 0x10c], 0
call fcn.00409600
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xf4]
push 0x11
push str.HKEY_CURRENT_USER
mov dword [ebp - 0xe0], 0xf
mov dword [ebp - 0xe4], edi
mov byte [ebp - 0xf4], 0
call fcn.00409600
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xdc]
push 0x12
push str.HKEY_LOCAL_MACHINE
mov dword [ebp - 0xc8], 0xf
mov dword [ebp - 0xcc], edi
mov byte [ebp - 0xdc], 0
call fcn.00409600
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xc4]
push 0xa
push str.HKEY_USERS
mov dword [ebp - 0xb0], 0xf
mov dword [ebp - 0xb4], edi
mov byte [ebp - 0xc4], 0
call fcn.00409600
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x98], 0xf
mov dword [ebp - 0x9c], edi
mov byte [ebp - 0xac], 0
push 0x15
push str.HKEY_PERFORMANCE_DATA
lea ecx, [ebp - 0xac]
call fcn.00409600
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x94]
push 0x13
push str.HKEY_CURRENT_CONFIG
mov dword [ebp - 0x80], 0xf
mov dword [ebp - 0x84], edi
mov byte [ebp - 0x94], 0
call fcn.00409600
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x7c]
push 0xd
push str.HKEY_DYN_DATA
mov dword [ebp - 0x68], 0xf
mov dword [ebp - 0x6c], edi
mov byte [ebp - 0x7c], 0
call fcn.00409600
push 1
push edi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0x10], 0x5c
call fcn.00409560
push eax
push edi
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00408f50
push 1
push edi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0x10], 0x5c
call fcn.00409560
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.00408f50
mov ebx, eax
lea eax, [ebp - 0x3c]
cmp eax, ebx
je 0x4379a1
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x437986
inc eax
lea ecx, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
call fcn.00409a60
push ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x3c], 0
call fcn.00409830
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x158]
cmp eax, 0x10
jb 0x4379c3
inc eax
lea ecx, [ebp - 0x16c]
push eax
push dword [ebp - 0x16c]
call fcn.00409a60
sub esp, 8
mov dword [ebp - 0x158], 0xf
lea eax, [ebp - 0x10]
mov dword [ebp - 0x15c], 0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0x16c], 0
mov byte [ebp - 0x10], 0x5c
push eax
call fcn.00429db0
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x184]
push eax
call fcn.00408f50
push eax
lea ecx, [ebp - 0x124]
call fcn.0040b360
mov eax, dword [ebp - 0x170]
cmp eax, 0x10
jb 0x437a2e
inc eax
lea ecx, [ebp - 0x184]
push eax
push dword [ebp - 0x184]
call fcn.00409a60
sub esp, 8
mov dword [ebp - 0x170], 0xf
lea eax, [ebp - 0x10]
mov dword [ebp - 0x174], 0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0x184], 0
mov byte [ebp - 0x10], 0x5c
push eax
call fcn.00429db0
push eax
push 0
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00408f50
push eax
lea ecx, [ebp - 0x13c]
call fcn.0040b360
mov eax, dword [ebp - 0x188]
cmp eax, 0x10
jb 0x437a98
inc eax
lea ecx, [ebp - 0x19c]
push eax
push dword [ebp - 0x19c]
call fcn.00409a60
lea edx, [ebp - 0x60]
mov dword [ebp - 0x188], 0xf
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x18c], 0
mov byte [ebp - 0x19c], 0
call fcn.00414d60
test al, al
je 0x437ad1
mov dword [ebp - 0x14], SysStringLen
jmp 0x437b76
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0xf4]
call fcn.00414d60
test al, al
je 0x437aef
mov dword [ebp - 0x14], reloc.WS2_32.dll_accept
jmp 0x437b76
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0xdc]
call fcn.00414d60
test al, al
je 0x437b0a
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x437b76
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0xc4]
call fcn.00414d60
test al, al
je 0x437b25
mov dword [ebp - 0x14], reloc.WS2_32.dll_closesocket
jmp 0x437b76
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0xac]
call fcn.00414d60
test al, al
je 0x437b40
mov dword [ebp - 0x14], reloc.WS2_32.dll_connect
jmp 0x437b76
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x94]
call fcn.00414d60
test al, al
je 0x437b5b
mov dword [ebp - 0x14], reloc.WS2_32.dll_getpeername
jmp 0x437b76
lea edx, [ebp - 0x60]
lea ecx, [ebp - 0x7c]
call fcn.00414d60
mov ecx, dword [ebp - 0x14]
test al, al
mov edx, reloc.OLEAUT32.dll_SysStringLen
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x4c]
cmp eax, 0x10
jb 0x437b8b
inc eax
lea ecx, [ebp - 0x60]
push eax
push dword [ebp - 0x60]
call fcn.00409a60
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x4c], 0xf
mov dword [ebp - 0x50], 0
mov byte [ebp - 0x60], 0
cmp eax, 0x10
jb 0x437bb2
inc eax
lea ecx, [ebp - 0x7c]
push eax
push dword [ebp - 0x7c]
call fcn.00409a60
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x68], 0xf
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x7c], 0
cmp eax, 0x10
jb 0x437bdf
inc eax
lea ecx, [ebp - 0x94]
push eax
push dword [ebp - 0x94]
call fcn.00409a60
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x80], 0xf
mov dword [ebp - 0x84], 0
mov byte [ebp - 0x94], 0
cmp eax, 0x10
jb 0x437c15
inc eax
lea ecx, [ebp - 0xac]
push eax
push dword [ebp - 0xac]
call fcn.00409a60
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x98], 0xf
mov dword [ebp - 0x9c], 0
mov byte [ebp - 0xac], 0
cmp eax, 0x10
jb 0x437c4e
inc eax
lea ecx, [ebp - 0xc4]
push eax
push dword [ebp - 0xc4]
call fcn.00409a60
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xb0], 0xf
mov dword [ebp - 0xb4], 0
mov byte [ebp - 0xc4], 0
cmp eax, 0x10
jb 0x437c87
inc eax
lea ecx, [ebp - 0xdc]
push eax
push dword [ebp - 0xdc]
call fcn.00409a60
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xc8], 0xf
mov dword [ebp - 0xcc], 0
mov byte [ebp - 0xdc], 0
cmp eax, 0x10
jb 0x437cc0
inc eax
lea ecx, [ebp - 0xf4]
push eax
push dword [ebp - 0xf4]
call fcn.00409a60
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xe0], 0xf
mov dword [ebp - 0xe4], 0
mov byte [ebp - 0xf4], 0
cmp eax, 0x10
jb 0x437cf9
inc eax
lea ecx, [ebp - 0x10c]
push eax
push dword [ebp - 0x10c]
call fcn.00409a60
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xf8], 0xf
mov dword [ebp - 0xfc], 0
mov byte [ebp - 0x10c], 0
cmp eax, 0x10
jb 0x437d2d
inc eax
lea ecx, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
call fcn.00409a60
cmp dword [ebp - 0x14], reloc.WS2_32.dll_accept
jne 0x437d55
lea eax, [ebp - 0x14]
push eax
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov ecx, dword [ebp - 0x14]
test eax, eax
mov edx, reloc.WS2_32.dll_accept
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x128], 0x10
lea ecx, [ebp - 0x20]
push ecx
push 0x20019
lea eax, [ebp - 0x13c]
cmovae eax, dword [ebp - 0x13c]
push 0
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x437e18
cmp dword [ebp - 0x110], 0x10
lea ecx, [ebp - 0x1c]
push ecx
push 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push ecx
lea eax, [ebp - 0x124]
mov dword [ebp - 0x1c], 0
cmovae eax, dword [ebp - 0x124]
push 0
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x437e13
cmp dword [ebp - 0x24], 1
jne 0x437e13
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x48]
call fcn.004297d0
cmp dword [ebp - 0x1c], 0
mov edi, dword [ebp - 0x48]
je 0x437e0f
cmp dword [ebp - 0x110], 0x10
lea ecx, [ebp - 0x1c]
push ecx
push edi
lea ecx, [ebp - 0x24]
push ecx
lea eax, [ebp - 0x124]
cmovae eax, dword [ebp - 0x124]
push 0
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x437e13
mov byte [ebp - 0x15], 1
push dword [ebp - 0x20]
call ebx
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x437e22
push eax
call ebx
lea ecx, [ebp - 0x124]
call fcn.00409040
lea ecx, [ebp - 0x13c]
call fcn.00409040
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 3
call fcn.00409040
cmp byte [ebp - 0x15], 0
je 0x437e75
mov eax, dword [ebp - 0x44]
sub eax, edi
je 0x437e88
push edi
lea ecx, [ebp - 0x154]
call fcn.00409100
push eax
mov ecx, esi
call fcn.0040b360
lea ecx, [ebp - 0x154]
call fcn.00409040
jmp 0x437e88
lea eax, [ebp + 0x20]
cmp esi, eax
je 0x437e88
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00409700
lea ecx, [ebp - 0x48]
call fcn.00429c90
lea ecx, [ebp + 8]
call fcn.00409040
lea ecx, [ebp + 0x20]
call fcn.00409040
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret