Function at 0x402050
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x2c]
push ebx
push ebp
xor ebx, ebx
push esi
mov esi, dword [esp + 0x3c]
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40209d
test cl, cl
je 0x402099
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40209d
add eax, 2
add esi, 2
test cl, cl
jne 0x402079
xor eax, eax
jmp 0x4020a2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4020ae
mov dword [esp + 0x14], 1
mov edi, dword [esp + 0x38]
push edi
call fcn.00401eb0
mov esi, eax
push edi
mov dword [esp + 0x28], esi
call fcn.00401dd0
add esp, 8
cmp esi, ebx
mov ebp, eax
je 0x4023be
cmp ebp, ebx
je 0x4023b3
lea eax, [esp + 0x40]
lea ecx, [esp + 0x10]
push eax
push 0x40ad40
push ecx
push ebx
push str.NetworkAddress
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x58], 0xd
mov dword [esp + 0x28], 1
call esi
mov edi, eax
mov eax, 4
mov dword [esp + 0x40], eax
mov dword [esp + 0x10], eax
lea edx, [esp + 0x40]
lea eax, [esp + 0x30]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
neg edi
push ebx
push str.AdptNWAOverrideEnabled
sbb edi, edi
push ebp
inc edi
call esi
cmp eax, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x402266
lea edx, [esp + 0x40]
lea eax, [esp + 0x10]
push edx
push 0x40d1c0
push eax
push 0
push str.AdptOvrMacAddr
push ebp
mov dword [esp + 0x58], 0x100
mov dword [esp + 0x28], 1
call esi
test eax, eax
jne 0x402266
mov eax, dword [esp + 0x30]
test eax, eax
je 0x402217
test edi, edi
je 0x4021fc
mov esi, dword [esp + 0x3c]
mov eax, 0x40ad40
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4021af
test cl, cl
je 0x4021ab
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4021af
add eax, 2
add esi, 2
test cl, cl
jne 0x40218b
xor eax, eax
jmp 0x4021b4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402266
mov esi, dword [esp + 0x3c]
mov eax, 0x40d1c0
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4021e9
test cl, cl
je 0x4021e5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4021e9
add eax, 2
add esi, 2
test cl, cl
jne 0x4021c5
xor eax, eax
jmp 0x4021ee
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402266
mov dword [esp + 0x18], 1
jmp 0x402266
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.AdptNWAOverrideEnabled
push ebp
call esi
push str.AdptOvrMacAddr
push ebp
call esi
jmp 0x4022b1
cmp dword [esp + 0x14], 1
jne 0x402266
mov esi, dword [esp + 0x3c]
mov eax, 0x40d1c0
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40224b
test cl, cl
je 0x402247
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40224b
add eax, 2
add esi, 2
test cl, cl
jne 0x402227
xor eax, eax
jmp 0x402250
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40225e
mov dword [esp + 0x2c], 1
jmp 0x402266
mov dword [esp + 0x28], 1
test edi, edi
je 0x4022aa
mov esi, dword [esp + 0x3c]
mov eax, 0x40ad40
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402297
test cl, cl
je 0x402293
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402297
add eax, 2
add esi, 2
test cl, cl
jne 0x402273
xor eax, eax
jmp 0x40229c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4022c2
mov dword [esp + 0x24], 1
jmp 0x4022c9
cmp dword [esp + 0x28], 1
je 0x4022c9
mov ecx, dword [esp + 0x14]
mov eax, 1
cmp ecx, eax
jne 0x402304
mov dword [esp + 0x18], eax
cmp dword [esp + 0x2c], 1
jne 0x40230e
mov esi, dword [esp + 0x3c]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push 1
push eax
mov eax, dword [esp + 0x30]
push str.NetworkAddress
push eax
call ebx
test eax, eax
jne 0x402312
cmp dword [esp + 0x14], 1
je 0x402312
mov eax, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
jmp 0x402312
mov dword [esp + 0x18], 0
jmp 0x4022c9
mov esi, dword [esp + 0x3c]
push str.AdptProbeCount
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x402366
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push 1
push eax
push str.AdptOvrMacAddr
push ebp
call ebx
test eax, eax
jne 0x402366
mov esi, 4
lea ecx, [esp + 0x2c]
push esi
push ecx
push esi
push eax
push str.AdptNWAOverrideEnabled
push ebp
mov dword [esp + 0x44], 1
mov dword [esp + 0x58], esi
call ebx
jmp 0x40236b
mov esi, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4023ad
lea edx, [esp + 0x2c]
push esi
push edx
push esi
push 0
push str.RebootRequired
push ebp
mov dword [esp + 0x44], 1
mov dword [esp + 0x28], esi
mov dword [esp + 0x58], esi
call ebx
lea eax, [esp + 0x2c]
push esi
push eax
push esi
push 0
push str.ResetIDRequested
push ebp
mov dword [esp + 0x28], esi
mov dword [esp + 0x58], esi
call ebx
mov esi, dword [esp + 0x20]
xor ebx, ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x38]
cmp ebp, ebx
je 0x4023c9
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x24], ebx
je 0x4023e7
mov ecx, dword [esp + 0x3c]
push ecx
push edi
call fcn.00402400
add esp, 8
cmp eax, 1
mov eax, 1
je 0x4023eb
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret