Function at 0x428620
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd64
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00411960
push 0x20a
lea eax, [ebp - 0x548]
mov dword [ebp - 0xd58], 0x32
push 0
push eax
call fcn.00411960
push 0x64
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00411960
add esp, 0x24
lea eax, [ebp - 0xcc]
xor ebx, ebx
xor edi, edi
push 0x32
push eax
push 0x4bdf2c
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x4286af
push str.cant_convert_guid_to_string
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xcc]
push eax
push str.SystemCurrentControlSetControlNetwork_s
lea eax, [ebp - 0x548]
push 0x105
push eax
call fcn.00419510
add esp, 0x10
lea eax, [ebp - 0xd50]
push eax
push 9
push 0
lea eax, [ebp - 0x548]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x428711
push str.VNLCleanupUnusedAdaptersW2K:_couldnt_open_registry_for_network_cards
push 1
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0xd64]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xd58]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push dword [ebp - 0xd50]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x428a3b
push 0x64
lea eax, [ebp - 0x130]
inc ebx
push 0
push eax
call fcn.00411960
push 0x400
lea eax, [ebp - 0xd48]
push 0
push eax
call fcn.00411960
push 0x400
lea eax, [ebp - 0x948]
push 0
push eax
call fcn.00411960
lea eax, [ebp - 0x68]
mov dword [ebp - 0xd54], 0x400
push eax
push str._sConnection
lea eax, [ebp - 0x130]
mov dword [ebp - 0xd58], 0x32
push 0x32
push eax
call fcn.00419510
add esp, 0x34
lea eax, [ebp - 0xd4c]
push eax
push 1
push 0
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0xd50]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4287d7
lea eax, [ebp - 0x68]
push eax
push str.VNLCleanupUnusedAdaptersW2K:_couldnt_open_Connection_subkey__so_not_deleting:__S
jmp 0x428a02
lea eax, [ebp - 0xd54]
push eax
lea eax, [ebp - 0xd48]
push eax
push 0
push 0
push str.Name
push dword [ebp - 0xd4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x428822
lea eax, [ebp - 0x68]
push eax
push str.VNLCleanupUnusedAdaptersW2K:_couldnt_query_Name__so_not_deleting:__S
push 0x20
call fcn.00446b80
add esp, 0xc
push dword [ebp - 0xd4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x428a0c
lea eax, [ebp - 0xd54]
mov dword [ebp - 0xd54], 0x400
push eax
lea eax, [ebp - 0x948]
push eax
push 0
push 0
push str.PnpInstanceID
push dword [ebp - 0xd4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xd4c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x42886f
lea eax, [ebp - 0x68]
push eax
push str.VNLCleanupUnusedAdaptersW2K:_couldnt_query_PnpInstanceID__so_not_deleting:__S
jmp 0x428a02
push 0xc
lea eax, [ebp - 0x948]
push str.ROOTVMware_
push eax
call fcn.0040e318
add esp, 0xc
test eax, eax
je 0x4288a3
push 9
lea eax, [ebp - 0x948]
push str.ROOTNet_
push eax
call fcn.0040e318
add esp, 0xc
test eax, eax
jne 0x4288d7
push 9
lea eax, [ebp - 0x948]
push str.ROOTNet_
push eax
call fcn.0040e318
add esp, 0xc
test eax, eax
jne 0x4288fd
push 6
lea eax, [ebp - 0xd48]
push 0x4a4570
push eax
call fcn.0040e318
add esp, 0xc
test eax, eax
je 0x4288fd
lea eax, [ebp - 0xd48]
push eax
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x68]
push eax
push str.VNLCleanupUnusedAdaptersW2K:_PnP_ID_and_or_name_for_GUID__S_doesnt_match_expectation:__S__S
push 0x20
call fcn.00446b80
add esp, 0x14
jmp 0x428a0c
lea eax, [ebp - 0x68]
push eax
push str.VNLCleanupUnusedAdaptersW2K:_VMware_GUID_is:__S
push 0x10
call fcn.00446b80
push 0
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.004277e0
add esp, 0x18
test eax, eax
je 0x42892f
lea eax, [ebp - 0x68]
push eax
push str.VNLCleanupUnusedAdaptersW2K:_adapter_found_in_control_class__skipping:__S
jmp 0x428a02
push 0x20a
lea eax, [ebp - 0x33c]
push 0
push eax
call fcn.00411960
lea eax, [ebp - 0x68]
push eax
push str.SystemCurrentControlSetServices_s
lea eax, [ebp - 0x33c]
push 0x105
push eax
call fcn.00419510
add esp, 0x1c
lea eax, [ebp - 0xd5c]
push eax
push 1
push 0
lea eax, [ebp - 0x33c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4289a1
lea eax, [ebp - 0x68]
push eax
push str.VNLCleanupUnusedAdaptersW2K:_adapter_service_key_is_present__skipping:__S
push 0x20
call fcn.00446b80
add esp, 0xc
push dword [ebp - 0xd5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x428a0c
push str.VNLCleanupUnusedAdaptersW2K:_service_key_is_not_present
push 0x20
call fcn.00446b80
push 8
call fcn.0047ee60
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4289ce
push str.VNLCleanupUnusedAdaptersW2K:_couldnt_allocate_buffer_for_string
push 1
call fcn.00446b80
add esp, 8
jmp 0x428a0c
lea eax, [ebp - 0x68]
mov dword [esi], edi
push eax
call fcn.004834a4
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x4289f7
push str.VNLCleanupUnusedAdaptersW2K:_couldnt_allocate_string
push 1
call fcn.00446b80
push esi
call fcn.0047ee40
jmp 0x428a09
lea eax, [ebp - 0x68]
mov edi, esi
push eax
push str.VNLCleanupUnusedAdaptersW2K:_added__S_to_list_of_GUIDs
push 0x20
call fcn.00446b80
add esp, 0xc
lea eax, [ebp - 0xd64]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xd58]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push dword [ebp - 0xd50]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x428742
push dword [ebp - 0xd50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x428ad8
nop
push 0x20a
lea eax, [ebp - 0x33c]
push 0
push eax
call fcn.00411960
push dword [edi + 4]
mov ebx, dword [edi]
lea eax, [ebp - 0x548]
push eax
push 0x4a190c
lea eax, [ebp - 0x33c]
push 0x105
push eax
call fcn.00419510
push 1
lea eax, [ebp - 0x33c]
push 0
push eax
call fcn.0041c1b0
add esp, 0x2c
test eax, eax
je 0x428aa8
mov ecx, 2
mov edx, str.VNLCleanupUnusedAdaptersW2K:_delete_of__S_successful
jmp 0x428ab2
mov ecx, 1
mov edx, str.VNLCleanupUnusedAdaptersW2K:_delete_of__S_failed
mov eax, dword [edi + 4]
push eax
push edx
push ecx
call fcn.00446b80
push dword [edi + 4]
call fcn.0047ee40
push edi
call fcn.0047ee40
add esp, 0x14
mov edi, ebx
test ebx, ebx
jne 0x428a50
cmp esi, 0x103
je 0x428b03
push esi
push str.VNLCleanupUnusedAdaptersW2K:_card_enumeration_returned:_0x_08x
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push str.VNLCleanupUnusedAdaptersW2K:_finished_enumerating_cards
push 0x10
call fcn.00446b80
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 1
pop esi
pop edi
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret