Function at 0x1801ca570
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x180428208]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor r14d, r14d
mov rbx, rcx
mov r15d, r14d
mov qword [rsp + 0x50], r14
mov qword [rcx], r14
call fcn.180238ef0
cmp eax, 3
je 0x1801ca5b6
xor eax, eax
jmp 0x1801cacd7
lea rax, [rsp + 0x48]
mov qword [rsp + 0x1a8], rsi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x1b0], rdi
lea rdx, str.SystemCurrentControlSetServicesTcpipParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1801ca6bb
mov rcx, qword [rsp + 0x48]
lea rdx, str.SearchList
mov r8, rbx
call fcn.1801c9ee0
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, str.Domain
call fcn.1801c9ee0
test eax, eax
je 0x1801ca6b0
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call fcn.1801c9870
mov rcx, qword [rbx]
mov rsi, rax
test rcx, rcx
je 0x1801ca64a
call fcn.1801c9870
add rax, 2
jmp 0x1801ca64f
mov eax, 1
mov rcx, qword [rbx]
lea rdx, [rax + rsi]
call qword [0x180428638]
test rax, rax
je 0x1801ca6a2
cmp qword [rbx], r14
jne 0x1801ca669
mov byte [rax], r14b
mov rcx, rax
mov qword [rbx], rax
call fcn.1801c9870
test rax, rax
je 0x1801ca694
mov rdx, qword [rbx]
dec rdx
nop
cmp byte [rdx + 1], r14b
lea rdx, [rdx + 1]
jne 0x1801ca680
movzx eax, word [0x1803c7c48]
mov word [rdx], ax
mov rcx, qword [rbx]
mov r8, rsi
mov rdx, rdi
call fcn.1802a2bb0
mov rcx, rdi
call qword [fcn.1800a58b0]
mov qword [rsp + 0x50], r14
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwarePoliciesMicrosoftWindows_NTDNSClient
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1801ca79b
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, str.SearchList
call fcn.1801c9ee0
test eax, eax
je 0x1801ca790
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call fcn.1801c9870
mov rcx, qword [rbx]
mov rsi, rax
test rcx, rcx
je 0x1801ca72b
call fcn.1801c9870
add rax, 2
jmp 0x1801ca730
mov eax, 1
mov rcx, qword [rbx]
lea rdx, [rax + rsi]
call qword [0x180428638]
test rax, rax
je 0x1801ca782
cmp qword [rbx], r14
jne 0x1801ca74a
mov byte [rax], r14b
mov rcx, rax
mov qword [rbx], rax
call fcn.1801c9870
test rax, rax
je 0x1801ca774
mov rdx, qword [rbx]
dec rdx
cmp byte [rdx + 1], r14b
lea rdx, [rdx + 1]
jne 0x1801ca760
movzx eax, word [0x1803c7c48]
mov word [rdx], ax
mov rcx, qword [rbx]
mov r8, rsi
mov rdx, rdi
call fcn.1802a2bb0
mov rcx, rdi
call qword [fcn.1800a58b0]
mov qword [rsp + 0x50], r14
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwarePoliciesMicrosoftSystemDNSClient
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1801ca876
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, str.PrimaryDNSSuffix
call fcn.1801c9ee0
test eax, eax
je 0x1801ca86b
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call fcn.1801c9870
mov rcx, qword [rbx]
mov rsi, rax
test rcx, rcx
je 0x1801ca80b
call fcn.1801c9870
add rax, 2
jmp 0x1801ca810
mov eax, 1
mov rcx, qword [rbx]
lea rdx, [rax + rsi]
call qword [0x180428638]
test rax, rax
je 0x1801ca862
cmp qword [rbx], r14
jne 0x1801ca82a
mov byte [rax], r14b
mov rcx, rax
mov qword [rbx], rax
call fcn.1801c9870
test rax, rax
je 0x1801ca854
mov rdx, qword [rbx]
dec rdx
cmp byte [rdx + 1], r14b
lea rdx, [rdx + 1]
jne 0x1801ca840
movzx eax, word [0x1803c7c48]
mov word [rdx], ax
mov rcx, qword [rbx]
mov r8, rsi
mov rdx, rdi
call fcn.1802a2bb0
mov rcx, rdi
call qword [fcn.1800a58b0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetServicesTcpipParametersInterfaces
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1801cacbd
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1801cacb2
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x60]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x70]
inc r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1801cac76
mov rsi, qword [rsp + 0x60]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.SearchList
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rsp + 0x40], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1801ca94c
cmp eax, 0xea
jne 0x1801caa2b
