Function at 0x10004afe
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x10054d20
call fcn.10013ac0
sub esp, 0x34c
push ebx
push esi
push edi
mov ebx, str.OSecurity
push str.AvoidSRPolicy_____
push ebx
mov esi, 0x10067f2c
push 0xf
push esi
call fcn.1000dfce
and byte [ebp - 0x358], 0
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0x357]
push 0x40
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x10058a7c
push str.SOFTWAREPoliciesMicrosoftWindowsSaferCodeIdentifiers
lea eax, [ebp - 0x358]
push 0x100603c0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.10029ac0
and dword [ebp - 4], 0
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x358]
push 0x2001f
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x20]
call fcn.10029be0
test eax, eax
mov dword [ebp - 0x28], eax
je 0x10004ed6
and byte [ebp - 0x254], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x253]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x3c]
stosb byte es:[edi], al
call sub.MFC42.DLL_CStringArray::CStringArray
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x20]
push eax
push str.Hashes
mov byte [ebp - 4], 1
call fcn.1002b850
test eax, eax
je 0x10004cda
xor edi, edi
cmp dword [0x10067cf4], edi
jbe 0x10004cdc
push str.AvoidSRPolicy_Hashes
push ebx
push 0xf
push esi
call fcn.1000dfce
add esp, 0x10
cmp dword [ebp - 0x34], edi
mov dword [ebp - 0x14], edi
jle 0x10004cdc
push 0x104
lea eax, [ebp - 0x254]
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
add esp, 0xc
push dword [eax + ecx*4]
lea eax, [ebp - 0x254]
push str.Hashes
push 0x100603c0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10004cc9
and byte [ebp - 0x44], al
mov dword [ebp - 0x24], edi
lea edi, [ebp - 0x43]
mov dword [ebp - 0x48], 0xb
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], 8
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push str.ItemSize
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [ebp - 0x44]
test eax, eax
je 0x10004c91
mov edi, dword [ebp - 0x24]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, dword [0x10067cf4]
jne 0x10004cc7
lea eax, [ebp - 0x254]
push 0
push eax
lea ecx, [ebp - 0x20]
call fcn.1002bcd0
or dword [ebp - 0x18], eax
push str.AvoidSRPolicy_Hashes_Delete
push ebx
push 0xf
push esi
call fcn.1000dfce
add esp, 0x10
xor edi, edi
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x34]
jl 0x10004bfd
jmp 0x10004cdc
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x3c]
call sub.MFC42.DLL_CStringArray::SetSize
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x20]
push eax
push str.Paths
call fcn.1002b850
test eax, eax
je 0x10004ec8
push 0x10067bf0
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x10004ec8
push str.AvoidSRPolicy_Paths
push ebx
push 0xf
push esi
call fcn.1000dfce
add esp, 0x10
cmp dword [ebp - 0x34], edi
mov dword [ebp - 0x14], edi
jle 0x10004ec8
push 0x104
lea eax, [ebp - 0x254]
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
add esp, 0xc
push dword [eax + ecx*4]
lea eax, [ebp - 0x254]
push str.Paths
push 0x100603c0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x254]
lea ecx, [ebp - 0x20]
push edi
push str.ItemData
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1002a060
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 2
cmp dword [eax - 8], edi
je 0x10004ead
push dword [0x10067be8]
push str._HKEY_
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0xc
test eax, eax
jne 0x10004dc7
push str.Winhlpsvr
push dword [ebp - 0x10]
call dword [sym.imp.MSVCRT.dll__mbsstr]
pop ecx
test eax, eax
pop ecx
je 0x10004ead
jmp 0x10004e85
and byte [ebp - 0x150], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x14f]
push 0x25
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x10]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::Find_1
cmp eax, 0xffffffff
push 0x104
jne 0x10004e07
push dword [ebp - 0x10]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
add esp, 0xc
jmp 0x10004e17
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x150], 0
je 0x10004eab
lea eax, [ebp - 0x150]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll__mbschr]
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x150]
push eax
jne 0x10004e47
push 0x10058abc
jmp 0x10004e78
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x150]
push eax
push 0x10067bf0
call dword [sym.imp.MSVCRT.dll__mbsnbicmp]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
jne 0x10004e83
lea eax, [ebp - 0x150]
push eax
push 0x10067bf0
call fcn.10008603
pop ecx
test eax, eax
pop ecx
je 0x10004eab
xor edi, edi
lea eax, [ebp - 0x254]
push edi
push eax
lea ecx, [ebp - 0x20]
call fcn.1002bcd0
or dword [ebp - 0x18], eax
push str.AvoidSRPolicy_Paths_Delete
push ebx
push 0xf
push esi
call fcn.1000dfce
add esp, 0x10
jmp 0x10004ead
xor edi, edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.100135b2
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x34]
jl 0x10004d30
and byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.100135ee
jmp 0x10004eee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AvoidSRPolicy_Open_failed__err___08x
push ebx
push 0xf
push esi
call fcn.1000dfce
add esp, 0x14
cmp dword [ebp - 0x28], 0
je 0x10004efc
lea ecx, [ebp - 0x20]
call fcn.10029c30
push str.AvoidSRPolicy_
push ebx
push 0xf
push esi
call fcn.1000dfce
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.10029b60
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret