Function at 0x425260
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x728
mov eax, dword [0x4a39f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, ecx
push 0x62
push eax
lea ecx, [ebp - 0xf2]
push ecx
mov dword [ebp - 0x714], esi
mov word [ebp - 0xf4], ax
call fcn.00405300
xor edx, edx
push 0x208
push edx
lea eax, [ebp - 0x2fe]
push eax
mov word [ebp - 0x300], dx
call fcn.00405300
xor ecx, ecx
push 0x62
push ecx
lea edx, [ebp - 0x8e]
push edx
xor edi, edi
mov word [ebp - 0x90], cx
call fcn.00405300
add esp, 0x24
mov dword [ebp - 0x70c], 0x32
test esi, esi
jne 0x425301
push str.state
push str.QueryIntelTeamingStateReg:__s_failed_n
push 1
call fcn.004343f0
add esp, 0xc
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0x8534
je 0x425311
push str.stateSize__sizeof_state
jmp 0x4252e0
mov esi, dword [esi + 8]
test esi, esi
jg 0x42531f
push str.state__numAdapters___0
jmp 0x4252e0
cmp esi, 0x40
jle 0x42532b
push str.state__numAdapters___VNET_BRSTATE_NUM_ADAPTERS
jmp 0x4252e0
push 0x32
lea eax, [ebp - 0xf4]
push eax
push 0x478b08
call dword [0x4653b0]
test eax, eax
jne 0x425364
push str.cant_convert_guid_to_string
push 1
call fcn.004343f0
add esp, 8
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xf4]
push ecx
push str.SYSTEMCurrentControlSetControlClass_s
lea edx, [ebp - 0x300]
push 0x105
push edx
call fcn.00457d45
add esp, 0x10
lea eax, [ebp - 0x708]
push eax
push 9
push 0
lea ecx, [ebp - 0x300]
push ecx
push 0x80000002
call dword [0x4650cc]
mov esi, eax
test esi, esi
je 0x4253d0
call dword [0x4651b0]
push eax
push esi
push str.QueryIntelTeamingStateReg:_couldnt_open_net_class_adapter:_0x_08x_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x728]
push edx
mov edx, dword [ebp - 0x708]
push 0
push 0
push 0
lea eax, [ebp - 0x70c]
push eax
lea ecx, [ebp - 0x90]
push ecx
push 0
push edx
call dword [0x465090]
test eax, eax
jne 0x42573c
push ebx
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x6fe]
inc edi
push ecx
mov dword [ebp - 0x718], edi
mov word [ebp - 0x700], ax
call fcn.00405300
mov ecx, dword [ebp - 0x708]
add esp, 0xc
lea edx, [ebp - 0x704]
push edx
push 1
push 0
lea eax, [ebp - 0x90]
push eax
push ecx
mov dword [ebp - 0x71c], 0x400
mov dword [ebp - 0x70c], 0x32
call dword [0x4650cc]
mov esi, eax
test esi, esi
je 0x425484
call dword [0x4651b0]
lea edx, [ebp - 0x90]
push edx
push eax
push esi
push str.QueryIntelTeamingStateReg:_could_not_open_adapter_key:_0x_08x_0x_08x__S
push 1
call fcn.004343f0
add esp, 0x14
jmp 0x425704
mov edi, dword [ebp - 0x704]
mov ebx, str.Intel
mov esi, str.ProviderName
call fcn.00424880
test eax, eax
jne 0x4254b1
push str.QueryIntelTeamingStateReg:_Provider_isnt_Intel
push 4
call fcn.004343f0
add esp, 8
jmp 0x4256f7
push str.QueryIntelTeamingStateReg:_Provider_is_Intel
push 0x10
call fcn.004343f0
mov edi, dword [ebp - 0x704]
add esp, 8
mov ebx, str.iansminiport
mov esi, str.ComponentId
call fcn.00424880
test eax, eax
jne 0x425521
mov edi, dword [ebp - 0x704]
mov esi, str.MatchingDeviceId
call fcn.00424880
test eax, eax
jne 0x425521
mov edi, dword [ebp - 0x704]
mov ebx, str.Intel_R__Advanced_Network_Services_Virtual_Adapter
mov esi, str.DriverDesc
call fcn.00424880
test eax, eax
jne 0x425521
push str.QueryIntelTeamingStateReg:_Intel_device_isnt_NCS_miniport
push 4
call fcn.004343f0
mov ecx, dword [ebp - 0x704]
add esp, 8
push ecx
jmp 0x4256fe
push str.QueryIntelTeamingStateReg:_device_is_NCS_miniport
push 0x10
call fcn.004343f0
mov edi, dword [0x4650c4]
xor eax, eax
add esp, 8
mov dword [ebp - 0x2a], eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
xor edx, edx
lea eax, [ebp - 0x720]
push eax
mov eax, dword [ebp - 0x704]
lea ecx, [ebp - 0x2c]
push ecx
mov word [ebp - 0x2c], dx
mov dword [ebp - 0x710], edx
lea edx, [ebp - 0x710]
push edx
push 0
push str.ReceiveLoadBalancing
push eax
mov dword [ebp - 0x720], 0x28
call edi
mov esi, eax
test esi, esi
jne 0x4256d9
cmp dword [ebp - 0x710], 1
jne 0x4256d9
mov ecx, 0x480030
lea eax, [ebp - 0x2c]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4255d6
test dx, dx
je 0x4255d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4255d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4255b0
xor eax, eax
jmp 0x4255db
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4255fa
push str.QueryIntelTeamingStateReg:_RLB_isnt_in_use
push 0x20
call fcn.004343f0
mov ecx, dword [ebp - 0x704]
add esp, 8
push ecx
jmp 0x4256fe
push str.QueryIntelTeamingStateReg:_RLB_is_in_use
push 0x20
call fcn.004343f0
mov ecx, dword [ebp - 0x704]
add esp, 8
lea edx, [ebp - 0x71c]
push edx
lea eax, [ebp - 0x700]
push eax
push 0
push 0
push str.NetCfgInstanceId
push ecx
call edi
mov esi, eax
test esi, esi
je 0x425652
call dword [0x4651b0]
push eax
push esi
push str.QueryIntelTeamingStateReg:_couldnt_query_instance_ID_for_adapter:_0x_08x_0x_08x
push 4
call fcn.004343f0
mov edx, dword [ebp - 0x704]
add esp, 0x10
push edx
jmp 0x4256fe
mov eax, dword [ebp - 0x704]
push eax
call dword [0x4650d0]
mov edi, dword [ebp - 0x714]
xor ecx, ecx
xor esi, esi
cmp dword [edi + 8], ecx
mov word [ebp - 0x302], cx
jle 0x4256bc
lea ebx, [edi + 0x40]
lea edx, [ebp - 0x700]
push edx
push ebx
call fcn.00457c9a
add esp, 8
test eax, eax
jne 0x42569a
inc esi
add ebx, 0x214
cmp esi, dword [edi + 8]
jl 0x425678
jmp 0x4256bc
push esi
push str.QueryIntelTeamingStateReg:_found_match_for_registry_and_state:_offset__d
push 0x10
call fcn.004343f0
mov eax, esi
imul eax, eax, 0x214
lea eax, [eax + edi + 0x3c]
add esp, 0xc
or dword [eax], 0x180
cmp esi, dword [edi + 8]
jl 0x425704
lea ecx, [ebp - 0x700]
push ecx
push str.QueryIntelTeamingStateReg:_didnt_find_intel_match_for__S
push 1
call fcn.004343f0
add esp, 0xc
jmp 0x425704
call dword [0x4651b0]
mov edx, dword [ebp - 0x710]
push edx
push eax
push esi
push str.QueryIntelTeamingStateReg:_Error_reading_RLB:_0x_08x_0x_08x_0x_08x
push 4
call fcn.004343f0
add esp, 0x14
mov eax, dword [ebp - 0x704]
push eax
call dword [0x4650d0]
mov edi, dword [ebp - 0x718]
lea ecx, [ebp - 0x728]
push ecx
mov ecx, dword [ebp - 0x708]
push 0
push 0
push 0
lea edx, [ebp - 0x70c]
push edx
lea eax, [ebp - 0x90]
push eax
push edi
push ecx
call dword [0x465090]
test eax, eax
je 0x425403
pop ebx
mov edx, dword [ebp - 0x708]
push edx
call dword [0x4650d0]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040506e
mov esp, ebp
pop ebp
ret