Function at 0x4152dd
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0x2c4
mov eax, 0x4a54b1
call fcn.00483f83
mov eax, dword [0x4f3a18]
mov esi, dword [ebp + 8]
and dword [ebp - 0x2d0], 0
xor ebx, ebx
inc ebx
mov dword [ebp - 0x2b0], esi
mov edi, 0x4f3a14
test bl, al
jne 0x415330
or eax, ebx
push 0x4f19f8
mov ecx, edi
mov dword [0x4f3a18], eax
call fcn.004016bd
push 0x4ac6d1
call fcn.00483172
mov eax, dword [0x4f3a18]
pop ecx
test al, 2
jne 0x41535b
or eax, 2
push 0x4f19f8
mov ecx, 0x4f3a1c
mov dword [0x4f3a18], eax
call fcn.004016bd
push 0x4ac6df
call fcn.00483172
mov eax, dword [0x4f3a18]
pop ecx
test al, 4
jne 0x415386
or eax, 4
push 0x4f19f8
mov ecx, 0x4f3a20
mov dword [0x4f3a18], eax
call fcn.004016bd
push 0x4ac6ed
call fcn.00483172
mov eax, dword [0x4f3a18]
pop ecx
test al, 8
jne 0x4153ac
or eax, 8
push 0x4f19f8
mov ecx, 0x4f3a24
mov dword [0x4f3a18], eax
call fcn.004016bd
push 0x4ac6c3
call fcn.00483172
pop ecx
mov eax, dword [0x4f3a1c]
cmp dword [eax - 0xc], 0
je 0x4153cf
push dword [0x4f3a0c]
mov ecx, 0x4f3a24
call fcn.00403715
test eax, eax
je 0x41591b
push 0x4f3a0c
mov ecx, 0x4f3a24
call fcn.00401cd5
mov ecx, edi
call fcn.00403853
mov ecx, 0x4f3a1c
call fcn.00403853
mov ecx, 0x4f3a20
call fcn.00403853
xor edi, edi
push 0x4f19f8
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2cc], edi
call fcn.004016bd
and dword [ebp - 4], edi
push 0x4f19f8
lea ecx, [ebp - 0x2c4]
call fcn.004016bd
lea eax, [ebp - 0x2b4]
push eax
push 0x20019
push edi
push str.Volatile_Environment
push SysReAllocStringLen
mov byte [ebp - 4], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x415597
push dword [ebp - 0x2b4]
call ebx
lea eax, [ebp - 0x2b4]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x415587
push 0x82
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2c0], 0x104
call fcn.00404c60
lea ecx, [ebp - 0x2c0]
push ecx
push eax
lea eax, [ebp - 0x2c8]
push eax
push edi
push str.AppData
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x2bc]
test eax, eax
jne 0x4154cd
push 0xffffffffffffffff
call fcn.0040e391
jmp 0x4154d2
call fcn.00403853
push 0x82
mov ecx, 0x4f3a14
mov dword [ebp - 0x2c0], 0x104
call fcn.00404c60
lea ecx, [ebp - 0x2c0]
push ecx
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0
push str.Local_AppData
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 0x4f3a14
test eax, eax
jne 0x41551f
push 0xffffffffffffffff
call fcn.0040e391
jmp 0x415524
call fcn.00403853
push 0x82
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x2c0], 0x104
call fcn.00404c60
lea ecx, [ebp - 0x2c0]
push ecx
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0
push str.A520A1A4_1780_4FF6_BD18_167343C5AF16
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x2c4]
test eax, eax
jne 0x415573
push 0xffffffffffffffff
call fcn.0040e391
jmp 0x41557d
push 0x4f3a14
call fcn.00401cd5
push dword [ebp - 0x2b4]
call ebx
jmp 0x415597
push 0x4f3a14
lea ecx, [ebp - 0x2c4]
call fcn.00401cd5
call fcn.00415956
test al, al
je 0x415717
lea eax, [ebp - 0x2b4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
mov byte [ebp - 0x2b5], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x415689
push 0x82
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2c0], 0x104
call fcn.00404c60
lea ecx, [ebp - 0x2c0]
push ecx
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0
push str.Isolation
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x415645
push 0xffffffffffffffff
lea ecx, [ebp - 0x2bc]
call fcn.0040e391
push 0
push str.PMIL
lea ecx, [ebp - 0x2bc]
mov byte [ebp - 0x2b5], 0
call fcn.00403888
test eax, eax
push 1
pop eax
cmove edi, eax
mov dword [ebp - 0x2cc], edi
push dword [ebp - 0x2b4]
call ebx
call fcn.0041624a
test al, al
jne 0x41567c
mov esi, dword [0x4f3280]
xor ebx, ebx
mov edi, esi
inc ebx
dec edi
cmp ebx, 0xa7
jb 0x415660
mov esi, dword [ebp - 0x2b0]
mov edi, dword [ebp - 0x2cc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x2b5], 0
je 0x41571e
lea eax, [ebp - 0x2b4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x415717
push 0x82
lea ecx, [ebp - 0x2bc]
mov dword [ebp - 0x2c0], 0x104
call fcn.00404c60
lea ecx, [ebp - 0x2c0]
push ecx
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0
push str.DefaultValue
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2bc]
call fcn.0040e391
push dword [ebp - 0x2b4]
call ebx
push 0
push str.PMIL
lea ecx, [ebp - 0x2bc]
call fcn.00403888
xor ebx, ebx
inc ebx
test eax, eax
jne 0x415721
jmp 0x41571a
xor ebx, ebx
inc ebx
mov edi, ebx
jmp 0x415721
xor ebx, ebx
inc ebx
cmp dword [0x4ed128], reloc.OLEAUT32.dll_SysReAllocString
je 0x415777
test edi, edi
je 0x41579b
call fcn.004159db
test al, al
je 0x415777
cmp byte [0x4f3954], 0
jne 0x415777
push str.Software_
lea ecx, [ebp - 0x2b0]
call fcn.0040185d
mov edi, 0x4f3a1c
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.00401cd5
mov ecx, dword [ebp - 0x2b0]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00404d08
jmp 0x415788
mov edi, 0x4f3a1c
push 0x4f3a0c
mov ecx, edi
call fcn.00401cd5
lea eax, [ebp - 0x2c4]
push eax
mov ecx, 0x4f3a14
call fcn.00401cd5
jmp 0x4157e9
mov edi, 0x4f3a14
push edi
call fcn.00414f73
pop ecx
test al, al
jne 0x4157b7
push str.Packageswindows_ie_ac_001AC
mov ecx, edi
call fcn.00401f8b
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea ecx, [ebp - 0x2b0]
call fcn.0040185d
mov edi, 0x4f3a1c
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.00401cd5
mov ecx, dword [ebp - 0x2b0]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00404d08
push 0
push str.windows_ie_ac_001
mov ecx, edi
call fcn.00403888
test eax, eax
jle 0x41580c
push 0x4f3a0c
mov ecx, 0x4f3a20
call fcn.00401cd5
jmp 0x415864
call fcn.004159db
test al, al
je 0x415834
cmp byte [0x4f3954], 0
jne 0x415834
push str.Software_
lea ecx, [ebp - 0x2b0]
call fcn.0040185d
mov byte [ebp - 4], 5
jmp 0x415848
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea ecx, [ebp - 0x2b0]
call fcn.0040185d
mov byte [ebp - 4], 4
push eax
mov ecx, 0x4f3a20
call fcn.00401cd5
mov ecx, dword [ebp - 0x2b0]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00404d08
mov eax, dword [0x4ed128]
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
je 0x4158df
cmp byte [0x4ed12c], 0
je 0x4158df
lea eax, [ebp - 0x2b0]
push eax
call fcn.00415d90
pop ecx
mov eax, dword [eax]
mov ecx, edi
push dword [eax - 0xc]
mov byte [ebp - 4], 6
push eax
call fcn.00401fb4
mov ecx, dword [ebp - 0x2b0]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00404d08
lea eax, [ebp - 0x2b0]
push eax
call fcn.00415d90
pop ecx
mov eax, dword [eax]
mov ecx, 0x4f3a20
push dword [eax - 0xc]
mov byte [ebp - 4], 7
push eax
call fcn.00401fb4
mov ecx, dword [ebp - 0x2b0]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00404d08
mov eax, dword [0x4ed128]
push ebx
push eax
push edi
call fcn.00414f15
push ebx
push dword [0x4ed128]
push 0x4f3a20
call fcn.00414f15
mov ecx, dword [ebp - 0x2c4]
add esp, 0x18
lea ecx, [ecx - 0x10]
call fcn.00404d08
mov ecx, dword [ebp - 0x2bc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00404d08
cmp byte [ebp + 0x10], 0
je 0x41593a
cmp byte [ebp + 0xc], 0
je 0x415933
mov ecx, dword [0x4f3a20]
add ecx, 0xfffffff0
push ecx
jmp 0x415943
mov eax, dword [0x4f3a1c]
jmp 0x41593f
mov eax, dword [0x4f3a14]
add eax, 0xfffffff0
push eax
call fcn.004036b6
add eax, 0x10
mov dword [esi], eax
pop ecx
mov eax, esi
call fcn.00483f32
ret