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1801caa2b
lea ecx, [rax + 1]
call qword [0x180428630]
mov rdi, rax
test rax, rax
je 0x1801caa2b
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.SearchList
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1801caa22
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x1801caa22
mov rcx, rdi
mov byte [rax + rdi], r14b
call fcn.1801c9870
mov rcx, qword [rbx]
mov rsi, rax
test rcx, rcx
je 0x1801ca9c9
call fcn.1801c9870
add rax, 2
jmp 0x1801ca9ce
mov eax, 1
mov rcx, qword [rbx]
lea rdx, [rax + rsi]
call qword [0x180428638]
test rax, rax
je 0x1801caa22
cmp qword [rbx], r14
jne 0x1801ca9e8
mov byte [rax], r14b
mov rcx, rax
mov qword [rbx], rax
call fcn.1801c9870
test rax, rax
je 0x1801caa14
mov rdx, qword [rbx]
dec rdx
nop
cmp byte [rdx + 1], r14b
lea rdx, [rdx + 1]
jne 0x1801caa00
movzx eax, word [0x1803c7c48]
mov word [rdx], ax
mov rcx, qword [rbx]
mov r8, rsi
mov rdx, rdi
call fcn.1802a2bb0
mov rcx, rdi
call qword [fcn.1800a58b0]
mov rsi, qword [rsp + 0x60]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.Domain
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rsp + 0x40], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1801caa69
cmp eax, 0xea
jne 0x1801cab4b
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1801cab4b
lea ecx, [rax + 1]
call qword [0x180428630]
mov rdi, rax
test rax, rax
je 0x1801cab4b
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.Domain
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1801cab42
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x1801cab42
mov rcx, rdi
mov byte [rax + rdi], r14b
call fcn.1801c9870
mov rcx, qword [rbx]
mov rsi, rax
test rcx, rcx
je 0x1801caae6
call fcn.1801c9870
add rax, 2
jmp 0x1801caaeb
mov eax, 1
mov rcx, qword [rbx]
lea rdx, [rax + rsi]
call qword [0x180428638]
test rax, rax
je 0x1801cab42
cmp qword [rbx], r14
jne 0x1801cab05
mov byte [rax], r14b
mov rcx, rax
mov qword [rbx], rax
call fcn.1801c9870
test rax, rax
je 0x1801cab34
mov rdx, qword [rbx]
dec rdx
nop dword [rax + rax]
cmp byte [rdx + 1], r14b
lea rdx, [rdx + 1]
jne 0x1801cab20
movzx eax, word [0x1803c7c48]
mov word [rdx], ax
mov rcx, qword [rbx]
mov r8, rsi
mov rdx, rdi
call fcn.1802a2bb0
mov rcx, rdi
call qword [fcn.1800a58b0]
mov rsi, qword [rsp + 0x60]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.DhcpDomain
mov rcx, rsi
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov dword [rsp + 0x40], r14d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1801cab89
cmp eax, 0xea
jne 0x1801cac6b
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1801cac6b
lea ecx, [rax + 1]
call qword [0x180428630]
mov rdi, rax
test rax, rax
je 0x1801cac6b
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.DhcpDomain
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1801cac62
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x1801cac62
mov rcx, rdi
mov byte [rax + rdi], r14b
call fcn.1801c9870
mov rcx, qword [rbx]
mov rsi, rax
test rcx, rcx
je 0x1801cac06
call fcn.1801c9870
add rax, 2
jmp 0x1801cac0b
mov eax, 1
mov rcx, qword [rbx]
lea rdx, [rax + rsi]
call qword [0x180428638]
test rax, rax
je 0x1801cac62
cmp qword [rbx], r14
jne 0x1801cac25
mov byte [rax], r14b
mov rcx, rax
mov qword [rbx], rax
call fcn.1801c9870
test rax, rax
je 0x1801cac54
mov rdx, qword [rbx]
dec rdx
nop dword [rax + rax]
cmp byte [rdx + 1], r14b
lea rdx, [rdx + 1]
jne 0x1801cac40
movzx eax, word [0x1803c7c48]
mov word [rdx], ax
mov rcx, qword [rbx]
mov r8, rsi
mov rdx, rdi
call fcn.1802a2bb0
mov rcx, rdi
call qword [fcn.1800a58b0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x70]
mov qword [rsp + 0x30], r14
mov edx, r15d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1801ca8e0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbx], r14
mov rdi, qword [rsp + 0x1b0]
mov rsi, qword [rsp + 0x1a8]
setne r14b
mov eax, r14d
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1800a5910
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x180
pop r15
pop r14
pop rbp
ret