Function at 0x402ce0
Capabilities:
Create process on windows
Create process suspended
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1bc
mov ebx, dword [0x49c0c8]
test ebx, ebx
je 0x403750
mov ecx, dword [0x49c0c4]
test ecx, ecx
je 0x403750
lea ebx, [ebp - 0x178]
mov dword [esp + 4], str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
mov dword [esp + 8], ebx
mov dword [esp], 0x80000001
call sub.advapi32.dll_RegOpenKeyA
sub esp, 0xc
mov dword [ebp - 0x18c], eax
test eax, eax
jne 0x403305
mov edx, dword [0x49c0c0]
test edx, edx
je 0x4034b0
lea ebx, [ebp - 0x11c]
mov dword [esp + 8], 0x104
lea edi, [ebp - 0x174]
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
sub esp, 0xc
mov esi, eax
mov dword [esp + 4], 0x73e
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.GetModuleFileName_failed:__d_n
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.0045a820
mov dword [esp], ebx
mov dword [esp + 4], 0x5c
call dword [sym.imp.msvcrt.dll_strrchr]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
add eax, 1
mov dword [esp], 0x80000001
mov dword [ebp - 0x17c], eax
call sub.advapi32.dll_RegOpenKeyA
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0x744
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], 0x45d74d
lea ebx, [ebp - 0x170]
mov dword [esp], eax
call fcn.0045a820
mov eax, dword [ebp - 0x174]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.FEATURE_BEHAVIORS
mov dword [esp], eax
call sub.advapi32.dll_RegOpenKeyA
sub esp, 0xc
test eax, eax
jne 0x403780
mov eax, dword [ebp - 0x17c]
lea esi, [ebp - 0x160]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x170]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [ebp - 0x160], 0
call sub.advapi32.dll_RegSetValueExA
sub esp, 0x18
mov dword [ebp - 0x180], eax
mov dword [esp + 4], 0x751
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword [ebp - 0x180]
mov dword [esp + 4], 0x45d83c
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0045a820
mov dword [esp + 4], 2
mov dword [esp], 6
call dword [0x49c0c8]
sub esp, 8
mov dword [ebp - 0x180], eax
mov dword [esp + 4], 0x754
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword [ebp - 0x180]
mov dword [esp + 4], str.CoInternetIsFeatureEnabled_returned__08x__expected_S_FALSE_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0045a820
mov eax, dword [ebp - 0x17c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 0x170]
sub esp, 8
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
mov dword [esp + 4], 2
mov dword [esp], 6
call dword [0x49c0c8]
sub esp, 8
mov dword [ebp - 0x17c], eax
mov dword [esp + 4], 0x760
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword [ebp - 0x17c]
mov dword [esp + 4], str.CoInternetIsFeatureEnabled_returned__08x__expected_S_FALSE_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0045a820
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], 6
call dword [0x49c0c4]
sub esp, 0xc
mov dword [ebp - 0x17c], eax
mov dword [esp + 4], 0x764
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword [ebp - 0x17c]
mov dword [esp + 4], str.CoInternetSetFeatureEnabled_failed:__08x_n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0045a820
mov eax, dword [ebp - 0x174]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
mov dword [esp + 8], edi
mov dword [esp + 4], str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegOpenKeyA
sub esp, 0xc
mov edi, eax
mov dword [esp + 4], 0x769
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
xor eax, eax
test edi, edi
mov dword [esp + 8], edi
sete al
mov dword [esp + 4], 0x45d8be
mov dword [esp], eax
call fcn.0045a820
mov eax, dword [ebp - 0x174]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.FEATURE_ZONE_ELEVATION
mov dword [esp], eax
call sub.advapi32.dll_RegOpenKeyA
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0x76c
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], 0x45d8be
mov dword [esp], eax
call fcn.0045a820
mov eax, dword [ebp - 0x170]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x45d8ec
mov dword [esp], eax
mov dword [ebp - 0x160], 1
call sub.advapi32.dll_RegSetValueExA
sub esp, 0x18
mov ebx, eax
cmp eax, 5
je 0x4038d5
mov dword [esp + 4], 0x778
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], 0x45d83c
mov dword [esp], eax
call fcn.0045a820
mov dword [esp + 4], 2
mov dword [esp], 1
call dword [0x49c0c8]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], 0x77b
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.CoInternetIsFeatureEnabled_returned__08x__expected_S_OK_n
mov dword [esp], eax
call fcn.0045a820
mov eax, dword [ebp - 0x170]
mov dword [esp + 4], 0x45d8ec
mov dword [esp], eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 0x170]
sub esp, 8
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x174]
sub esp, 4
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
mov dword [esp + 4], 2
mov dword [esp], 1
call dword [0x49c0c8]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], 0x785
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.CoInternetIsFeatureEnabled_returned__08x__expected_S_OK_n
mov dword [esp], eax
call fcn.0045a820
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 1
call dword [0x49c0c4]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0x788
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.CoInternetSetFeatureEnabled_failed:__08x_n
mov dword [esp], eax
call fcn.0045a820
mov ebx, 0x45eec8
xor esi, esi
xor edx, edx
mov eax, 2
mov dword [ebp - 0x17c], 0
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [0x49c0c8]
sub esp, 8
mov dword [ebp - 0x180], eax
test esi, esi
je 0x40327b
mov esi, dword [str.windows]
mov edi, 0x45d951
mov ecx, 5
repe cmpsb byte [esi], byte es:[edi]
seta al
sbb al, 0
test al, al
sete al
movzx eax, al
mov esi, eax
mov dword [esp], esi
call fcn.0045a990
mov esi, dword [ebp - 0x180]
jmp 0x4032d5
mov dword [esp + 4], 0x71b
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword [ebx]
mov edx, dword [ebp - 0x17c]
mov dword [esp + 8], esi
mov dword [esp + 4], str.CoInternetIsFeatureEnabled_returned__08x__expected__08x_on_test__d_n
cmp esi, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 0x10], edx
movzx eax, al
mov dword [esp], eax
call fcn.0045a820
call fcn.0045a9e0
call fcn.0045a9c0
test eax, eax
jne 0x403290
add dword [ebp - 0x17c], 1
mov eax, dword [ebp - 0x17c]
add ebx, 0x10
cmp eax, 0x1c
je 0x4034d0
mov eax, dword [ebx - 4]
mov edx, dword [ebx - 8]
mov esi, dword [ebx + 4]
jmp 0x403240
xor eax, eax
lea edi, [ebp - 0x160]
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
mov dword [esp], 0x80000001
call sub.advapi32.dll_RegCreateKeyA
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0x7cd
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
xor eax, eax
test ebx, ebx
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], 0x45d74d
lea ebx, [ebp - 0x11c]
mov dword [esp], eax
call fcn.0045a820
mov dword [esp + 4], 0x7cf
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov dword [esp], str.Running_features_tests_in_a_separated_process._n
call fcn.0045a850
lea eax, [ebp - 0x174]
mov dword [esp], eax
call fcn.0045aaa0
mov eax, dword [ebp - 0x174]
mov edx, dword [eax + 4]
mov dword [esp + 0xc], edx
mov eax, dword [eax]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.__s___s_internet_features
call fcn.00402100
lea eax, [ebp - 0x170]
mov dword [esp + 4], ebx
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x160]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x174]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
sub esp, 0x28
mov ebx, eax
mov dword [esp + 4], 0x7d4
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp], ebx
mov dword [esp + 4], str.Could_not_create_process:__u_n
mov dword [esp + 8], eax
call fcn.0045a820
mov dword [esp + 4], 0x7d5
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call fcn.0045ab00
mov eax, dword [ebp - 0x16c]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x170]
sub esp, 4
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [esp + 4], str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
mov dword [esp], 0x80000001
call sub.advapi32.dll_RegDeleteKeyA
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x739
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov dword [esp], str.Skipping_internet_feature_registry_tests__IE_is_too_old..._n
call fcn.0045a930
mov dword [esp + 4], 2
mov dword [esp], 0x1c
call dword [0x49c0c8]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], 0x792
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
xor eax, eax
cmp ebx, 0x80004005
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.CoInternetIsFeatureEnabled_returned__08x__expected_E_FAIL_n
mov dword [esp], eax
call fcn.0045a820
mov dword [esp + 8], 1
mov dword [esp + 4], 2
mov dword [esp], 0x1c
call dword [0x49c0c4]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 4], 0x7a9
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
xor eax, eax
cmp ebx, 0x80004005
mov dword [esp + 8], ebx
