Function at 0x103cb33
Capabilities:
Get domain information
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x107342c]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x660]
push eax
xor ebx, ebx
push 1
push ebx
mov dword [ebp - 0x658], ebx
mov dword [ebp - 0x668], ebx
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
test eax, eax
jne 0x103cd89
mov eax, dword [ebp - 0x660]
mov eax, dword [eax]
push esi
push edi
push 4
pop esi
cmp eax, esi
je 0x103cb86
cmp eax, 5
jne 0x103ccfc
push 0x1014d90
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, eax
cmp edi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
je 0x103cbb0
push dword [ebp + 8]
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x660]
cmp dword [eax], 5
jne 0x103ccfc
lea eax, [ebp - 0x65c]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1014d20
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103cd06
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x670]
push eax
push edi
mov dword [ebp - 0x664], edi
mov edi, 0x1014d08
push edi
push dword [ebp - 0x65c]
mov dword [ebp - 0x66c], esi
mov dword [ebp - 0x670], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
xor ecx, ecx
cmp eax, ecx
jne 0x103ccdc
cmp dword [ebp - 0x664], ecx
jne 0x103cceb
push 0x1014ce4
push ecx
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [ebp - 0x674], eax
je 0x103cceb
push 1
push eax
push 4
push 0
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
jne 0x103ccce
mov eax, dword [ebp + 8]
push 3
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0x678], eax
push dword [ebp - 0x678]
push dword [ebp - 0x674]
call ebx
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x670]
push eax
push 0
push edi
push dword [ebp - 0x65c]
call esi
cmp dword [ebp - 0x664], 0
jne 0x103ccc4
inc dword [ebp - 0x668]
cmp dword [ebp - 0x668], 3
jb 0x103cc7c
jmp 0x103ccce
mov dword [ebp - 0x658], 1
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x103cceb
cmp eax, 2
jne 0x103cceb
mov dword [ebp - 0x658], 1
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
pop esi
jmp 0x103cd06
mov dword [ebp - 0x658], 1
mov ecx, dword [ebp - 0x660]
mov eax, dword [ecx]
cmp eax, esi
je 0x103cd17
cmp eax, 5
jne 0x103cd7c
push dword [ecx + 0xc]
lea eax, [ebp - 0x404]
push 0x1014cc4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0xb4
push 0x1014c98
push 0x101128c
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
jmp 0x103cd60
inc edi
cmp edi, ebx
ja 0x103cd7c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x404]
push eax
call esi
cmp eax, 0xffffffff
je 0x103cd50
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x660]
call sub.NETAPI32.dll_DsRoleFreeMemory
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x658]
pop ebx
call fcn.0103e4d8
leave
ret 4