Function at 0x481be6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x58], 0
je 0x481c2f
mov dword [esp + 4], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x58]
mov dword [esp], eax
call fcn.00461239
test eax, eax
je 0x481c2f
mov dword [esp + 4], str.RvAresConstruct__init_winNT_:_Compiled_without_Platform_SDK
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x58]
mov dword [esp], eax
call fcn.0046161d
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetServicesTcpipParameters
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x481cac
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetServicesVxdMSTCP
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x481cac
mov dword [ebp - 0x134], 0
jmp 0x481ec2
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x128]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.NameServer
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x481cfb
cmp dword [ebp - 0x14], 1
jbe 0x481cfb
jmp 0x481d3c
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x128]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.DhcpNameServer
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x481e1b
cmp dword [ebp - 0x14], 1
jbe 0x481e1b
lea eax, [ebp - 0x128]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x130], 0
je 0x481e22
mov dword [esp + 4], 0x2c
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jne 0x481db6
mov dword [esp + 4], 0x20
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call sub.msvcrt.dll_strchr
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x481dd0
mov eax, dword [ebp - 0x130]
mov byte [eax], 0
lea eax, [ebp - 0x130]
inc dword [eax]
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00481fe4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x481e0a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x134], eax
jmp 0x481ec2
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x12c], eax
jmp 0x481d68
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x128]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Domain
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x481e71
cmp dword [ebp - 0x14], 1
jbe 0x481e71
jmp 0x481e8b
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [ebp - 0x134], 0
jmp 0x481ec2
mov dword [esp + 8], 0x7fffffff
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048213d
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
leave
ret