Function at 0x100d7a10
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x34]
sub esp, 0x34
push 0xffffffffffffffff
push 0x1024f5e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
lea eax, [ebp + 0x2c]
mov dword [ebp + 0x20], ecx
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.WS2_32.dll_bind
mov dword [ebp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d7dcf
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x18]
push eax
push 0
push 0
push 0
push dword [ebp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x100d7dc6
mov eax, dword [ebp + 0x28]
cmp eax, 0x400
ja 0x100d7dc6
mov ecx, dword [ebp + 0x18]
cmp ecx, 0x400
ja 0x100d7dc6
push esi
xor esi, esi
mov dword [ebp + 0x1c], esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ecx, ecx
je 0x100d7dae
push ebx
mov edx, 2
xor ecx, ecx
add eax, edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006e70d
mov ecx, dword [ebp + 0x28]
add esp, 4
inc ecx
mov ebx, eax
push ecx
push ebx
push esi
push dword [ebp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x100d7d93
mov eax, dword [ebp + 0x28]
xor ecx, ecx
mov word [ebx + eax*2 + 2], cx
lea eax, [ebp + 0x24]
push eax
push 0x20019
push ecx
push ebx
push dword [ebp + 0x2c]
mov dword [ebp + 0x24], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d7d93
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 7
mov word [ebp - 0x54], ax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
push str.ServiceName
lea ecx, [ebp]
mov dword [ebp - 4], eax
call fcn.1001a2f0
mov ecx, dword [ebp + 0x20]
lea eax, [ebp]
push eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x70]
push dword [ebp + 0x24]
push eax
call sym.WMCommon.dll_private:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_WM::GMNetworkAdapter::ReadRegString_struct_HKEY_____class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
push eax
lea ecx, [ebp - 0x54]
call fcn.1001a270
lea ecx, [ebp - 0x70]
call fcn.1001a5a0
lea ecx, [ebp]
mov byte [ebp - 4], 0
call fcn.1001a5a0
push str.Description
lea ecx, [ebp]
call fcn.1001a2f0
mov ecx, dword [ebp + 0x20]
lea eax, [ebp]
push eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x70]
push dword [ebp + 0x24]
push eax
call sym.WMCommon.dll_private:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_WM::GMNetworkAdapter::ReadRegString_struct_HKEY_____class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
push eax
lea ecx, [ebp - 0x3c]
call fcn.1001a270
lea ecx, [ebp - 0x70]
call fcn.1001a5a0
lea ecx, [ebp]
mov byte [ebp - 4], 0
call fcn.1001a5a0
cmp dword [ebp - 0x44], 0
je 0x100d7d18
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_
lea ecx, [ebp]
call fcn.1001a2f0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x54]
cmp dword [ebp - 0x40], 8
lea ecx, [ebp]
push dword [ebp - 0x44]
cmovae eax, dword [ebp - 0x54]
push eax
call fcn.1001a7c0
push 0xb
push str.Connection
lea ecx, [ebp]
call fcn.1001a7c0
cmp dword [ebp + 0x14], 8
lea ecx, [ebp + 0x30]
push ecx
push 0x20019
lea eax, [ebp]
mov dword [ebp + 0x30], 0
cmovae eax, dword [ebp]
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d7c95
push 0x10267b28
lea ecx, [ebp - 0x88]
call fcn.1001a2f0
mov ecx, dword [ebp + 0x20]
lea eax, [ebp - 0x88]
push eax
mov byte [ebp - 4], 4
lea eax, [ebp - 0xa0]
push dword [ebp + 0x30]
push eax
call sym.WMCommon.dll_private:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_WM::GMNetworkAdapter::ReadRegString_struct_HKEY_____class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__
push eax
lea ecx, [ebp - 0x24]
call fcn.1001a270
lea ecx, [ebp - 0xa0]
call fcn.1001a5a0
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.1001a5a0
push dword [ebp + 0x30]
call edi
mov dword [ebp + 0x30], 0
cmp dword [ebp - 0x14], 0
je 0x100d7d0c
push 0x3e
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
lea ecx, [ebp]
call fcn.1001a600
cmp dword [ebp - 0x40], 8
lea eax, [ebp - 0x54]
push dword [ebp - 0x44]
cmovae eax, dword [ebp - 0x54]
lea ecx, [ebp]
push eax
call fcn.1001a7c0
cmp dword [ebp + 0x14], 8
lea ecx, [ebp + 0x30]
push ecx
push 0x20019
lea eax, [ebp]
cmovae eax, dword [ebp]
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d7cf5
push dword [ebp + 0x30]
call edi
mov dword [ebp + 0x30], 0
jmp 0x100d7d0c
cmp dword [ebp - 0x10], 8
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], 0
cmovae eax, dword [ebp - 0x24]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp]
mov byte [ebp - 4], 0
call fcn.1001a5a0
push dword [ebp + 0x24]
call edi
cmp dword [ebp - 0x14], 0
je 0x100d7d74
mov edi, dword [ebp + 0x20]
lea eax, [ebp - 0x54]
push eax
mov esi, dword [edi + 0x1c]
cmp dword [edi + 0x20], esi
je 0x100d7d62
mov ecx, esi
mov dword [ebp - 0x58], esi
call fcn.1001a380
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 5
lea ecx, [esi + 0x18]
push eax
call fcn.1001a380
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 6
lea ecx, [esi + 0x30]
push eax
call fcn.1001a380
add dword [edi + 0x1c], 0x48
jmp 0x100d7d6b
push esi
lea ecx, [edi + 0x18]
call fcn.10048850
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 0x1c]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.1001a5a0
lea ecx, [ebp - 0x3c]
call fcn.1001a5a0
lea ecx, [ebp - 0x54]
call fcn.1001a5a0
push ebx
call fcn.1006e708
inc esi
add esp, 4
mov dword [ebp + 0x1c], esi
cmp esi, dword [ebp + 0x18]
jae 0x100d7dad
mov eax, dword [ebp + 0x28]
jmp 0x100d7abe
pop ebx
push dword [ebp + 0x2c]
call edi
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
lea esp, [ebp + 0x34]
pop ebp
ret
push dword [ebp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor al, al
mov dword fs:[0], ecx
lea esp, [ebp + 0x34]
pop ebp
ret