Function at 0x14004ba80
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x568
mov rax, qword [0x140177698]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
xor ebp, ebp
mov qword [r11 + 0x18], rsi
mov ebx, ebp
mov qword [r11 + 0x20], rdi
mov esi, ebp
mov qword [rsp + 0x38], rbp
mov edi, ebp
nop dword [rax]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x14004baf7
mov edx, dword [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rsi, rax
test rax, rax
je 0x14004bcca
inc edi
cmp edi, 0x64
jl 0x14004bac0
jmp 0x14004bcae
test eax, eax
jne 0x14004bcae
call fcn.14004b5b0
mov edx, eax
mov rax, rsi
test rsi, rsi
je 0x14004bcca
lea rcx, [rax + 0x1c0]
test rcx, rcx
je 0x14004bb3e
cmp byte [rcx], bl
je 0x14004bb3e
lea rcx, [rax + 0x1f0]
test rcx, rcx
je 0x14004bb3e
cmp byte [rcx], bl
je 0x14004bb3e
test edx, edx
je 0x14004bb4b
cmp dword [rax + 0x1a0], edx
je 0x14004bb4b
mov rax, qword [rax]
test rax, rax
jne 0x14004bb12
jmp 0x14004bcae
add rax, 0xc
lea r9, str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
lea r8, [0x14014f560]
mov qword [rsp + 0x20], rax
mov edx, 0x400
lea rcx, [rsp + 0x150]
call fcn.14004d8a0
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
lea rdx, [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14004bcae
mov qword [rsp + 0x560], r14
mov edi, ebp
mov r14, qword [rsp + 0x38]
mov dword [rsp + 0x30], 0x3f1
nop dword [rax]
test rbx, rbx
je 0x14004bbbe
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14004bc15
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rdx, str.Domain
mov qword [rsp + 0x20], rbx
mov rcx, r14
inc edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x14004bc05
cmp edi, 0x64
jl 0x14004bbb0
movzx eax, byte [rbx]
test al, al
jne 0x14004bc81
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x38]
mov rbx, rbp
mov dword [rsp + 0x30], 0x3f1
test rbx, rbx
je 0x14004bc33
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14004bca6
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rdx, str.DhcpDomain
mov qword [rsp + 0x20], rbx
mov rcx, rdi
inc ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x14004bc7a
cmp ebp, 0x64
jl 0x14004bc25
movzx eax, byte [rbx]
test al, al
je 0x14004bca6
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140054930
test rax, rax
je 0x14004bca6
cmp byte [rsp + 0x50], 0
je 0x14004bca6
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140060c20
mov r14, qword [rsp + 0x560]
test rsi, rsi
je 0x14004bcbc
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x14004bcca
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x588]
mov rsi, qword [rsp + 0x580]
mov rbp, qword [rsp + 0x578]
mov rbx, qword [rsp + 0x570]
test rcx, rcx
je 0x14004bcfa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.14006a270
add rsp, 0x568
ret