Function at 0x42f390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564abc
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x5d6c64]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318_
lea ecx, [ebp - 0x38]
call fcn.00404e60
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2b9]
mov dword [ebp - 0x2b8], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x2ec], eax
mov byte [ebp - 4], 2
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.00406660
mov byte [ebp - 4], 3
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 8]
call fcn.0041bc4c
pop ecx
pop ecx
mov dword [ebp - 0x3c], 0x40
and dword [ebp - 0x5c], 0
jmp 0x42f428
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x40
jge 0x42f7b5
xor eax, eax
mov word [ebp - 0x280], ax
xor eax, eax
lea edi, [ebp - 0x27e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push dword [ebp - 0x5c]
push str._04d
lea eax, [ebp - 0x280]
push eax
call fcn.00430d36
add esp, 0xc
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x29c]
push eax
call fcn.00412033
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x29c]
call fcn.004071e0
mov dword [ebp - 0x2c0], eax
push 0x2001f
push dword [ebp - 0x2c0]
push reloc.WS2_32.dll_bind
lea ecx, [ebp - 0x18]
call fcn.0042ff2b
test eax, eax
je 0x42f4c7
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x29c]
call fcn.00406660
mov byte [ebp - 4], 3
jmp 0x42f421
xor eax, eax
mov word [ebp - 0x264], ax
push 0x206
push 0
lea eax, [ebp - 0x262]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 0x268], 0x104
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x264]
push eax
push str.NetCfgInstanceId
lea ecx, [ebp - 0x18]
call fcn.0043005b
test eax, eax
je 0x42f54f
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x18], 0
je 0x42f52f
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2cc], eax
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
mov byte [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x29c]
call fcn.00406660
mov byte [ebp - 4], 3
jmp 0x42f421
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x58]
call fcn.00408940
neg eax
sbb eax, eax
inc eax
movzx eax, al
neg eax
sbb eax, eax
inc eax
movzx eax, al
test eax, eax
je 0x42f5b2
and dword [ebp - 0x2d0], 0
cmp dword [ebp - 0x18], 0
je 0x42f592
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2d0], eax
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
mov byte [ebp - 4], 7
push 0
push 1
lea ecx, [ebp - 0x29c]
call fcn.00406660
mov byte [ebp - 4], 3
jmp 0x42f421
and dword [ebp - 0x26c], 0
xor eax, eax
jne 0x42f5b9
xor eax, eax
jne 0x42f5b9
mov dword [ebp - 0x2d8], 4
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 0
push str.Characteristics
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0
je 0x42f60d
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x2e0], eax
jmp 0x42f629
cmp dword [ebp - 0x2d4], 4
je 0x42f622
mov dword [ebp - 0x2e0], 0xd
jmp 0x42f629
and dword [ebp - 0x2e0], 0
cmp dword [ebp - 0x2e0], 0
je 0x42f6b7
and dword [ebp - 0x2e4], 0
cmp dword [ebp - 0x18], 0
je 0x42f656
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2e4], eax
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
mov byte [ebp - 0x29d], 0
mov byte [ebp - 4], 8
push 0
push 1
lea ecx, [ebp - 0x29c]
call fcn.00406660
mov byte [ebp - 4], 3
mov byte [ebp - 4], 9
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00406660
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0xa
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.00406660
mov byte [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0042fef7
mov al, byte [ebp - 0x29d]
jmp 0x42f7e6
mov eax, dword [ebp - 0x26c]
and eax, 4
je 0x42f766
and dword [ebp - 0x2e8], 0
cmp dword [ebp - 0x18], 0
je 0x42f6e6
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2e8], eax
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
push 4
call fcn.0041b640
pop ecx
movzx eax, al
test eax, eax
je 0x42f711
mov ecx, dword [ebp + 8]
call fcn.00406480
push eax
push str.GetAdaptersInfo:_adapter__s__is_physical_adapter.
push 4
call fcn.0041b5a4
add esp, 0xc
mov byte [ebp - 0x29e], 1
mov byte [ebp - 4], 0xb
push 0
push 1
lea ecx, [ebp - 0x29c]
call fcn.00406660
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0xc
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00406660
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00404eb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0042fef7
mov al, byte [ebp - 0x29e]
jmp 0x42f7e6
lea ecx, [ebp - 0x18]
call fcn.0042fef7
mov byte [ebp - 0x29f], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x29c]
call fcn.00404eb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00404eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00404eb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0042fef7
mov al, byte [ebp - 0x29f]
jmp 0x42f7e6
mov byte [ebp - 0x2a0], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
call fcn.00404eb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.00404eb0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0042fef7
mov al, byte [ebp - 0x2a0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004610a0
leave
ret