Function at 0x42894b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
push ebx
push esi
push edi
mov dword [ebp - 0x1f8], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x475648
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4289a7
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x47568c
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x428a8b
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x1f8]
cmp dword [0x4622c8], 0
je 0x4289d6
xor eax, eax
jmp 0x428d62
cmp dword [ebp - 0x1f8], 0xc
jle 0x428a40
push 0x4756c8
push 0x5fd800
call fcn.004530c0
add esp, 8
mov eax, str.HAS_NO_CNAME
mov ecx, 0x9854e0
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov al, byte [eax + 0xc]
mov byte [ecx + 0xc], al
cmp dword [0x45e03c], 0
je 0x428a34
push 0x9854e0
push str._n_rForce_This_Computer_to_be___s_
call fcn.00452380
add esp, 8
xor eax, eax
jmp 0x428d62
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlComputerNameActiveComputerName
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x428a86
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlComputerNameComputerName
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
jmp 0x4289a7
mov dword [ebp - 0x14], 0x64
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push str.ComputerName
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [0x45e03c], 0
je 0x428ad8
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
push str._nThis_Computer___S___x_
call fcn.00452380
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0x5fd800
call fcn.004530c0
add esp, 8
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
cmp dword [ebp - 0x10], 0x32
jge 0x428b50
mov eax, dword [ebp - 0x10]
mov al, byte [ebp + eax - 0x114]
mov ecx, dword [ebp - 8]
mov byte [ecx + 0x9854e0], al
mov eax, dword [ebp - 0x10]
movsx eax, byte [ebp + eax - 0x114]
test eax, eax
jne 0x428b44
mov eax, dword [ebp - 0x10]
movsx eax, byte [ebp + eax - 0x113]
test eax, eax
jne 0x428b44
mov dword [ebp - 0x10], 0x63
add dword [ebp - 0x10], 2
inc dword [ebp - 8]
jmp 0x428afa
dec dword [ebp - 8]
mov eax, dword [ebp - 8]
mov byte [eax + 0x9854e0], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x984f20
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x428cf3
mov dword [ebp - 0x14], 0x64
lea eax, [ebp - 0x114]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push str.NV_Domain
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x114]
push eax
push 0x475814
push 0x984f20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edi, 0x984f20
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x481ca0
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x475818
push 0x984f20
call fcn.00453660
add esp, 8
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
mov byte [eax + 0x984f20], 0
cmp dword [0x45e03c], 0
je 0x428c6f
push 0x984f20
push str._nThis_Computer_Domain___s_
call fcn.00452380
add esp, 8
mov dword [ebp - 0x14], 0x64
lea eax, [ebp - 0x114]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x475838
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x114]
push eax
push 0x475850
push 0x5ad460
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [0x45e03c], 0
je 0x428ce9
push 0x5ad460
push str._nThis_Computer_DHCP_Domain___s_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x1f4], 0
lea eax, [ebp - 0x1f4]
push eax
call fcn.0043811d
add esp, 4
movsx eax, byte [ebp - 0x1f4]
test eax, eax
je 0x428d5b
lea eax, [ebp - 0x1f4]
push eax
push 0x984f20
push str._r_nUpdating_Domain_from___s______s_
call fcn.00452380
add esp, 0xc
lea edi, [ebp - 0x1f4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, 0x984f20
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
jmp 0x428d62
pop edi
pop esi
pop ebx
leave
ret