Function at 0x100406320
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x478
xor ebx, ebx
mov esi, ecx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [0x10043f028], eax
test eax, eax
jns 0x100406368
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
add rsp, 0x478
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0xc0]
mov r9, qword [0x10042dba0]
mov r8d, 0x17
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, qword [0x10042db90]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [0x10043f028], eax
test eax, eax
js 0x100406349
mov rcx, qword [rsp + 0xc0]
lea r8, [rsp + 0xc8]
mov edx, 3
mov rax, qword [rcx]
call qword [rax + 0x38]
mov dword [0x10043f028], eax
test eax, eax
js 0x100406525
mov ecx, esi
mov r12d, 1
lea rbp, [rsp + 0xd0]
mov r14, qword [sym.imp.OLEAUT32.dll_SysFreeString]
xor ecx, 1
mov r13d, r12d
movzx edi, cl
mov ebx, edi
mov rdi, rbp
nop dword [rax]
lea rsi, [rsp + 0xb0]
lea r12, [rsp + 0xb2]
mov rcx, qword [rsp + 0xc8]
xor r9d, r9d
mov r8, rdi
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x40]
mov dword [0x10043f028], eax
test eax, eax
js 0x100406586
jne 0x100406590
mov rcx, qword [rsp + 0xd0]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
mov rcx, qword [rsp + 0xd0]
test eax, eax
mov dword [0x10043f028], eax
mov rax, qword [rcx]
js 0x100406583
mov rdx, r12
call qword [rax + 0x78]
mov rcx, qword [rsp + 0xd0]
mov dword [0x10043f028], eax
test eax, eax
js 0x100406580
mov rax, qword [rcx]
lea rdx, [rsp + 0x100]
call qword [rax + 0x58]
mov rcx, qword [rsp + 0xd0]
mov dword [0x10043f028], eax
test eax, eax
js 0x100406580
mov rax, qword [rcx]
lea rdx, [rsp + 0xb4]
call qword [rax + 0x90]
mov rcx, qword [rsp + 0xd0]
mov dword [0x10043f028], eax
test eax, eax
js 0x100406580
mov rax, qword [rcx]
lea rdx, [rsp + 0xe8]
call qword [rax + 0x38]
mov dword [0x10043f028], eax
test eax, eax
js 0x100406570
xor eax, eax
mov rcx, qword [rsp + 0xe8]
cmp word [rsp + 0xb0], 0
setne al
cmp eax, r13d
je 0x1004065b0
call r14
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x100406400
mov ebx, 1
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x100406349
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
call rbx
test eax, eax
jle 0x100406740
call rbx
movzx eax, ax
or eax, 0x80070000
mov dword [0x10043f028], eax
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.OLEAUT32.dll_SysFreeString]
nop
mov rcx, qword [rsp + 0xd0]
nop dword [rax + rax]
mov rax, qword [rcx]
call qword [rax + 0x10]
xor ebx, ebx
jmp 0x100406517
mov rcx, qword [rsp + 0xc8]
mov rax, qword [rcx]
call qword [rax + 0x50]
cmp r13d, ebx
jle 0x100406512
xor r13d, r13d
jmp 0x1004063f0
lea rbp, [rsp + 0x170]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x20], rbp
mov r9d, 0xffffffff
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x100406540
mov rdx, rbp
lea rcx, str.Name____:__s
call sub.cygwin1.dll_printf
cmp word [rsp + 0xb0], 0
jne 0x100406758
cmp word [rsp + 0xb2], 0
jne 0x100406747
mov eax, dword [rsp + 0xb4]
lea rdx, str.public
test eax, eax
je 0x100406655
lea rdx, str.private
cmp eax, 1
je 0x100406655
cmp eax, 2
lea rdx, [0x10042459c]
lea rax, str.domain
cmove rdx, rax
lea rcx, str.___s__n
call sub.cygwin1.dll_printf
movzx eax, byte [rsp + 0x10f]
mov edx, 0x25
mov rcx, rbp
mov r9d, dword [rsp + 0x100]
lea r8, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
mov dword [rsp + 0x68], eax
movzx eax, byte [rsp + 0x10e]
mov dword [rsp + 0x60], eax
movzx eax, byte [rsp + 0x10d]
mov dword [rsp + 0x58], eax
movzx eax, byte [rsp + 0x10c]
mov dword [rsp + 0x50], eax
movzx eax, byte [rsp + 0x10b]
mov dword [rsp + 0x48], eax
movzx eax, byte [rsp + 0x10a]
mov dword [rsp + 0x40], eax
movzx eax, byte [rsp + 0x109]
mov dword [rsp + 0x38], eax
movzx eax, byte [rsp + 0x108]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x106]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x104]
mov dword [rsp + 0x20], eax
call sub.cygwin1.dll_snprintf
mov rdx, rbp
lea rcx, str.NetID___:__s_n
call sub.cygwin1.dll_printf
test r13d, r13d
je 0x100406729
mov rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0xe0]
mov rax, qword [rcx]
call qword [rax + 0x68]
mov dword [0x10043f028], eax
test eax, eax
jns 0x100406769
mov ecx, 0xa
call sub.cygwin1.dll_putchar
mov rcx, qword [rsp + 0xe8]
jmp 0x1004064fc
call rbx
jmp 0x10040655b
lea rcx, str.__inet_
call sub.cygwin1.dll_printf
jmp 0x100406622
lea rcx, str.__connected_
call sub.cygwin1.dll_printf
jmp 0x100406613
lea rax, [rsp + 0xd8]
mov dword [rsp + 0x88], r13d
mov r15, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x8c], ebx
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], r12
jmp 0x1004067be
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xe0]
mov r8, qword [rsp + 0x78]
xor r9d, r9d
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x40]
mov dword [0x10043f028], eax
test eax, eax
jne 0x100406ae9
mov rcx, qword [rsp + 0xd8]
lea rdx, [rsp + 0x110]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov dword [0x10043f028], eax
test eax, eax
js 0x1004067b0
movzx eax, byte [rsp + 0x11f]
mov r9d, dword [rsp + 0x110]
lea r8, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
mov edx, 0x25
mov rcx, qword [rsp + 0x80]
mov dword [rsp + 0x68], eax
movzx eax, byte [rsp + 0x11e]
mov dword [rsp + 0x60], eax
movzx eax, byte [rsp + 0x11d]
mov dword [rsp + 0x58], eax
movzx eax, byte [rsp + 0x11c]
mov dword [rsp + 0x50], eax
movzx eax, byte [rsp + 0x11b]
mov dword [rsp + 0x48], eax
movzx eax, byte [rsp + 0x11a]
mov dword [rsp + 0x40], eax
movzx eax, byte [rsp + 0x119]
mov dword [rsp + 0x38], eax
movzx eax, byte [rsp + 0x118]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x116]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x114]
mov dword [rsp + 0x20], eax
call sub.cygwin1.dll_snprintf
lea rax, [rsp + 0xf0]
xor r8d, r8d
mov r9d, 8
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
mov rcx, 0xffffffff80000002
call r15
mov dword [0x10043f028], eax
mov ebp, eax
test eax, eax
je 0x1004068ec
mov rdx, qword [rsp + 0x80]
lea rcx, str.Adapter_:__s_n
call sub.cygwin1.dll_printf
jmp 0x1004067b0
movzx eax, byte [rsp + 0x11f]
mov r9d, dword [rsp + 0x110]
lea rcx, [rsp + 0x141]
lea r8, str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
mov edx, 0x25
lea rsi, [rsp + 0xb8]
lea rbx, [rsp + 0x120]
mov dword [rsp + 0x68], eax
movzx eax, byte [rsp + 0x11e]
lea r12, [rsp + 0xf8]
mov dword [rsp + 0x60], eax
movzx eax, byte [rsp + 0x11d]
mov dword [rsp + 0x58], eax
movzx eax, byte [rsp + 0x11c]
mov dword [rsp + 0x50], eax
movzx eax, byte [rsp + 0x11b]
mov dword [rsp + 0x48], eax
movzx eax, byte [rsp + 0x11a]
mov dword [rsp + 0x40], eax
movzx eax, byte [rsp + 0x119]
mov dword [rsp + 0x38], eax
movzx eax, byte [rsp + 0x118]
mov dword [rsp + 0x30], eax
movzx eax, word [rsp + 0x116]
mov dword [rsp + 0x28], eax
movzx eax, word [rsp + 0x114]
mov dword [rsp + 0x20], eax
call sub.cygwin1.dll_snprintf
mov ecx, 0x7d
mov byte [rsp + 0x140], 0x7b
mov rdi, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov word [rsp + 0x165], cx
jmp 0x1004069c3
add ebp, 1
mov dword [rsp + 0xb8], 0x1f
mov r9, rsi
mov r8, rbx
mov edx, ebp
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
mov dword [0x10043f028], eax
test eax, eax
jne 0x100406ad6
mov eax, dword [rsp + 0xb8]
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0xf0]
mov byte [rsp + rax + 0x120], 0
mov qword [rsp + 0x20], r12
call r15
mov dword [0x10043f028], eax
test eax, eax
jne 0x1004069c0
lea r13, [rsp + 0x270]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x20], r13
xor r8d, r8d
lea rdx, str.ServiceName
mov dword [rsp + 0xb8], 0xff
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x10043f028], eax
test eax, eax
jne 0x100406ac3
mov eax, dword [rsp + 0xb8]
mov rcx, r13
lea rdx, [rsp + 0x140]
mov byte [rsp + rax + 0x270], 0
call sub.cygwin1.dll_strcmp
mov rcx, qword [rsp + 0xf8]
test eax, eax
je 0x100406b23
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1004069c0
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1004069c0
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1004068d3
mov rcx, qword [rsp + 0xe0]
mov r13d, dword [rsp + 0x88]
mov ebx, dword [rsp + 0x8c]
mov rdi, qword [rsp + 0x90]
mov rax, qword [rcx]
mov rsi, qword [rsp + 0x98]
mov r12, qword [rsp + 0xa0]
call qword [rax + 0x10]
jmp 0x100406729
lea rax, [rsp + 0xbc]
xor r9d, r9d
lea rdx, str.Description
xor r8d, r8d
lea r13, [rsp + 0x370]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0xbc], 0xfe
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [0x10043f028], eax
test eax, eax
jne 0x100406ac3
xor edx, edx
mov r9d, 0xffffffff
mov r8, r13
mov ecx, 0xfde9
mov eax, dword [rsp + 0xbc]
lea r10, [rsp + 0x1f0]
mov qword [rsp + 0xa8], r10
shr eax, 1
mov word [rsp + rax*2 + 0x370], dx
xor edx, edx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x100406ac3
mov r13, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, qword [rsp + 0x80]
mov rdx, r13
lea rcx, str.Adapter_:__s___s__n
call sub.cygwin1.dll_printf
jmp 0x1004067b0