Function at 0x103bd79
Capabilities:
Get domain information
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x10723e4]
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x660]
push eax
xor ebx, ebx
push 1
push ebx
mov dword [ebp - 0x658], ebx
mov dword [ebp - 0x668], ebx
call sub.NETAPI32.dll_DsRoleGetPrimaryDomainInformation
test eax, eax
jne 0x103bfcf
mov eax, dword [ebp - 0x660]
mov eax, dword [eax]
push esi
push edi
push 4
pop esi
cmp eax, esi
je 0x103bdcc
cmp eax, 5
jne 0x103bf42
push 0x1014a70
push ebx
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, eax
cmp edi, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
je 0x103bdf6
push dword [ebp + 8]
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x660]
cmp dword [eax], 5
jne 0x103bf42
lea eax, [ebp - 0x65c]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1014a00
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103bf4c
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x670]
push eax
push edi
mov dword [ebp - 0x664], edi
mov edi, 0x10149e8
push edi
push dword [ebp - 0x65c]
mov dword [ebp - 0x66c], esi
mov dword [ebp - 0x670], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
xor ecx, ecx
cmp eax, ecx
jne 0x103bf22
cmp dword [ebp - 0x664], ecx
jne 0x103bf31
push 0x10149c4
push ecx
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [ebp - 0x674], eax
je 0x103bf31
push 1
push eax
push 4
push 0
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
jne 0x103bf14
mov eax, dword [ebp + 8]
push 3
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0x678], eax
push dword [ebp - 0x678]
push dword [ebp - 0x674]
call ebx
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x670]
push eax
push 0
push edi
push dword [ebp - 0x65c]
call esi
cmp dword [ebp - 0x664], 0
jne 0x103bf0a
inc dword [ebp - 0x668]
cmp dword [ebp - 0x668], 3
jb 0x103bec2
jmp 0x103bf14
mov dword [ebp - 0x658], 1
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x103bf31
cmp eax, 2
jne 0x103bf31
mov dword [ebp - 0x658], 1
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
pop esi
jmp 0x103bf4c
mov dword [ebp - 0x658], 1
mov ecx, dword [ebp - 0x660]
mov eax, dword [ecx]
cmp eax, esi
je 0x103bf5d
cmp eax, 5
jne 0x103bfc2
push dword [ecx + 0xc]
lea eax, [ebp - 0x404]
push 0x10149a4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0xb4
push 0x1014978
push 0x1010fcc
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetProfileIntW]
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
jmp 0x103bfa6
inc edi
cmp edi, ebx
ja 0x103bfc2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x404]
push eax
call esi
cmp eax, 0xffffffff
je 0x103bf96
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x660]
call sub.NETAPI32.dll_DsRoleFreeMemory
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x658]
pop ebx
call fcn.0103d24a
leave
ret 4