Function at 0x5b34f0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x114
mov eax, dword [0x6ab0d4]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push edi
mov edi, dword [esp + 0x120]
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [edi], ebx
call fcn.005b7510
cmp eax, 3
je 0x5b3538
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.005697c8
add esp, 0x114
ret
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x5b35bf
push edi
push str.SearchList
push dword [esp + 0x1c]
call fcn.005b3450
lea eax, [esp + 0x1c]
push eax
push str.Domain
push dword [esp + 0x28]
call fcn.005b3450
add esp, 0x18
test eax, eax
je 0x5b35b9
mov esi, dword [esp + 0x10]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b3594
sub ecx, edx
push ecx
push esi
push edi
call fcn.005b2df0
push esi
call dword [0x6ab140]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
mov dword [esp + 0x10], ebx
push dword [esp + 0x14]
call ebp
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwarePoliciesMicrosoftWindows_NTDNSClient
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x5b362b
lea eax, [esp + 0x10]
push eax
push str.SearchList
push dword [esp + 0x1c]
call fcn.005b3450
add esp, 0xc
test eax, eax
je 0x5b3625
mov esi, dword [esp + 0x10]
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b3600
sub ecx, edx
push ecx
push esi
push edi
call fcn.005b2df0
push esi
call dword [0x6ab140]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
mov dword [esp + 0x10], ebx
push dword [esp + 0x14]
call ebp
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwarePoliciesMicrosoftSystemDNSClient
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x5b369b
lea eax, [esp + 0x10]
push eax
push str.PrimaryDNSSuffix
push dword [esp + 0x1c]
call fcn.005b3450
add esp, 0xc
test eax, eax
je 0x5b3695
mov esi, dword [esp + 0x10]
mov ecx, esi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b3670
sub ecx, edx
push ecx
push esi
push edi
call fcn.005b2df0
push esi
call dword [0x6ab140]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x10
mov dword [esp + 0x10], ebx
push dword [esp + 0x14]
call ebp
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParametersInterfaces
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x5b3818
push eax
push eax
push eax
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x100
push eax
lea eax, [esp + 0x34]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x5b3812
lea eax, [esp + 0x18]
inc ebx
push eax
push 1
push 0
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x24]
call esi
test eax, eax
jne 0x5b37e5
lea eax, [esp + 0x10]
push eax
push str.SearchList
push dword [esp + 0x20]
call fcn.005b3450
add esp, 0xc
test eax, eax
je 0x5b3748
mov esi, dword [esp + 0x10]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b3725
sub ecx, edx
push ecx
push esi
push edi
call fcn.005b2df0
push esi
call dword [0x6ab140]
add esp, 0x10
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push str.Domain
push dword [esp + 0x20]
call fcn.005b3450
add esp, 0xc
test eax, eax
je 0x5b3793
mov esi, dword [esp + 0x10]
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b3770
sub ecx, edx
push ecx
push esi
push edi
call fcn.005b2df0
push esi
call dword [0x6ab140]
add esp, 0x10
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push str.DhcpDomain
push dword [esp + 0x20]
call fcn.005b3450
add esp, 0xc
test eax, eax
je 0x5b37d9
mov esi, dword [esp + 0x10]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5b37b6
sub ecx, edx
push ecx
push esi
push edi
call fcn.005b2df0
push esi
call dword [0x6ab140]
add esp, 0x10
mov dword [esp + 0x10], 0
push dword [esp + 0x18]
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x100
push eax
lea eax, [esp + 0x34]
push eax
push ebx
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x5b36e5
push dword [esp + 0x14]
call ebp
mov ecx, dword [esp + 0x120]
xor eax, eax
cmp dword [edi], eax
pop esi
pop ebp
pop edi
setne al
pop ebx
xor ecx, esp
call fcn.005697c8
add esp, 0x114
ret