Function at 0x6e027930
Capabilities:
Parse url
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2b38
call fcn.6e0498e0
mov eax, dword [0x6e06c64c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x28]
push 0x824
push eax
lea eax, [ebp - 0x1848]
push eax
mov word [edi], cx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
push 0x3c
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x2b38]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x2b38], esi
add esp, 0x18
inc eax
mov dword [ebp - 0x2b24], eax
mov dword [ebp - 0x2b08], eax
lea eax, [ebp - 0x2b38]
push eax
push ebx
push ebx
lea eax, [ebp - 0x1848]
push eax
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
test eax, eax
je 0x6e027bb0
cmp dword [ebp - 0x2b2c], 3
je 0x6e0279c7
cmp dword [ebp - 0x2b2c], 4
jne 0x6e027bb0
lea eax, [ebp - 0x1848]
push eax
lea eax, [ebp - 0x2ae0]
push 0x94c
push eax
call fcn.6e04250a
add esp, 0xc
test al, al
je 0x6e027bc3
push ebx
push ebx
lea eax, [ebp - 0x400]
mov dword [ebp - 0x2aec], ebx
push 0x1cc
push eax
mov dword [ebp - 0x2af8], ebx
mov dword [ebp - 0x2ae8], ebx
call fcn.6e04250a
add esp, 0x10
test eax, eax
jne 0x6e027b87
lea eax, [ebp - 0x2aec]
push eax
lea eax, [ebp - 0x2ae8]
push eax
push 0x6e06f764
lea eax, [ebp - 0x2af8]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.6e04250a
add esp, 0x14
mov esi, 0x6e058508
cmp dword [0x6e06f764], ebx
mov ecx, 0x6e058518
cmove esi, ecx
test eax, eax
jne 0x6e027b87
mov eax, dword [ebp - 0x2ae8]
shr eax, 0x10
cmp eax, 0xc
jbe 0x6e027ad3
mov eax, dword [ebp - 0x2aec]
shr eax, 0x10
cmp eax, 0x2710
jb 0x6e027aa4
cmp eax, 0x4e20
jae 0x6e027a8a
mov eax, str.Beta
jmp 0x6e027aa9
cmp eax, 0x7530
jae 0x6e027a98
mov eax, 0x6e058530
jmp 0x6e027aa9
cmp eax, 0x9c40
mov eax, str.2017
jb 0x6e027aa9
mov eax, str.Trunk
push eax
lea eax, [ebp - 0x68]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
lea eax, [ebp - 0x68]
push eax
push esi
push str.SoftwarePoliciesAdobe_s_sFeatureLockDowncSharePoint
lea eax, [ebp - 0x800]
push 0x400
push eax
call fcn.6e04250a
add esp, 0x1c
jmp 0x6e027af1
push eax
push esi
push str.SoftwarePoliciesAdobe_s_d.0FeatureLockDowncSharePoint
lea eax, [ebp - 0x800]
push 0x400
push eax
lfence
call fcn.6e04250a
add esp, 0x14
test eax, eax
js 0x6e027b87
lea eax, [ebp - 0x2ae4]
mov dword [ebp - 0x2ae4], ebx
push eax
xor esi, esi
lea eax, [ebp - 0x800]
inc esi
push esi
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6e027b87
lea eax, [ebp - 0x2afc]
mov dword [ebp - 0x2af0], ebx
push eax
lea eax, [ebp - 0x2af4]
mov dword [ebp - 0x2af4], ebx
push eax
lea eax, [ebp - 0x2af0]
mov dword [ebp - 0x2afc], 4
push eax
push ebx
push str.bDisableSharePointFeatures
push dword [ebp - 0x2ae4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6e027b77
cmp dword [ebp - 0x2af0], 4
jne 0x6e027b77
cmp dword [ebp - 0x2af4], esi
movzx ebx, bl
cmove ebx, esi
push dword [ebp - 0x2ae4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x6e027bc3
lea eax, [ebp - 0x2ae0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
test eax, eax
je 0x6e027bc3
lea eax, [ebp - 0x2ae0]
push eax
call fcn.6e04250a
pop ecx
test eax, eax
je 0x6e027bc3
or eax, 0xffffffff
mov word [edi], ax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6e0492f0
leave
ret 0x24
mov eax, 0x400f0003
jmp 0x6e027bb2