Function at 0x1004df50
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10092b4c
mov eax, dword fs:[0]
push eax
sub esp, 0x8c8
mov eax, dword [0x100bb0a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor al, al
mov dword [ebp - 0x86c], 0
mov byte [ebp - 0x86d], al
mov byte [ebp - 0x86e], al
lea eax, [ebp - 0x86c]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallSkyGuard_Endpoint
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1004dfc4
push str.update_cloudapp_port:_open_subpath_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1004e5a3
push 0x800
lea eax, [ebp - 0x814]
push 0
push eax
call fcn.10064410
add esp, 0xc
mov dword [ebp - 0x81c], 0
lea eax, [ebp - 0x818]
mov dword [ebp - 0x818], 0x400
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x81c]
push eax
push 0
push str.InstallDir
push dword [ebp - 0x86c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1004e02a
push str.update_cloudapp_port:_get_InstallDir_value_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1004e5a3
xor eax, eax
mov dword [ebp - 0x820], 7
mov dword [ebp - 0x824], 0
mov word [ebp - 0x834], ax
cmp word [ebp - 0x814], ax
jne 0x1004e054
xor ecx, ecx
jmp 0x1004e06f
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004e060
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x834]
call fcn.10021b80
push 0x30
push str.EndpointAgentetcEndpointClientAgentConfig.xml
lea ecx, [ebp - 0x834]
mov dword [ebp - 4], 0
call fcn.100215b0
xor eax, eax
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push eax
mov word [ebp - 0x84c], ax
lea ecx, [ebp - 0x84c]
lea eax, [ebp - 0x834]
mov dword [ebp - 0x838], 7
push eax
mov dword [ebp - 0x83c], 0
call fcn.100219c0
xorps xmm0, xmm0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x868]
movq qword [ebp - 0x858], xmm0
movups xmmword [ebp - 0x868], xmm0
mov dword [ebp - 0x850], 0
call fcn.100362b0
push 1
mov byte [ebp - 4], 4
call fcn.100506b3
add esp, 4
mov dword [ebp - 0x890], eax
lea eax, [ebp - 0x888]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x84c]
call fcn.1004d660
lea ecx, [ebp - 0x894]
mov byte [ebp - 4], 6
push ecx
push 0
lea ecx, [ebp - 0x868]
push ecx
push eax
call fcn.10033230
mov eax, dword [ebp - 0x874]
add esp, 0x10
mov byte [ebp - 4], 5
cmp eax, 0x10
jb 0x1004e197
mov ecx, dword [ebp - 0x888]
inc eax
cmp eax, 0x1000
jb 0x1004e18e
test cl, 0x1f
je 0x1004e16a
call fcn.1006fbb9
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x1004e176
call fcn.1006fbb9
sub ecx, eax
cmp ecx, 4
jae 0x1004e182
call fcn.1006fbb9
cmp ecx, 0x23
jbe 0x1004e18c
call fcn.1006fbb9
mov ecx, eax
push ecx
call fcn.1004ebb6
add esp, 4
mov dword [ebp - 0x874], 0xf
mov dword [ebp - 0x878], 0
mov byte [ebp - 0x888], 0
mov ecx, dword [ebp - 0x890]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x1004e1d3
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov ecx, eax
test ecx, ecx
je 0x1004e1d3
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x17
xor eax, eax
mov byte [ebp - 4], 3
push str.root.cloudAppWebService
lea ecx, [ebp - 0x8b4]
mov dword [ebp - 0x8a0], 7
mov dword [ebp - 0x8a4], 0
mov word [ebp - 0x8b4], ax
call fcn.10021b80
cmp dword [ebp - 0x8a0], 8
mov eax, 0x2e
mov word [ebp - 0x89c], ax
lea eax, [ebp - 0x8b4]
cmovae eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x898], eax
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], 8
call fcn.100362b0
push eax
lea eax, [ebp - 0x8b4]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x868]
call fcn.10046ba0
mov esi, dword [ebp - 0x874]
mov edi, eax
mov byte [ebp - 4], 8
test esi, esi
je 0x1004e27d
lea ecx, [esi + 9]
call fcn.10043400
push dword [esi + 4]
call fcn.1004ebb6
push 0x10
push esi
call fcn.1004f361
add esp, 0xc
mov eax, dword [ebp - 0x878]
cmp eax, 8
jb 0x1004e2df
mov ecx, dword [ebp - 0x88c]
inc eax
cmp eax, 0x7fffffff
jbe 0x1004e29b
call fcn.1006fbb9
add eax, eax
cmp eax, 0x1000
jb 0x1004e2d6
test byte [ebp - 0x88c], 0x1f
je 0x1004e2b2
call fcn.1006fbb9
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x1004e2be
call fcn.1006fbb9
sub ecx, eax
cmp ecx, 4
jae 0x1004e2ca
call fcn.1006fbb9
cmp ecx, 0x23
jbe 0x1004e2d4
call fcn.1006fbb9
mov ecx, eax
push ecx
call fcn.1004ebb6
add esp, 4
xor eax, eax
mov dword [ebp - 0x878], 7
mov word [ebp - 0x88c], ax
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x87c], 0
mov byte [ebp - 4], 3
cmp eax, 8
jb 0x1004e362
mov ecx, dword [ebp - 0x8b4]
inc eax
cmp eax, 0x7fffffff
jbe 0x1004e31e
call fcn.1006fbb9
add eax, eax
cmp eax, 0x1000
jb 0x1004e359
test byte [ebp - 0x8b4], 0x1f
je 0x1004e335
call fcn.1006fbb9
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x1004e341
call fcn.1006fbb9
sub ecx, eax
cmp ecx, 4
jae 0x1004e34d
call fcn.1006fbb9
cmp ecx, 0x23
jbe 0x1004e357
call fcn.1006fbb9
mov ecx, eax
push ecx
call fcn.1004ebb6
add esp, 4
xor eax, eax
mov dword [ebp - 0x8a0], 7
push 4
push str.Port
lea ecx, [ebp - 0x8d4]
mov dword [ebp - 0x8a4], 0
mov word [ebp - 0x8b4], ax
mov dword [ebp - 0x8c0], 7
mov dword [ebp - 0x8c4], eax
mov word [ebp - 0x8d4], ax
call fcn.10021b80
cmp dword [ebp - 0x8c0], 8
mov eax, 0x2e
mov word [ebp - 0x8bc], ax
lea eax, [ebp - 0x8d4]
cmovae eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x8b8], eax
lea eax, [ebp - 0x8d4]
mov byte [ebp - 4], 0xa
push eax
mov ecx, edi
call fcn.10046a80
mov edi, eax
push 1
mov byte [ebp - 4], 0xb
call fcn.100506b3
push ecx
mov esi, eax
mov eax, esp
mov dword [ebp - 0x890], eax
mov dword [eax + 4], esi
mov ecx, esi
mov eax, dword [esi]
mov byte [ebp - 4], 0xc
call dword [eax + 4]
mov byte [ebp - 4], 0xd
test esi, esi
je 0x1004e423
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 8]
call eax
mov ecx, eax
test ecx, ecx
je 0x1004e423
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.1002e920
mov esi, eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x8c0]
cmp eax, 8
jb 0x1004e496
mov ecx, dword [ebp - 0x8d4]
inc eax
cmp eax, 0x7fffffff
jbe 0x1004e452
call fcn.1006fbb9
add eax, eax
cmp eax, 0x1000
jb 0x1004e48d
test byte [ebp - 0x8d4], 0x1f
je 0x1004e469
call fcn.1006fbb9
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x1004e475
call fcn.1006fbb9
sub ecx, eax
cmp ecx, 4
jae 0x1004e481
call fcn.1006fbb9
cmp ecx, 0x23
jbe 0x1004e48b
call fcn.1006fbb9
mov ecx, eax
push ecx
call fcn.1004ebb6
add esp, 4
lea eax, [ebp - 0x888]
push esi
push eax
call fcn.1004da80
add esp, 8
mov edi, eax
mov esi, 0x100c6d74
cmp edi, esi
je 0x1004e4ed
mov eax, dword [0x100c6d88]
cmp eax, 0x10
jb 0x1004e4ca
inc eax
mov ecx, esi
push eax
push dword [0x100c6d74]
call fcn.10002440
push edi
mov ecx, esi
mov dword [0x100c6d88], 0xf
mov dword [0x100c6d84], 0
mov byte [0x100c6d74], 0
call fcn.1001dae0
mov eax, dword [ebp - 0x874]
cmp eax, 0x10
jb 0x1004e50b
inc eax
lea ecx, [ebp - 0x888]
push eax
push dword [ebp - 0x888]
call fcn.10002440
push str.update_cloudapp_port:_parse_cloudAppWebService.Port_is
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x100c6d88], 0x10
cmovae esi, dword [0x100c6d74]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x868]
call fcn.10037d70
mov eax, dword [ebp - 0x838]
cmp eax, 8
jb 0x1004e554
inc eax
lea ecx, [ebp - 0x84c]
push eax
push dword [ebp - 0x84c]
call fcn.10023310
mov eax, dword [ebp - 0x820]
mov byte [ebp - 0x86d], 1
cmp eax, 8
jb 0x1004e5a3
inc eax
lea ecx, [ebp - 0x834]
push eax
push dword [ebp - 0x834]
call fcn.10023310
jmp 0x1004e5a3
mov ecx, dword [ebp - 0x86c]
test ecx, ecx
je 0x1004e5b4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x86d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1004ebbb
mov esp, ebp
pop ebp
ret