Function at 0x4022e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x419f27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
push ebp
mov ebp, ecx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x20], ebp
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x2c], ebx
mov byte [ebp + 0x30], bl
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x240], 0x1bb
mov dword [ebp + 0x248], ebx
mov dword [ebp + 0x24c], ebx
mov dword [ebp + 0x250], ebx
mov dword [ebp + 0x25c], ebx
mov dword [ebp + 0x260], ebx
mov dword [ebp + 0x26c], ebx
mov dword [ebp + 0x270], ebx
mov dword [ebp + 0x274], ebx
mov dword [ebp + 0x278], ebx
mov dword [esp + 0x13c], ebx
mov dword [ebp + 0x27c], ebx
mov dword [ebp + 0x280], ebx
mov byte [ebp + 0x284], bl
mov dword [ebp + 0x288], ebx
mov dword [ebp + 0x28c], ebx
mov byte [ebp + 0x290], bl
mov dword [ebp + 0x294], ebx
mov dword [ebp + 0x298], ebx
mov byte [ebp + 0x29c], bl
mov dword [ebp + 0x2a0], ebx
mov dword [ebp + 0x2a4], ebx
mov dword [ebp + 0x2a8], ebx
mov dword [ebp + 0x2ac], ebx
mov dword [ebp + 0x2b0], ebx
mov dword [ebp + 0x2bc], ebx
lea esi, [ebp + 0x604]
mov byte [ebp + 0x5e4], 3
mov ecx, esi
mov byte [esp + 0x13c], 1
mov dword [ebp + 0x5e8], ebx
mov dword [ebp + 0x5ec], ebx
mov dword [ebp + 0x5f0], ebx
mov dword [ebp + 0x5f4], ebx
mov dword [ebp + 0x5f8], ebx
mov byte [ebp + 0x5fc], bl
mov dword [ebp + 0x600], ebx
call sub.MFC42.DLL_CString::CString_1
mov al, byte [esp + 0x1b]
mov dword [ebp + 0x7bc], ebx
mov dword [ebp + 0x7c0], ebx
mov dword [ebp + 0x7c4], ebx
mov dword [ebp + 0x7e0], ebx
mov dword [ebp + 0x7e4], ebx
mov dword [ebp + 0x7e8], ebx
mov byte [ebp + 0x7ec], 1
mov byte [ebp + 0x7f0], al
mov dword [ebp + 0x7f4], ebx
mov dword [ebp + 0x7f8], ebx
mov dword [ebp + 0x7fc], ebx
mov byte [esp + 0x13c], 3
mov byte [ebp + 0x804], bl
mov dword [ebp + 0x914], ebx
mov dword [ebp + 0x918], ebx
mov dword [ebp + 0x91c], ebx
mov dword [ebp + 0x920], ebx
mov dword [ebp + 0x924], ebx
mov dword [ebp + 0x928], ebx
mov dword [ebp + 0x938], ebx
mov dword [ebp + 0x93c], ebx
mov dword [ebp + 0x940], ebx
mov dword [ebp + 0x944], ebx
mov dword [ebp + 0x948], ebx
push 0x429ec8
mov ecx, esi
mov dword [ebp + 0x94c], ebx
mov dword [ebp + 0x950], ebx
mov dword [ebp + 0x954], ebx
mov dword [ebp + 0x958], ebx
call sub.MFC42.DLL_CString::operator_2
or ecx, 0xffffffff
mov word [ebp + 0x2b4], bx
xor eax, eax
mov edi, 0x429ec8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
lea edx, [ebp + 0x70c]
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFile::CFile
push ebx
push ebx
push str.PredSvrAddr.txt
lea ecx, [esp + 0x30]
mov byte [esp + 0x148], 4
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x40252e
push 0x80
lea eax, [ebp + 0x70c]
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CFile::Read
mov byte [eax + ebp + 0x70c], bl
lea eax, [ebp + 0x5e8]
push eax
call dword [sym.imp.ssrapi.dll_ssr_CreateSsrZlibStream]
add esp, 4
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
push str.SoftwareNetentSecISCClient
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x150], 5
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402737
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.UseZlibCompress
push esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], pe_nt_image_headers32
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x4025c3
lea edx, [esp + 0x34]
push 0x42413c
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [ebp + 0x5ec], eax
lea eax, [esp + 0x10]
push eax
lea edi, [ebp + 0x608]
push edi
lea ecx, [esp + 0x1c]
push ecx
push ebx
push str.InstallDir
push esi
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x4025fa
mov ecx, 0x41
xor eax, eax
rep stosd dword es:[edi], eax
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.iphlpapi.dll
mov dword [ebp + 0x934], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetExtendedTcpTable
push eax
mov dword [ebp + 0x938], eax
call edi
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x93c], eax
jne 0x402654
call esi
push eax
push str._RSIscConnector__Get_GetExtendedTcpTable_error__ErrCode:__u
push 5
push 1
call fcn.004195d0
push eax
call fcn.00419410
add esp, 0x14
mov edx, dword [ebp + 0x938]
push str.GetOwnerModuleFromTcpEntry
push edx
call edi
cmp eax, ebx
mov dword [ebp + 0x940], eax
jne 0x402686
call esi
push eax
push str._RSIscConnector__Get_GetOwnerModuleFromTcpEntry_error__ErrCode:__u
push 5
push 1
call fcn.004195d0
push eax
call fcn.00419410
add esp, 0x14
mov eax, dword [ebp + 0x938]
push str.GetExtendedUdpTable
push eax
call edi
mov ecx, dword [ebp + 0x938]
push str.GetOwnerModuleFromUdpEntry
push ecx
mov dword [ebp + 0x944], eax
call edi
mov dword [ebp + 0x948], eax
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
cmp eax, ebx
mov dword [ebp + 0x94c], eax
je 0x4026fc
push 0x20
push 0x1388
push 0x1388
push ebp
push 0x402900
push eax
lea eax, [ebp + 0x950]
push eax
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
jne 0x4026fc
call esi
push eax
push str._RSIscConnector__CreateTimerQueueTimer_failed___d_
push 5
push 1
call fcn.004195d0
push eax
call fcn.00419410
add esp, 0x14
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x40270b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
mov byte [esp + 0x13c], 3
call fcn.00419872
mov ecx, dword [esp + 0x134]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x130
ret
mov dword [ebp + 0x5ec], ebx
jmp 0x4025fa