Function at 0x4321c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53f5b1
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x58f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x59aee4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test ecx, ecx
jne 0x4323e5
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x254], 0x104
mov dword [ebp - 0x258], 0
call fcn.0041f4d0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x43224f
push 0x80004005
call fcn.00419af0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x21c], esi
lea eax, [ebp - 0x258]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4323b8
mov edx, dword [ebp - 0x254]
test edx, edx
jns 0x4322a0
push 0x80070057
call fcn.00419af0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4322c3
push edx
lea ecx, [ebp - 0x21c]
call fcn.004233d0
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x254]
push eax
push esi
push 0
push 0
push str.svcVersion
push dword [ebp - 0x258]
call edi
test eax, eax
jne 0x43232c
cmp dword [ebp - 0x254], eax
jbe 0x4323ac
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0x59aee4
push str._d._d._d._d
push esi
call fcn.004320a0
add esp, 0x18
cmp eax, 4
je 0x4323ac
mov dword [0x59aee4], 0
jmp 0x4323ac
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x254]
lea ecx, [ebp - 0x21c]
call fcn.004226f0
push eax
push 0
push 0
push str.Version
push dword [ebp - 0x258]
call edi
test eax, eax
jne 0x4323a6
cmp dword [ebp - 0x254], eax
jbe 0x4323a6
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
push 0x59aee4
push str._d._d._d._d
push esi
call fcn.004320a0
mov ecx, dword [0x59aee4]
xor edx, edx
add esp, 0x18
cmp eax, 4
cmovne ecx, edx
mov dword [0x59aee4], ecx
jmp 0x4323ac
mov esi, dword [ebp - 0x21c]
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4323d7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x59aee4]
test ecx, ecx
je 0x43265a
cmp ecx, 7
jbe 0x43265a
cmp byte [0x59aee8], 0
jne 0x43265a
cmp ecx, 8
jne 0x43240c
mov dword [ebp - 0x220], 0x22b8
jmp 0x432421
xor eax, eax
cmp ecx, 9
setne al
lea eax, [eax*2 + 0x270f]
mov dword [ebp - 0x220], eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
mov dword [ebp - 4], 1
mov dword [ebp - 0x25c], 7
mov dword [ebp - 0x260], eax
mov word [ebp - 0x270], ax
cmp word [ebp - 0x218], ax
jne 0x43247d
xor ecx, ecx
jmp 0x432495
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432486
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x270]
call fcn.00412ae0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x270]
cmp dword [ebp - 0x25c], 8
cmovae eax, dword [ebp - 0x270]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, eax
cmp word [edx], 0
jne 0x4324d3
xor ecx, ecx
jmp 0x4324ef
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4324e0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x248]
call fcn.00412ae0
mov eax, dword [ebp - 0x25c]
cmp eax, 8
jb 0x43251a
inc eax
lea ecx, [ebp - 0x270]
push eax
push dword [ebp - 0x270]
call fcn.004132e0
push 0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43263c
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x24c]
push ecx
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x230], eax
push ecx
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x24c], 4
push ecx
lea eax, [ebp - 0x248]
mov dword [ebp - 0x250], 4
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push dword [ebp - 0x21c]
call edi
cmp eax, 2
jne 0x4325d9
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x220]
push 4
push ecx
push 4
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x432630
jmp 0x43261d
test eax, eax
jne 0x432630
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x220]
je 0x432629
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x220]
push 4
push ecx
push 4
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x432629
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov byte [0x59aee8], 1
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x43265a
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.004132e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ce8d
mov esp, ebp
pop ebp
ret