sete al
mov dword [esp + 4], str.CoInternetSetFeatureEnabled_returned__08x__expected_E_FAIL_n
mov ebx, 0x45ee60
xor esi, esi
mov dword [esp], eax
call fcn.0045a820
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 2
mov dword [ebp - 0x17c], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x184]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x188]
mov dword [esp], eax
call dword [0x49c0c4]
sub esp, 0xc
mov dword [ebp - 0x18c], eax
test esi, esi
je 0x4035f2
mov esi, dword [str.windows]
mov edi, 0x45d951
mov ecx, 5
repe cmpsb byte [esi], byte es:[edi]
seta al
sbb al, 0
test al, al
sete al
movzx eax, al
mov esi, eax
mov dword [esp], esi
call fcn.0045a990
mov esi, dword [ebp - 0x18c]
jmp 0x403648
mov dword [esp + 4], 0x7af
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x17c]
mov dword [esp + 8], esi
mov dword [esp + 4], str.CoInternetSetFeatureEnabled_returned__08x__expected__08x_on_test__d_n
cmp esi, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 0x10], ecx
movzx eax, al
mov dword [esp], eax
call fcn.0045a820
call fcn.0045a9e0
call fcn.0045a9c0
test eax, eax
jne 0x403602
mov eax, dword [ebp - 0x184]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x188]
mov dword [esp], eax
call dword [0x49c0c8]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x180]
sub esp, 8
test eax, eax
je 0x4036a2
mov esi, dword [str.windows]
mov edi, 0x45d951
mov ecx, 5
repe cmpsb byte [esi], byte es:[edi]
seta al
sbb al, 0
test al, al
sete al
movzx eax, al
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov dword [esp], eax
call fcn.0045a990
mov esi, dword [ebp - 0x184]
jmp 0x403706
mov dword [esp + 4], 0x7b4
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword [ebx + 0x18]
mov edx, dword [ebp - 0x17c]
mov dword [esp + 8], esi
mov dword [esp + 4], str.CoInternetIsFeatureEnabled_returned__08x__expected__08x_on_test__d_n
cmp esi, eax
mov dword [esp + 0xc], eax
sete al
mov dword [esp + 0x10], edx
movzx eax, al
mov dword [esp], eax
call fcn.0045a820
call fcn.0045a9e0
call fcn.0045a9c0
test eax, eax
jne 0x4036c0
add dword [ebp - 0x17c], 1
mov eax, dword [ebp - 0x17c]
add ebx, 0x20
cmp eax, 3
je 0x4034a1
mov ecx, dword [ebx + 4]
mov edi, dword [ebx]
mov edx, dword [ebx + 0x1c]
mov eax, dword [ebx + 8]
mov dword [ebp - 0x184], ecx
mov esi, dword [ebx + 0x10]
mov dword [ebp - 0x188], edi
mov dword [ebp - 0x180], edx
jmp 0x4035a7
mov dword [esp + 4], 0x7bf
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov dword [esp], str.Skipping_internet_feature_tests__IE_is_too_old_n
call fcn.0045a930
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x174]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.FEATURE_BEHAVIORS
mov dword [esp], eax
call sub.advapi32.dll_RegCreateKeyA
sub esp, 0xc
mov esi, eax
mov dword [esp + 4], 0x74c
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
xor eax, eax
test esi, esi
mov dword [esp + 8], esi
sete al
mov dword [esp + 4], 0x45d74d
lea esi, [ebp - 0x160]
mov dword [esp], eax
call fcn.0045a820
mov eax, dword [ebp - 0x17c]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x170]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [ebp - 0x160], 0
call sub.advapi32.dll_RegSetValueExA
sub esp, 0x18
mov dword [ebp - 0x17c], eax
mov dword [esp + 4], 0x751
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword [ebp - 0x17c]
mov dword [esp + 4], 0x45d83c
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0045a820
mov dword [esp + 4], 2
mov dword [esp], 6
call dword [0x49c0c8]
sub esp, 8
mov dword [ebp - 0x17c], eax
mov dword [esp + 4], 0x754
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov eax, dword [ebp - 0x17c]
mov dword [esp + 4], str.CoInternetIsFeatureEnabled_returned__08x__expected_S_FALSE_n
cmp eax, 1
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0045a820
mov eax, dword [ebp - 0x170]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x174]
sub esp, 4
mov dword [esp + 4], str.FEATURE_BEHAVIORS
mov dword [esp], eax
call sub.advapi32.dll_RegDeleteKeyA
sub esp, 8
jmp 0x402f35
mov dword [esp + 4], 0x772
mov dword [esp], str..._wine_dlls_urlmon_tests_misc.c
call fcn.0045a5b0
mov dword [esp], str.Not_allowed_to_modify_zone_elevation_n
call fcn.0045a910
mov eax, dword [ebp - 0x170]
mov dword [esp + 4], 0x45d8ec
mov dword [esp], eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 0x170]
sub esp, 8
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x174]
sub esp, 4
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x403228