Function at 0x1003396
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x100938c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
lea ecx, reloc.NETAPI32.dll_DsGetDcNameW
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], ebx
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], ebx
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], ebx
call fcn.010045f4
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
call fcn.01002da9
test eax, eax
jne 0x10035bd
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
push 1
push ebx
push 0x10017f8
push dword [ebp - 0x7dc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
sub ecx, ebx
je 0x100341a
dec ecx
dec ecx
je 0x10035b2
push eax
push 0x2718
call fcn.01002773
pop ecx
jmp 0x10035bc
push edi
mov esi, 0x3e8
push esi
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push ebx
push eax
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], ebx
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], esi
call sub.msvcrt.dll_memset
push esi
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push ebx
push eax
call sub.msvcrt.dll_memset
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add esp, 0x18
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
push ebx
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
push ebx
push dword [ebp - 0x7d8]
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], 0x1f4
call edi
cmp eax, ebx
jne 0x1003595
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], 1
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push 0x10017f4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10034d4
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
push 0x276e
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], 0x1f4
call fcn.01002737
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push 0x10017f4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x100350e
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
push 0x276f
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], 0x1f4
call fcn.01002737
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
push 0x271a
call fcn.01002773
inc dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW]
push esi
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push ebx
push eax
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], esi
call sub.msvcrt.dll_memset
push esi
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
push ebx
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
lea eax, reloc.NETAPI32.dll_DsGetDcNameW
push eax
push dword [ebp - 0x7e8]
mov dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], 0x1f4
push dword [ebp - 0x7d8]
call edi
cmp eax, ebx
je 0x100349a
pop edi
cmp eax, 0x103
je 0x10035aa
push eax
push 0x2715
call fcn.01002773
pop ecx
pop ecx
cmp dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], ebx
jne 0x10035bd
push 0x2719
call fcn.01002773
pop ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], ebx
je 0x10035d3
push dword [ebp - 0x7dc]
call esi
cmp dword [ebp - reloc.NETAPI32.dll_DsGetDcNameW], ebx
je 0x10035e3
push dword [ebp - 0x7d8]
call esi
lea ecx, reloc.NETAPI32.dll_DsGetDcNameW
call fcn.01004606
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0100597e
leave
ret