Function at 0x40ed70
Capabilities:
Check os version
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push ebx
push esi
push edi
lea eax, [ebp - 0xfc]
push eax
mov dword [ebp - 0xfc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xec], 2
jne 0x40ee91
cmp dword [ebp - 0xf8], 5
jb 0x40ee91
push str.iphlpapi.dll
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
mov dword [ebp - 0xc], esi
je 0x40ee87
push str.GetAdaptersInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x40edef
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0x280
mov ecx, dword [ebp - 4]
push ecx
call fcn.004028e0
add esp, 4
lea edx, [ebp - 4]
mov esi, eax
push edx
push esi
call ebx
mov edi, eax
test edi, edi
je 0x40ee2f
push esi
call fcn.00402836
add esp, 4
xor esi, esi
cmp edi, 0x6f
jne 0x40ee2f
mov eax, dword [ebp - 8]
mov ecx, eax
inc eax
cmp ecx, 5
mov dword [ebp - 8], eax
jl 0x40edf6
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x40ee7e
test esi, esi
je 0x40ee7e
mov edi, esi
mov eax, dword [edi + 0x224]
test eax, eax
je 0x40ee63
lea eax, [edi + 0x22c]
call fcn.0040e930
lea eax, [edi + 0x254]
call fcn.0040e930
mov edi, dword [edi]
test edi, edi
jne 0x40ee43
push esi
call fcn.00402836
mov eax, dword [0x4209f8]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.00402836
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesNetBTAdapters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ee87
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x200]
push edx
push eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40f049
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push 1
push 0
lea edx, [ebp - 0x200]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f01c
mov edx, dword [0x41c4b4]
mov ecx, dword [str.DhcpNameServer]
mov eax, dword [0x41c4b8]
mov dword [ebp - 0x64], edx
mov dl, byte [0x41c4be]
mov dword [ebp - 0x68], ecx
mov cx, word [0x41c4bc]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5a], dl
mov edx, dword [0x41c938]
xor eax, eax
mov word [ebp - 0x5c], cx
mov ecx, dword [str.DhcpNameServerBackup]
mov dword [ebp - 0x59], eax
mov dword [ebp - 0x4f], edx
mov edx, dword [0x41c944]
mov word [ebp - 0x55], ax
mov eax, dword [0x41c93c]
mov dword [ebp - 0x53], ecx
mov ecx, dword [0x41c940]
mov dword [ebp - 0x43], edx
mov edx, dword [0x41c4f8]
mov dword [ebp - 0x4b], eax
mov al, byte [0x41c948]
mov dword [ebp - 0x47], ecx
mov ecx, dword [str.NameServer]
mov dword [ebp - 0x3a], edx
mov byte [ebp - 0x3f], al
mov ax, word [0x41c4fc]
mov dword [ebp - 0x3e], ecx
mov cl, byte [0x41c4fe]
xor edx, edx
mov dword [ebp - 0x33], edx
mov word [ebp - 0x36], ax
mov eax, dword [str.NameServerBackup]
mov byte [ebp - 0x34], cl
mov ecx, dword [0x41c924]
mov dword [ebp - 0x2f], edx
mov word [ebp - 0x2b], dx
mov edx, dword [0x41c928]
mov dword [ebp - 0x29], eax
mov eax, dword [0x41c92c]
mov dword [ebp - 0x25], ecx
mov cl, byte [0x41c930]
mov dword [ebp - 0x21], edx
mov dword [ebp - 0x1d], eax
mov byte [ebp - 0x19], cl
mov dword [ebp - 0x18], 0
lea esi, [ebp - 0x68]
mov edi, 4
lea esp, [esp]
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x304]
push eax
push 0
push 0
push esi
push ecx
mov dword [ebp - 0x14], 0x104
call ebx
test eax, eax
je 0x40f00c
lea eax, [ebp - 0x304]
call fcn.0040e930
add esi, 0x15
dec edi
jne 0x40efe0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
inc eax
lea edx, [ebp - 0x200]
push edx
push eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x40eee2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4209f8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret