Function at 0x6e0281c0
Capabilities:
Parse url
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2b38
call fcn.6e04b200
mov eax, dword [0x6e06e64c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x28]
push 0x824
push eax
lea eax, [ebp - 0x1848]
push eax
mov word [edi], cx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
push 0x3c
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x2b38]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x2b38], esi
add esp, 0x18
inc eax
mov dword [ebp - 0x2b24], eax
mov dword [ebp - 0x2b08], eax
lea eax, [ebp - 0x2b38]
push eax
push ebx
push ebx
lea eax, [ebp - 0x1848]
push eax
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
test eax, eax
je 0x6e028440
cmp dword [ebp - 0x2b2c], 3
je 0x6e028257
cmp dword [ebp - 0x2b2c], 4
jne 0x6e028440
lea eax, [ebp - 0x1848]
push eax
lea eax, [ebp - 0x2ae0]
push 0x94c
push eax
call fcn.6e01daf9
add esp, 0xc
test al, al
je 0x6e028453
push ebx
push ebx
lea eax, [ebp - 0x400]
mov dword [ebp - 0x2aec], ebx
push 0x1cc
push eax
mov dword [ebp - 0x2af8], ebx
mov dword [ebp - 0x2ae8], ebx
call fcn.6e01daf9
add esp, 0x10
test eax, eax
jne 0x6e028417
lea eax, [ebp - 0x2aec]
push eax
lea eax, [ebp - 0x2ae8]
push eax
push 0x6e071b7c
lea eax, [ebp - 0x2af8]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.6e01daf9
add esp, 0x14
mov esi, 0x6e05a588
cmp dword [0x6e071b7c], ebx
mov ecx, 0x6e05a598
cmove esi, ecx
test eax, eax
jne 0x6e028417
mov eax, dword [ebp - 0x2ae8]
shr eax, 0x10
cmp eax, 0xc
jbe 0x6e028363
mov eax, dword [ebp - 0x2aec]
shr eax, 0x10
cmp eax, 0x2710
jb 0x6e028334
cmp eax, 0x4e20
jae 0x6e02831a
mov eax, str.Beta
jmp 0x6e028339
cmp eax, 0x7530
jae 0x6e028328
mov eax, 0x6e05a5b0
jmp 0x6e028339
cmp eax, 0x9c40
mov eax, str.2017
jb 0x6e028339
mov eax, str.Trunk
push eax
lea eax, [ebp - 0x68]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
lea eax, [ebp - 0x68]
push eax
push esi
push str.SoftwarePoliciesAdobe_s_sFeatureLockDowncSharePoint
lea eax, [ebp - 0x800]
push 0x400
push eax
call fcn.6e01daf9
add esp, 0x1c
jmp 0x6e028381
push eax
push esi
push str.SoftwarePoliciesAdobe_s_d.0FeatureLockDowncSharePoint
lea eax, [ebp - 0x800]
push 0x400
push eax
lfence
call fcn.6e01daf9
add esp, 0x14
test eax, eax
js 0x6e028417
lea eax, [ebp - 0x2ae4]
mov dword [ebp - 0x2ae4], ebx
push eax
xor esi, esi
lea eax, [ebp - 0x800]
inc esi
push esi
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6e028417
lea eax, [ebp - 0x2afc]
mov dword [ebp - 0x2af0], ebx
push eax
lea eax, [ebp - 0x2af4]
mov dword [ebp - 0x2af4], ebx
push eax
lea eax, [ebp - 0x2af0]
mov dword [ebp - 0x2afc], 4
push eax
push ebx
push str.bDisableSharePointFeatures
push dword [ebp - 0x2ae4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6e028407
cmp dword [ebp - 0x2af0], 4
jne 0x6e028407
cmp dword [ebp - 0x2af4], esi
movzx ebx, bl
cmove ebx, esi
push dword [ebp - 0x2ae4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x6e028453
lea eax, [ebp - 0x2ae0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
test eax, eax
je 0x6e028453
lea eax, [ebp - 0x2ae0]
push eax
call fcn.6e01daf9
pop ecx
test eax, eax
je 0x6e028453
or eax, 0xffffffff
mov word [edi], ax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6e04ac30
leave
ret 0x24
mov eax, 0x400f0003
jmp 0x6e028442