Function at 0x10063f50
Capabilities:
Get mac address on windows
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x530
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
push esi
push edi
lea ecx, [ebp - 0x518]
xor edi, edi
push ecx
push edi
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x518], edi
call ebx
mov edx, dword [ebp - 0x518]
push edx
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
add esp, 4
lea eax, [ebp - 0x518]
push eax
push esi
mov dword [ebp - 0x52c], esi
call ebx
cmp esi, edi
je 0x100641e0
movzx ecx, byte [esi + 0x199]
movzx edx, byte [esi + 0x198]
movzx eax, byte [esi + 0x197]
push ecx
movzx ecx, byte [esi + 0x196]
push edx
movzx edx, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push ecx
mov ecx, dword [ebp - 0x530]
push edx
push eax
push str.msc_mac_02x:_02x:_02x:_02x:_02x:_02x
push 0x40
push ecx
call fcn.1005f880
lea eax, [esi + 8]
add esp, 0x24
mov dword [ebp - 0x510], edi
mov dword [ebp - 0x514], edi
mov dword [ebp - 0x524], edi
mov dword [ebp - 0x50c], edi
mov dword [ebp - 0x520], edi
mov dword [ebp - 0x51c], 0x104
mov dword [ebp - 0x528], edi
cmp eax, edi
je 0x100641d6
cmp byte [eax], 0
je 0x100641d6
lea edx, [ebp - 0x510]
push edx
push 0x20019
push edi
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100641d6
mov ecx, dword [ebp - 0x510]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x514]
push eax
push edi
push edi
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1006408a
mov dword [ebp - 0x514], 0x64
xor ebx, ebx
cmp dword [ebp - 0x514], edi
jbe 0x100641b4
jmp 0x100640a0
push 0x400
lea edx, [ebp - 0x508]
push edi
push edx
call sub.MSVCR100.dll_memset
push ebx
push str._04u
mov ecx, 0x400
lea edi, [ebp - 0x508]
call fcn.100639e0
mov edx, dword [ebp - 0x510]
add esp, 0x14
lea eax, [ebp - 0x50c]
push eax
push 0x20019
push 0
mov ecx, edi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10064195
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x51c]
push eax
mov eax, dword [ebp - 0x50c]
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x520]
push edx
push 0
push str.NetCfgInstanceId
push eax
call edi
test eax, eax
je 0x1006412f
mov ecx, dword [ebp - 0x50c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10064195
lea eax, [esi + 8]
push eax
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10064153
mov eax, dword [ebp - 0x50c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10064195
lea ecx, [ebp - 0x51c]
push ecx
mov ecx, dword [ebp - 0x50c]
lea edx, [ebp - 0x528]
push edx
lea eax, [ebp - 0x520]
push eax
push 0
push str.Characteristics
push ecx
mov dword [ebp - 0x51c], 4
call edi
mov edx, dword [ebp - 0x50c]
push edx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x100641a6
inc ebx
xor edi, edi
cmp ebx, dword [ebp - 0x514]
jb 0x100640a0
jmp 0x100641b4
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x524], eax
xor edi, edi
mov ecx, dword [ebp - 0x510]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x524]
and dl, 4
xor eax, eax
cmp dl, 4
sete al
cmp eax, edi
jne 0x100641e0
mov esi, dword [esi]
cmp esi, edi
jne 0x10063fb1
mov eax, dword [ebp - 0x52c]
push eax
call dword [sym.imp.MSVCR100.dll_free]
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret