Function at 0x418094
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46702b
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x48e190]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
push esi
push edi
mov eax, dword [0x48e190]
xor eax, esp
push eax
lea eax, [esp + 0x2b0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
xor ebx, ebx
push ebx
lea ecx, [esp + 0x8c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0xa4], 0xf
call fcn.0040a1d7
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x2bc], ebx
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x100
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0041f461
mov byte [esp + 0x2b8], 1
push dword [eax]
lea eax, [esp + 0x44]
call fcn.00408208
lea edx, [esp + 0x40]
lea ecx, [esp + 0x24]
mov byte [esp + 0x2b8], 2
call fcn.0042c6ca
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x2c4], 3
call fcn.0040932b
push ebx
push 1
lea ecx, [esp + 0x2c]
call fcn.0040949a
push ebx
push 1
lea esi, [esp + 0x48]
call fcn.00409732
lea eax, [esp + 0x1c]
mov byte [esp + 0x2b8], bl
call fcn.0040ecd4
cmp dword [esp + 0xa0], 0x10
mov eax, dword [esp + 0x8c]
jae 0x4181ba
lea eax, [esp + 0x8c]
push eax
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy_S
lea esi, [esp + 0x74]
call fcn.0042ca5a
pop ecx
pop ecx
mov byte [esp + 0x2b8], 4
cmp dword [esp + 0x84], 8
mov eax, dword [esp + 0x70]
jae 0x4181e5
lea eax, [esp + 0x70]
push eax
lea esi, [edi + 0x1ac]
push str.RegisterElevationPolicy:__S
mov dword [esp + 0x28], esi
call fcn.00409019
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
push dword [esp + 0x1c]
lea esi, [esp + 0x30]
push str.Failed_to_create_key_for__s_elevation_policy
mov byte [esp + 0x2c8], 5
call fcn.0042c8fb
add esp, 0x10
mov esi, eax
mov byte [esp + 0x2b8], 6
cmp dword [esp + 0x84], 8
mov eax, dword [esp + 0x70]
jae 0x41823b
lea eax, [esp + 0x70]
push eax
xor eax, eax
cmp byte [edi + 0x59], bl
lea ecx, [esp + 0x60]
sete al
add eax, 0x80000001
push eax
mov eax, 0x2001f
call fcn.0040ca9e
push eax
mov eax, esi
call fcn.00429dfd
pop ecx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2c0], 5
call fcn.0040949a
push dword [esp + 0x14]
lea esi, [esp + 0x28]
push str.Failed_to_create_AppName_for__s_elevation_policy
call fcn.0042c8fb
pop ecx
pop ecx
mov esi, eax
push edi
push dword [esp + 0x18]
lea eax, [esp + 0x64]
push str.AppName
push eax
mov byte [esp + 0x2c8], 7
call fcn.0040ca68
push eax
mov eax, esi
call fcn.00429dfd
pop ecx
push ebx
push edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2c0], 5
call fcn.0040949a
push dword [esp + 0x14]
lea esi, [esp + 0x28]
push str.Failed_to_create_Policy_for__s_elevation_policy
call fcn.0042c8fb
pop ecx
pop ecx
mov esi, eax
push 4
lea eax, [esp + 0x20]
push eax
push 4
push ebx
mov byte [esp + 0x2c8], 8
push str.Policy
push dword [esp + 0x70]
mov dword [esp + 0x34], 3
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
mov eax, esi
call fcn.00429dfd
pop ecx
push ebx
push edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2c0], 5
call fcn.0040949a
push dword [esp + 0x14]
lea esi, [esp + 0x28]
push str.Failed_to_create_AppPath_for__s_elevation_policy
call fcn.0042c8fb
pop ecx
pop ecx
mov esi, eax
mov byte [esp + 0x2b8], 9
push edi
push dword [esp + 0x1c]
lea eax, [esp + 0x64]
push str.AppPath
push eax
call fcn.0040ca68
push eax
mov eax, esi
call fcn.00429dfd
pop ecx
push ebx
push edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2c0], 5
call fcn.0040949a
lea esi, [esp + 0x5c]
call fcn.0040cb8b
push str.ieframe.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x18], eax
cmp eax, ebx
je 0x4183c1
push str.IERefreshElevationPolicy
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x41839e
call eax
jmp 0x4183a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jg 0x4183ac
mov esi, eax
jmp 0x4183b5
movzx esi, ax
or esi, 0x80070000
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4183d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jg 0x4183cf
mov esi, eax
jmp 0x4183d8
movzx esi, ax
or esi, 0x80070000
cmp esi, ebx
jge 0x4183ed
push esi
mov esi, dword [esp + 0x24]
push str.WARNING:_RefreshPolicies_failed___HR0x_X
call fcn.00409019
pop ecx
pop ecx
lea esi, [esp + 0x5c]
call fcn.0040cb8b
push ebx
push edi
lea esi, [esp + 0x74]
call fcn.00409732
push ebx
push edi
lea ecx, [esp + 0x90]
call fcn.0040949a
mov ecx, dword [esp + 0x2b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.00447c3d
mov esp, ebp
pop ebp
ret 8