Function at 0x10006e90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x118
mov eax, dword [0x10011010]
xor eax, esp
mov dword [esp + 0x114], eax
push ebp
mov ebp, dword [esp + 0x120]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 4], eax
mov dword [ebp], eax
call fcn.1000a470
cmp eax, 3
je 0x10006edb
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1000de3c
add esp, 0x118
ret
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push edi
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10006fe5
push ebp
push str.SearchList
push dword [esp + 0x1c]
call fcn.10006df0
lea eax, [esp + 0x1c]
push eax
push str.Domain
push dword [esp + 0x28]
call fcn.10006df0
add esp, 0x18
test eax, eax
je 0x10006fdf
mov ebx, dword [esp + 0x10]
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10006f40
mov edx, dword [ebp]
sub esi, ecx
test edx, edx
je 0x10006f63
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006f55
sub ecx, edi
add ecx, 2
jmp 0x10006f68
mov ecx, 1
lea eax, [ecx + esi]
push eax
push edx
call dword [0x10011004]
mov edi, eax
add esp, 8
test edi, edi
je 0x10006fc1
cmp dword [ebp], 0
jne 0x10006f85
mov byte [edi], 0
mov ecx, edi
mov dword [ebp], edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006f90
sub ecx, edx
je 0x10006fb3
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10006fa0
mov ax, word [0x1000f34c]
mov word [edi], ax
push esi
push ebx
push dword [ebp]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
add esp, 0xc
push ebx
call dword [0x10011008]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], 0
push dword [esp + 0x14]
call ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwarePoliciesMicrosoftWindows_NTDNSClient
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x100070d5
lea eax, [esp + 0x10]
push eax
push str.SearchList
push dword [esp + 0x1c]
call fcn.10006df0
add esp, 0xc
test eax, eax
je 0x100070cf
mov ebx, dword [esp + 0x10]
mov esi, ebx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10007030
mov edx, dword [ebp]
sub esi, ecx
test edx, edx
je 0x10007053
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007045
sub ecx, edi
add ecx, 2
jmp 0x10007058
mov ecx, 1
lea eax, [ecx + esi]
push eax
push edx
call dword [0x10011004]
mov edi, eax
add esp, 8
test edi, edi
je 0x100070b1
cmp dword [ebp], 0
jne 0x10007075
mov byte [edi], 0
mov ecx, edi
mov dword [ebp], edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007080
sub ecx, edx
je 0x100070a3
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10007090
mov ax, word [0x1000f34c]
mov word [edi], ax
push esi
push ebx
push dword [ebp]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
add esp, 0xc
push ebx
call dword [0x10011008]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], 0
push dword [esp + 0x14]
call ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwarePoliciesMicrosoftSystemDNSClient
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x100071c5
lea eax, [esp + 0x10]
push eax
push str.PrimaryDNSSuffix
push dword [esp + 0x1c]
call fcn.10006df0
add esp, 0xc
test eax, eax
je 0x100071bf
mov ebx, dword [esp + 0x10]
mov esi, ebx
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10007120
mov edx, dword [ebp]
sub esi, ecx
test edx, edx
je 0x10007143
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007135
sub ecx, edi
add ecx, 2
jmp 0x10007148
mov ecx, 1
lea eax, [ecx + esi]
push eax
push edx
call dword [0x10011004]
mov edi, eax
add esp, 8
test edi, edi
je 0x100071a1
cmp dword [ebp], 0
jne 0x10007165
mov byte [edi], 0
mov ecx, edi
mov dword [ebp], edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007170
sub ecx, edx
je 0x10007193
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10007180
mov ax, word [0x1000f34c]
mov word [edi], ax
push esi
push ebx
push dword [ebp]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
add esp, 0xc
push ebx
call dword [0x10011008]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], 0
push dword [esp + 0x14]
call ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParametersInterfaces
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x100074ac
push eax
push eax
push eax
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], pe_nt_image_headers32
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x100074a6
nop
inc dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
push 1
push 0
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x24]
call esi
test eax, eax
jne 0x10007475
lea eax, [esp + 0x10]
push eax
push str.SearchList
push dword [esp + 0x20]
call fcn.10006df0
add esp, 0xc
test eax, eax
je 0x100072e7
mov ebx, dword [esp + 0x10]
mov esi, ebx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10007257
mov edx, dword [ebp]
sub esi, ecx
test edx, edx
je 0x1000727e
mov ecx, edx
lea edi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007270
sub ecx, edi
add ecx, 2
jmp 0x10007283
mov ecx, 1
lea eax, [ecx + esi]
push eax
push edx
call dword [0x10011004]
mov edi, eax
add esp, 8
test edi, edi
je 0x100072d5
cmp dword [ebp], 0
jne 0x100072a0
mov byte [edi], 0
mov ecx, edi
mov dword [ebp], edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100072a8
sub ecx, edx
je 0x100072c7
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x100072b4
mov ax, word [0x1000f34c]
mov word [edi], ax
push esi
push ebx
push dword [ebp]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
add esp, 0xc
push ebx
call dword [0x10011008]
add esp, 4
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push str.Domain
push dword [esp + 0x20]
call fcn.10006df0
add esp, 0xc
test eax, eax
je 0x100073a3
mov ebx, dword [esp + 0x10]
mov esi, ebx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x10007310
mov edx, dword [ebp]
sub esi, ecx
test edx, edx
je 0x10007333
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007325
sub ecx, edi
add ecx, 2
jmp 0x10007338
mov ecx, 1
lea eax, [ecx + esi]
push eax
push edx
call dword [0x10011004]
mov edi, eax
add esp, 8
test edi, edi
je 0x10007391
cmp dword [ebp], 0
jne 0x10007355
mov byte [edi], 0
mov ecx, edi
mov dword [ebp], edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007360
sub ecx, edx
je 0x10007383
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10007370
mov ax, word [0x1000f34c]
mov word [edi], ax
push esi
push ebx
push dword [ebp]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
add esp, 0xc
push ebx
call dword [0x10011008]
add esp, 4
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push str.DhcpDomain
push dword [esp + 0x20]
call fcn.10006df0
add esp, 0xc
test eax, eax
je 0x10007463
mov ebx, dword [esp + 0x10]
mov esi, ebx
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x100073d0
mov edx, dword [ebp]
sub esi, ecx
test edx, edx
je 0x100073f3
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100073e5
sub ecx, edi
add ecx, 2
jmp 0x100073f8
mov ecx, 1
lea eax, [ecx + esi]
push eax
push edx
call dword [0x10011004]
mov edi, eax
add esp, 8
test edi, edi
je 0x10007451
cmp dword [ebp], 0
jne 0x10007415
mov byte [edi], 0
mov ecx, edi
mov dword [ebp], edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007420
sub ecx, edx
je 0x10007443
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10007430
mov ax, word [0x1000f34c]
mov word [edi], ax
push esi
push ebx
push dword [ebp]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
add esp, 0xc
push ebx
call dword [0x10011008]
add esp, 4
mov dword [esp + 0x10], 0
push dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], pe_nt_image_headers32
push eax
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10007210
push dword [esp + 0x14]
call ebx
mov ecx, dword [esp + 0x124]
xor eax, eax
cmp dword [ebp], eax
pop edi
pop esi
pop ebx
setne al
pop ebp
xor ecx, esp
call fcn.1000de3c
add esp, 0x118
ret