Function at 0x2100ef360
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x428
lea r12, [rsp + 0x220]
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
lea rdx, str.TcpipParametersInterfaces_
mov rcx, r12
call sym.msys_2.0.dll_wcpcpy
mov rdx, rax
mov rax, qword gs:[8]
mov rax, qword [rax - 0x2938]
test rax, rax
je 0x2100ef6a0
lea rcx, [sym.__ascii_mbtowc]
cmp qword [rax + 0xe8], rcx
je 0x2100ef690
mov rax, qword gs:[8]
mov rax, qword [rax - 0x2938]
mov rcx, qword [sym.__utf8_mbtowc]
test rax, rax
je 0x2100ef3e6
mov rcx, qword [rax + 0xe8]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rdi
mov r8d, 0xdc
call sym._sys_mbstowcs_int_____reent__wchar_t__char_const__unsigned_long___mbstate_t___wchar_t__unsigned_long__char_const__unsigned_long_
mov rdx, r12
mov ecx, 1
call sym.RtlCheckRegistryKey
test eax, eax
js 0x2100ef676
xor eax, eax
lea rdi, [rsp + 0xd0]
xor r9d, r9d
mov rdx, r12
mov ecx, 0x2a
lea r15, [rsp + 0x50]
lea r13, [rsp + 0x70]
mov dword [rsp + 0x4c], 0
rep stosq qword [rdi], rax
lea rax, str.EnableDHCP
mov qword [rsp + 0x20], 0
lea r14, [rsp + 0x80]
mov qword [rsp + 0xe0], rax
lea rax, str.DhcpIPAddress
lea r8, [rsp + 0xd0]
mov ecx, 1
mov qword [rsp + 0x118], rax
lea rax, str.DhcpSubnetMask
mov qword [rsp + 0x150], rax
lea rax, str.IPAddress
mov qword [rsp + 0x188], rax
lea rax, str.SubnetMask
mov qword [rsp + 0x1c0], rax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov dword [rsp + 0xd8], 0xa0
mov dword [rsp + 0x110], 0x30
mov dword [rsp + 0x148], 0x30
mov dword [rsp + 0x180], 0x30
mov dword [rsp + 0x1b8], 0x30
mov qword [rsp + 0x120], r15
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x190], r13
mov qword [rsp + 0x1c8], r14
call sym.RtlQueryRegistryValues
test eax, eax
js 0x2100ef676
mov ebp, dword [rsp + 0x4c]
test ebp, ebp
jne 0x2100ef6c0
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x2100ef780
cmp word [rdi], 0
je 0x2100ef5c0
test ebx, ebx
je 0x2100ef7d0
xor r12d, r12d
jmp 0x2100ef5a9
cmp r12d, ebx
je 0x2100ef7d0
mov rcx, rdi
add r12d, 1
call sym.msys_2.0.dll_wcslen
lea rdi, [rdi + rax*2 + 2]
cmp word [rdi], 0
jne 0x2100ef5a0
mov rdi, qword [rsp + 0x88]
test rdi, rdi
je 0x2100ef615
cmp word [rdi], 0
mov byte [rsp + 0x38], 0
je 0x2100ef615
test ebx, ebx
jne 0x2100ef5f0
jmp 0x2100ef830
cmp ebx, ebp
je 0x2100ef830
mov rcx, rdi
add ebp, 1
call sym.msys_2.0.dll_wcslen
lea rdi, [rdi + rax*2 + 2]
cmp word [rdi], 0
jne 0x2100ef5e8
cmp byte [rsp + 0x38], 0
je 0x2100ef615
lea rax, [rsi + 0x68]
mov qword [rsi + 0x18], rax
mov rdx, qword [rsp + 0x58]
test byte [rsi + 0x10], 2
je 0x2100ef631
mov eax, dword [rsi + 0x16c]
not eax
or eax, dword [rsi + 0x6c]
mov dword [rsi + 0xec], eax
test rdx, rdx
je 0x2100ef63e
mov rcx, r15
call sym.RtlFreeUnicodeString
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x2100ef652
mov rcx, qword [rsp + 0x30]
call sym.RtlFreeUnicodeString
cmp qword [rsp + 0x78], 0
je 0x2100ef662
mov rcx, r13
call sym.RtlFreeUnicodeString
cmp qword [rsp + 0x88], 0
je 0x2100ef676
mov rcx, r14
call sym.RtlFreeUnicodeString
nop
add rsp, 0x428
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [sym.__utf8_mbtowc]
jmp 0x2100ef3e6
lea rax, [sym.__ascii_mbtowc]
cmp qword [sym.__utf8_mbtowc], rax
lea rcx, [sym.__utf8_mbtowc]
jne 0x2100ef3c3
jmp 0x2100ef3e6
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x2100ef760
mov dword [rsp + 0x20], 0
lea r12, [rsp + 0x90]
mov edx, 0x40
mov r9, 0xffffffffffffffff
mov rcx, r12
call sym._sys_wcstombs_char__unsigned_long__wchar_t_const__unsigned_long__bool_
lea rdx, [rsi + 0x6c]
mov rcx, r12
call sym.inet_pton4_char_const__unsigned_char_
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x2100ef60d
mov byte [rsp + 0x38], 1
mov dword [rsp + 0x20], 0
mov edx, 0x40
mov rcx, r12
mov r8, rax
mov r9, 0xffffffffffffffff
call sym._sys_wcstombs_char__unsigned_long__wchar_t_const__unsigned_long__bool_
lea rdx, [rsi + 0x16c]
mov rcx, r12
call sym.inet_pton4_char_const__unsigned_char_
cmp byte [rsp + 0x38], 0
je 0x2100ef74e
lea rax, [rsi + 0x68]
mov qword [rsi + 0x18], rax
lea rax, [rsi + 0x168]
mov qword [rsi + 0x20], rax
jmp 0x2100ef615
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x2100ef7a8
mov byte [rsp + 0x38], 0
lea r12, [rsp + 0x90]
jmp 0x2100ef711
mov rdi, qword [rsp + 0x88]
test rdi, rdi
je 0x2100ef615
cmp word [rdi], 0
je 0x2100ef615
mov byte [rsp + 0x38], 0
jmp 0x2100ef5d8
test byte [rsi + 0x10], 2
je 0x2100ef652
mov edx, dword [rsi + 0x16c]
not edx
or edx, dword [rsi + 0x6c]
mov dword [rsi + 0xec], edx
jmp 0x2100ef643
mov dword [rsp + 0x20], 0
mov r8, rdi
lea rcx, [rsp + 0x90]
mov r9, 0xffffffffffffffff
mov edx, 0x40
mov qword [rsp + 0x38], rcx
call sym._sys_wcstombs_char__unsigned_long__wchar_t_const__unsigned_long__bool_
mov rcx, qword [rsp + 0x38]
lea rdx, [rsi + 0x6c]
call sym.inet_pton4_char_const__unsigned_char_
mov rdi, qword [rsp + 0x88]
test rdi, rdi
je 0x2100ef60d
cmp word [rdi], 0
mov byte [rsp + 0x38], 1
jne 0x2100ef5d8
jmp 0x2100ef60d
mov dword [rsp + 0x20], 0
lea rbx, [rsp + 0x90]
mov r8, rdi
mov edx, 0x40
mov rcx, rbx
mov r9, 0xffffffffffffffff
call sym._sys_wcstombs_char__unsigned_long__wchar_t_const__unsigned_long__bool_
lea rdx, [rsi + 0x16c]
mov rcx, rbx
call sym.inet_pton4_char_const__unsigned_char_
jmp 0x2100ef73f