Function at 0x4074b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x33c
mov eax, dword [0x43f2a8]
push ebx
push ebp
push esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov ebp, ecx
mov ecx, 0xc
mov esi, str.SYSTEMCurrentControlSetServicesTcpipParameters
lea edi, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x348], eax
lea eax, [esp + 0x2c]
push eax
push 0x20019
push 0
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x54]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x44], ebp
movsb byte es:[edi], byte [esi]
call ebx
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x406d1c
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x30]
lea eax, [ebp + 8]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.Domain
mov esi, pe_nt_image_headers32
push edx
mov dword [esp + 0x2c], esi
call edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [ebp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.Hostname
push eax
mov dword [esp + 0x2c], esi
call edi
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x30]
lea edx, [ebp + 0x28]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push str.IPEnableRouter
push ecx
mov dword [esp + 0x2c], esi
call edi
mov edx, dword [esp + 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
lea eax, [ebp + 0x1e70]
push eax
mov ecx, ebp
mov dword [esp + 0x20], 0
call fcn.00406b60
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 4], eax
call ebx
test eax, eax
je 0x406d82
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x406d69
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x338]
call fcn.00412f7c
add esp, 0x33c
ret
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0
push ecx
mov dword [esp + 0x58], 0
mov dword [esp + 0x64], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ebx, eax
test ebx, ebx
jne 0x4070ab
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
inc eax
push eax
mov dword [ebp + 4], edx
call fcn.0042310d
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
add esp, 4
test eax, eax
mov dword [esp + 0x3c], ebx
jle 0x40709e
mov esi, dword [esp + 0x30]
add ebp, 0x1e71
mov dword [esp + 0x38], ebp
add esi, 0x1b6
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
push 0
push 0
push 0
push 0
inc ecx
lea edx, [esp + 0x54]
push edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x58], ecx
mov ecx, dword [esp + 0x50]
push eax
push ecx
push edx
mov dword [esp + 0x38], 1
mov dword [esp + 0x30], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x40]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
jne 0x407035
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x44]
lea ebp, [esi - 0x80]
lea ecx, [ebp - 0x106]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push str.Description
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x14c]
push edx
lea eax, [esp + 0x20]
push eax
push ebx
push str.ServiceName
push ecx
mov dword [esp + 0x28], pe_nt_image_headers32
call edi
mov ebx, eax
test ebx, ebx
jne 0x407031
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x250]
push str._sInterfaces_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebx
lea eax, [esp + 0x254]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test ebx, ebx
jne 0x407026
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
push eax
push ebx
push str.EnableDHCP
push ecx
mov dword [esp + 0x28], pe_nt_image_headers32
call edi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push ebp
lea eax, [esp + 0x20]
push eax
push ebx
push str.DefaultGateway
push ecx
mov dword [esp + 0x28], pe_nt_image_headers32
call edi
mov edx, dword [esp + 0x10]
push edx
push ebp
mov ebp, dword [esp + 0x38]
mov ecx, ebp
call fcn.00406b10
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x1c], pe_nt_image_headers32
push ebx
je 0x406f7e
push str.DhcpIPAddress
jmp 0x406f83
push str.IPAddress
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
push esi
mov ecx, ebp
call fcn.00406b10
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x10]
push ecx
lea ebp, [esi + 0x80]
push ebp
lea edx, [esp + 0x20]
push edx
test eax, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], pe_nt_image_headers32
push 0
je 0x406fc1
push str.DhcpSubnetMask
jmp 0x406fc6
push str.SubnetMask
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x34]
push ebp
call fcn.00406b10
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x10], pe_nt_image_headers32
je 0x407007
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esi + 0x100]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.DhcpNameServer
push edx
jmp 0x407024
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esi + 0x100]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push str.NameServer
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x38]
mov edx, dword [esp + 0x40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
mov cl, byte [ebp]
mov dl, byte [ebp + 1]
mov byte [esi - 0x86], al
mov al, byte [ebp + 2]
mov byte [esi - 0x85], cl
mov cl, byte [ebp + 3]
mov byte [esi - 0x83], al
mov eax, dword [esp + 0x3c]
mov byte [esi - 0x84], dl
mov dl, byte [ebp + 4]
mov byte [esi - 0x82], cl
mov ecx, dword [esp + 0x28]
inc eax
mov byte [esi - 0x81], dl
add ebp, 6
add esi, 0x306
cmp eax, ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ebp
jl 0x406e00
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
push eax
call fcn.00423112
add esp, 4
mov ecx, dword [esp + 0x1c]
push ecx
call esi
mov ecx, dword [esp + 0x348]
pop edi
xor eax, eax
pop esi
test ebx, ebx
pop ebp
sete al
pop ebx
call fcn.00412f7c
add esp, 0x33c
ret
sub esp, 0x238
mov eax, dword [0x43f2a8]
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
push edi
mov dword [esp + 0x244], eax
lea eax, [esp + 0x20]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesVxDMSTCP
mov esi, ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x4c], esi
call ebp
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x40719e
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esi + 8]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.Domain
mov edi, pe_nt_image_headers32
push ecx
mov dword [esp + 0x28], edi
call ebx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esi + 0x18]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.Hostname
push edx
mov dword [esp + 0x28], edi
call ebx
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esi + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push str.EnableDNS
push eax
mov dword [esp + 0x28], edi
call ebx
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.NameServer
push ecx
mov dword [esp + 0x28], edi
call ebx
mov edx, dword [esp + 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
lea eax, [esi + 0x1e70]
push eax
mov ecx, esi
mov dword [esp + 0x20], 0
call fcn.00406b60
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push 0
push str.SystemCurrentControlSetServicesClassNet
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi + 4], eax
call ebp
test eax, eax
je 0x407204
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4071eb
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x234]
call fcn.00412f7c
add esp, 0x238
ret
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x5c]
push eax
push 0
push 0
push 0
push ecx
mov dword [esp + 0x70], 0
mov dword [esp + 0x54], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ebp, eax
test ebp, ebp
jne 0x407488
mov edx, dword [esp + 0x24]
inc edx
push edx
call fcn.0042310d
mov dword [esp + 0x30], eax
mov eax, dword [esi + 4]
add esp, 4
test eax, eax
mov dword [esp + 0x28], ebp
jle 0x407488
lea edi, [esi + 0x1e71]
mov eax, 0x286
lea ecx, [esp + 0x44]
add esi, 0x136
sub eax, ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], eax
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
push 0
push 0
push 0
push 0
inc edx
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x50], edx
mov edx, dword [esp + 0x3c]
push ecx
push edx
push eax
mov dword [esp + 0x34], 1
mov dword [esp + 0x30], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebp, eax
test ebp, ebp
jne 0x40743a
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push eax
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407308
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esi - 0x106]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push str.DriverDesc
push eax
call ebx
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
lea edx, [esp + 0x148]
push str.SystemCurrentControlSetServicesClassNetTrans_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x150]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, eax
test ebp, ebp
jne 0x40742f
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
push ebp
push str.DefaultGateway
mov edi, pe_nt_image_headers32
push ecx
mov dword [esp + 0x28], edi
call ebx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffffe
xor eax, eax
test ecx, ecx
jle 0x407390
cmp byte [esi + eax], 0
jne 0x40738b
mov byte [esi + eax], 0x2c
inc eax
cmp eax, ecx
jl 0x407381
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], edi
lea edi, [esi + 0x80]
push edi
lea eax, [esp + 0x1c]
push eax
push 0
push str.IPAddress
push ecx
call ebx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffffe
xor eax, eax
test ecx, ecx
jle 0x4073cf
cmp byte [eax + edi], 0
jne 0x4073ca
mov byte [eax + edi], 0x2c
inc eax
cmp eax, ecx
jl 0x4073c0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
lea edi, [esi + 0x100]
push edi
lea eax, [esp + 0x1c]
push eax
push 0
push str.IPMask
push ecx
mov dword [esp + 0x28], pe_nt_image_headers32
call ebx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffffe
xor eax, eax
test ecx, ecx
jle 0x407412
cmp byte [eax + edi], 0
jne 0x40740d
mov byte [eax + edi], 0x2c
inc eax
cmp eax, ecx
jl 0x407403
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x44]
lea edx, [edx + esi - 0x106]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x407421
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [edi - 1]
mov al, byte [edi + 1]
mov dl, byte [edi]
mov byte [esi - 4], al
mov al, byte [edi + 4]
mov byte [esi - 6], cl
mov cl, byte [edi + 2]
mov byte [esi - 5], dl
mov dl, byte [edi + 3]
mov byte [esi - 1], al
mov eax, dword [esp + 0x28]
mov byte [esi - 3], cl
mov ecx, dword [esp + 0x38]
mov byte [esi - 2], dl
mov edx, dword [ecx + 4]
inc eax
add edi, 6
add esi, 0x306
cmp eax, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], edi
jl 0x407285
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x1c]
push edx
call edi
mov ecx, dword [esp + 0x244]
pop edi
xor eax, eax
test ebp, ebp
pop esi
pop ebp
sete al
pop ebx
call fcn.00412f7c
add esp, 0x238
ret
push esi
mov esi, ecx
call fcn.00406a10
cmp eax, 2
mov dword [esi + 0x1e6c], eax
jne 0x4074cb
mov ecx, esi
pop esi
jmp 0x4070d0
cmp eax, 4
jne 0x4074d8
mov ecx, esi
pop esi
jmp 0x406c60
xor eax, eax
pop esi
ret