Function at 0x14004f650
Capabilities:
Get networking parameters
Query or enumerate registry value

Disassembly:
mov r11, rsp
push r13
sub rsp, 0x1e0
mov rax, qword [0x140177698]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov r13, qword [rsp + 0x210]
mov qword [r11 + 0x10], rbx
xor ebx, ebx
mov qword [r11 - 0x10], rbp
mov rbp, qword [rsp + 0x218]
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
movzx r12d, r8b
mov qword [r11 - 0x30], r14
mov r14, r9
mov qword [r11 - 0x38], r15
mov r15, rcx
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x80], rbp
test dl, dl
je 0x14004f826
mov ebp, ebx
mov esi, ebx
call fcn.14004b5b0
mov r14d, eax
mov edi, ebx
test eax, eax
je 0x14004f728
mov dword [rsp + 0x70], ebx
nop dword [rax]
nop word [rax + rax]
lea r8, [rsp + 0x70]
mov rdx, rbp
mov ecx, r14d
call sub.IPHLPAPI.DLL_GetPerAdapterInfo
cmp eax, 0x6f
jne 0x14004f71a
mov edx, dword [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rbp, rax
test rax, rax
je 0x14004f819
inc edi
cmp edi, 0x64
jl 0x14004f6e0
jmp 0x14004f7fd
test eax, eax
jne 0x14004f7fd
lea rdi, [rbp + 0x10]
jmp 0x14004f786
mov dword [rsp + 0x70], 0x258
test rsi, rsi
je 0x14004f73e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [rsp + 0x70]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14004f819
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.IPHLPAPI.DLL_GetNetworkParams
cmp eax, 0x6f
jne 0x14004f777
inc edi
cmp edi, 0x64
jl 0x14004f730
jmp 0x14004f80b
test eax, eax
jne 0x14004f80b
lea rdi, [rsi + 0x110]
test rdi, rdi
je 0x14004f7fd
nop dword [rax + rax]
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x88]
call fcn.14004cfd0
test eax, eax
jne 0x14004f7f5
movzx eax, word [0x14014fa10]
xor r9d, r9d
mov r8, qword [0x14014f9d8]
xor edx, edx
mov byte [rsp + 0x60], bl
mov rcx, r15
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x50], 1
mov word [rsp + 0x48], bx
mov byte [rsp + 0x40], bl
mov dword [rsp + 0x38], 0x1e
mov dword [rsp + 0x30], ebx
mov word [rsp + 0x28], ax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
call fcn.140060750
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14004f790
test rbp, rbp
je 0x14004f80b
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rsi, rsi
je 0x14004f819
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r14, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov r15, qword [rsp + 0x1b0]
test r12b, r12b
mov r12, qword [rsp + 0x1c0]
je 0x14004f97a
lea r8, [rsp + 0x78]
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParameters
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14004f960
mov rsi, qword [rsp + 0x78]
mov edi, ebx
mov dword [rsp + 0x70], 0x3f1
nop
test rbx, rbx
je 0x14004f87e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14004f960
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x80]
lea rdx, str.SearchList
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
inc edi
cmp eax, 0xea
jne 0x14004f8d1
cmp edi, 0x64
jl 0x14004f870
jmp 0x14004f957
test eax, eax
jne 0x14004f957
lea rdx, [0x14014f51c]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov rdx, rax
test rax, rax
je 0x14004f957
movzx ecx, byte [rdx]
cmp cl, byte [0x1400743d0]
je 0x14004f940
cmp cl, byte [0x14007c714]
jne 0x14004f910
movzx eax, byte [rdx + 1]
cmp al, byte [0x14007c715]
je 0x14004f940
test rdx, rdx
je 0x14004f940
lea rcx, [rsp + 0xa0]
call fcn.140054930
test rax, rax
je 0x14004f940
cmp byte [rsp + 0xa0], 0
je 0x14004f940
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140060c20
lea rdx, [0x14014f51c]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov rdx, rax
test rax, rax
jne 0x14004f8f1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14004f970
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14004ba80
call fcn.14004bf90
mov rdi, qword [rsp + 0x1c8]
mov rsi, qword [rsp + 0x1d0]
mov rbx, qword [rsp + 0x1f8]
test r14, r14
je 0x14004f99f
mov rcx, r14
call fcn.14004b470
mov r14, qword [rsp + 0x1b8]
test rbp, rbp
je 0x14004f9bb
lea rdx, str.SOFTWAREApple_Inc.BonjourDynDNSSetupBrowseDomains
mov rcx, rbp
call fcn.14004b1f0
mov rbp, qword [rsp + 0x1d8]
test r13, r13
je 0x14004f9d7
lea rdx, str.SOFTWAREApple_Inc.BonjourDynDNSSetupRegistrationDomains
mov rcx, r13
call fcn.14004b1f0
mov al, 1
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14006a270
add rsp, 0x1e0
pop r13
ret