Function at 0x10018270
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x114], eax
push ebp
mov ebp, dword [esp + 0x120]
push esi
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 8], esi
mov dword [ebp], esi
call fcn.10019e80
cmp eax, 3
je 0x100182bd
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x118
ret
push ebx
push edi
lea eax, [esp + 0x14]
push eax
push 0x20019
push esi
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10018342
mov ebx, dword [esp + 0x14]
mov esi, ebp
mov edi, str.SearchList
call fcn.100176e0
mov ebx, dword [esp + 0x14]
lea esi, [esp + 0x10]
mov edi, str.Domain
call fcn.100176e0
test eax, eax
je 0x10018337
mov esi, dword [esp + 0x10]
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10018310
sub eax, edx
mov ebx, eax
push esi
mov eax, ebp
call fcn.10017a50
push esi
call dword [0x10138fdc]
add esp, 8
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
push str.SoftwarePoliciesMicrosoftWindows_NTDNSClient
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100183b3
mov ebx, dword [esp + 0x14]
lea esi, [esp + 0x10]
mov edi, str.SearchList
call fcn.100176e0
test eax, eax
je 0x100183a8
mov esi, dword [esp + 0x10]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10018381
sub eax, edx
mov ebx, eax
push esi
mov eax, ebp
call fcn.10017a50
push esi
call dword [0x10138fdc]
add esp, 8
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push str.SoftwarePoliciesMicrosoftSystemDNSClient
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10018424
mov ebx, dword [esp + 0x14]
lea esi, [esp + 0x10]
mov edi, str.PrimaryDNSSuffix
call fcn.100176e0
test eax, eax
je 0x10018419
mov esi, dword [esp + 0x10]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100183f2
sub eax, edx
mov ebx, eax
push esi
mov eax, ebp
call fcn.10017a50
push esi
call dword [0x10138fdc]
add esp, 8
mov dword [esp + 0x10], 0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParametersInterfaces
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100185b5
push eax
push eax
push eax
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x38]
push edx
push eax
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x40], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x100185aa
mov eax, dword [esp + 0x14]
add dword [esp + 0x1c], 1
lea ecx, [esp + 0x18]
push ecx
push 1
push 0
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10018578
mov ebx, dword [esp + 0x18]
lea esi, [esp + 0x10]
mov edi, str.SearchList
call fcn.100176e0
test eax, eax
je 0x100184de
mov esi, dword [esp + 0x10]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100184b7
sub eax, edx
mov ebx, eax
push esi
mov eax, ebp
call fcn.10017a50
push esi
call dword [0x10138fdc]
add esp, 8
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x18]
lea esi, [esp + 0x10]
mov edi, str.Domain
call fcn.100176e0
test eax, eax
je 0x10018527
mov esi, dword [esp + 0x10]
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10018500
sub eax, edx
mov ebx, eax
push esi
mov eax, ebp
call fcn.10017a50
push esi
call dword [0x10138fdc]
add esp, 8
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x18]
lea esi, [esp + 0x10]
mov edi, str.DhcpDomain
call fcn.100176e0
test eax, eax
je 0x1001856d
mov esi, dword [esp + 0x10]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10018546
sub eax, edx
mov ebx, eax
push esi
mov eax, ebp
call fcn.10017a50
push esi
call dword [0x10138fdc]
add esp, 8
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0
push 0
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x38]
push eax
push ecx
push edx
mov dword [esp + 0x40], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10018472
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x124]
pop edi
xor eax, eax
cmp dword [ebp], eax
pop ebx
pop esi
setne al
pop ebp
xor ecx, esp
call fcn.1001d3e9
add esp, 0x118
ret