Function at 0x10192170
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x10c], esi
mov dword [edi], ebx
call fcn.10196530
cmp eax, 3
jne 0x101924fa
lea eax, [ebp - 0x108]
push eax
push 0x20019
push ebx
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10192212
push edi
push str.SearchList
push dword [ebp - 0x108]
call fcn.101920d0
add esp, 0xc
test eax, eax
je 0x101921ec
push dword [edi]
call fcn.10192da0
add esp, 4
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi], ebx
je 0x10192212
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
push eax
push 0x20019
push 0
push str.SoftwarePoliciesMicrosoftSystemDNSClient
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10192254
push edi
push str.PrimaryDNSSuffix
push dword [ebp - 0x108]
call fcn.101920d0
add esp, 0xc
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi], ebx
je 0x101924fa
lea eax, [ebp - 0x108]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParametersInterfaces
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101924fa
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0x100
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x101924b3
lea eax, [ebp - 0x114]
inc esi
push eax
push 1
push 0
lea eax, [ebp - 0x104]
mov dword [ebp - 0x120], esi
push eax
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1019247e
lea eax, [ebp - 0x10c]
push eax
push str.SearchList
push dword [ebp - 0x114]
call fcn.101920d0
add esp, 0xc
test eax, eax
jne 0x1019233f
lea eax, [ebp - 0x10c]
push eax
push str.Domain
push dword [ebp - 0x114]
call fcn.101920d0
add esp, 0xc
test eax, eax
jne 0x1019233f
lea eax, [ebp - 0x10c]
push eax
push str.DhcpDomain
push dword [ebp - 0x114]
call fcn.101920d0
add esp, 0xc
test eax, eax
je 0x10192472
mov esi, dword [ebp - 0x10c]
jmp 0x10192355
mov esi, dword [ebp - 0x110]
jmp 0x10192355
mov edi, dword [ebp - 0x118]
mov al, byte [esi + ebx]
add esi, ebx
mov dword [ebp - 0x110], esi
test al, al
je 0x10192388
movzx eax, al
push eax
call fcn.100ec7b7
add esp, 4
test eax, eax
jne 0x1019237a
mov al, byte [esi]
cmp al, 0x2c
jne 0x10192382
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10192364
mov dword [ebp - 0x110], esi
mov ebx, esi
test al, al
je 0x101923ad
nop
movzx eax, al
push eax
call fcn.100ec7b7
add esp, 4
test eax, eax
jne 0x101923ad
cmp byte [ebx], 0x2c
je 0x101923ad
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x10192390
sub ebx, esi
je 0x10192453
cmp byte [esi], 0
mov edi, dword [edi]
je 0x1019234f
nop dword [eax]
mov al, byte [edi]
test al, al
je 0x10192437
movzx eax, al
push eax
call fcn.100ec7b7
add esp, 4
test eax, eax
jne 0x101923dc
mov al, byte [edi]
cmp al, 0x2c
jne 0x101923e4
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x101923c6
test al, al
je 0x10192437
mov al, byte [edi]
mov esi, edi
nop dword [eax]
movzx eax, al
push eax
call fcn.100ec7b7
add esp, 4
test eax, eax
jne 0x1019240d
cmp byte [esi], 0x2c
je 0x1019240d
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x101923f0
mov eax, esi
sub eax, edi
cmp ebx, eax
jne 0x10192433
push ebx
push dword [ebp - 0x110]
push edi
call fcn.100e5b4e
mov edi, dword [ebp - 0x118]
add esp, 0xc
test eax, eax
je 0x10192347
mov edi, esi
jmp 0x101923c0
mov esi, dword [ebp - 0x110]
mov edi, dword [ebp - 0x118]
push ebx
push esi
push edi
call fcn.10191800
add esp, 0xc
jmp 0x10192355
push dword [ebp - 0x10c]
call dword [0x1026eac4]
mov esi, dword [ebp - 0x120]
add esp, 4
mov dword [ebp - 0x10c], 0
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0x100
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x101922b4
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [edi]
test edx, edx
je 0x101924e2
mov eax, edx
mov cl, byte [eax]
test cl, cl
je 0x101924e2
nop dword [eax]
cmp cl, 0x2c
jne 0x101924d8
mov byte [eax], 0x20
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x101924d0
mov edx, dword [edi]
xor eax, eax
test edx, edx
pop edi
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
mov esp, ebp
pop ebp
ret