Function at 0xa9d826
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push 0x4c
mov eax, 0xaff12c
call fcn.00af8df7
mov dword [ebp - 0x54], ecx
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
mov ebx, dword [ebp - 0x10]
test ebx, ebx
jne 0xb40b9e
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], edi
call fcn.00a9eff6
mov ecx, dword [ebp + 4]
test eax, eax
js 0xb40bb9
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathGetArgsW]
push 1
push 0xffffffffffffffff
push 0x9f3904
push 0xffffffffffffffff
push eax
call dword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
push 2
pop esi
mov ebx, eax
mov dword [ebp - 0x14], edi
sub ebx, esi
lea eax, [ebp - 0x14]
neg ebx
push eax
sbb ebx, ebx
and ebx, 0xfff00000
push edi
add ebx, 0x100000
call dword [sym.imp.api_ms_win_security_isolatedcontainer_l1_1_1.dll_IsProcessInWDAGContainer]
test eax, eax
mov eax, edi
js 0xa9d8ab
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
and eax, 0x80000
mov dword [ebp - 0x50], eax
call fcn.00a9f15b
test al, al
jne 0xb40bce
mov ecx, dword [ebp - 0x10]
call fcn.00a9efae
mov dword [ebp - 0x1c], edi
test al, al
jne 0xb40bce
call fcn.00a9f612
push edi
push edi
movzx eax, al
push edi
neg eax
push 0x9f38ec
sbb eax, eax
push 0x9f3848
and eax, 0x4000
push reloc.SHCORE.dll_Ordinal_1
mov dword [ebp - 0x4c], eax
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
neg eax
mov dword [ebp - 0x18], edi
sbb eax, eax
and eax, 0xffff8000
add eax, 0x8000
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USERENV.dll_GetProfileType]
test eax, eax
je 0xb40bda
mov eax, edi
mov ecx, dword [ebp + 4]
test eax, eax
js 0xb40bfe
test byte [ebp - 0x18], 1
mov dword [ebp - 0x18], 0x2000
jne 0xa9d946
mov dword [ebp - 0x18], edi
call fcn.00a9f51f
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x1000
mov dword [ebp - 0x44], eax
call fcn.00a9f201
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x800
mov dword [ebp - 0x40], eax
call fcn.00a9f4b4
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x400
mov dword [ebp - 0x3c], eax
call fcn.00a9f489
movzx eax, al
neg eax
push 0x43
sbb eax, eax
and eax, 0x200
mov dword [ebp - 0x38], eax
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
neg eax
sbb eax, eax
and eax, 0x100
mov dword [ebp - 0x34], eax
call fcn.00a9f3db
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x40
mov dword [ebp - 0x30], eax
call fcn.00ab1fc7
neg eax
push 0x1d
sbb eax, eax
and eax, 0x10
mov dword [ebp - 0x2c], eax
call dword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_IsOS]
neg eax
sbb eax, eax
and eax, 8
mov dword [ebp - 0x28], eax
call fcn.00a9dc5a
movzx eax, al
mov edx, 0x9f05b0
neg eax
sbb eax, eax
and eax, 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push ecx
push 0x9f382c
mov ecx, reloc.SHCORE.dll_Ordinal_1
call fcn.00a41860
test eax, eax
js 0xa9da14
cmp dword [ebp - 0x20], 0
je 0xa9da14
mov esi, edi
lea eax, [ebp - 0x24]
mov edx, 0x9f3758
push eax
push ecx
push 0x9f37c4
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00a41860
test eax, eax
js 0xb40c13
cmp dword [ebp - 0x24], 0
je 0xb40c13
or esi, edi
or esi, dword [ebp - 0x14]
or esi, dword [ebp - 0x28]
or esi, dword [ebp - 0x2c]
or esi, dword [ebp - 0x30]
or esi, dword [ebp - 0x34]
or esi, dword [ebp - 0x38]
or esi, dword [ebp - 0x3c]
or esi, dword [ebp - 0x40]
or esi, dword [ebp - 0x44]
or esi, dword [ebp - 0x18]
or esi, dword [ebp - 0x48]
or esi, dword [ebp - 0x4c]
or esi, dword [ebp - 0x1c]
or esi, dword [ebp - 0x50]
or esi, ebx
mov ebx, dword [ebp - 0x54]
or dword [ebx + 0x68], esi
test byte [0xc96fc4], 2
je 0xa9daa4
call fcn.00a9f39f
movzx esi, al
neg esi
sbb esi, esi
and esi, 0x20000
call fcn.00a9f361
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x10000
or esi, eax
or dword [ebx + 0x68], esi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0
je 0xa9dab7
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
call fcn.00af8dc0
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
jmp 0xa9d848
push eax
push 0x9f6984
mov edx, 0x3b5
call fcn.00ab606d
jmp 0xa9d85e
mov dword [ebp - 0x1c], 0x40000
jmp 0xa9d8d7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0xb40bee
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0xa9d92b
mov eax, 0x80004005
jmp 0xa9d92b
push eax
push 0x9f6984
mov edx, 0x2d9
call fcn.00ab606d
jmp 0xa9d943
xor edi, edi
inc edi
jmp 0xa9da3f