Function at 0x4de0ac
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [0x654b34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x684], eax
mov dword [ebp - 0x678], ebx
mov dword [ebp - 0x674], ebx
mov dword [ebp - 0x670], ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x4de40b
test edi, edi
je 0x4de40b
push 0x104
push edi
call fcn.005766e5
pop ecx
pop ecx
push 0x20019
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy_
push esi
lea ecx, [ebp - 0x678]
mov dword [ebp - 0x660], eax
call fcn.004186bb
test eax, eax
jne 0x4de40b
push 0x200
lea eax, [ebp - 0x204]
mov dword [ebp - 0x618], 0x100
push ebx
push eax
call fcn.0056dc10
mov eax, dword [ebp - 0x678]
add esp, 0xc
mov esi, ebx
mov dword [ebp - 0x668], ebx
mov dword [ebp - 0x66c], eax
lea ecx, [ebp - 0x650]
push ecx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x618]
push ecx
lea ecx, [ebp - 0x204]
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4de400
push 0x20019
lea eax, [ebp - 0x204]
mov dword [ebp - 0x65c], ebx
push eax
push dword [ebp - 0x66c]
lea ecx, [ebp - 0x65c]
mov dword [ebp - 0x658], ebx
mov dword [ebp - 0x654], ebx
call fcn.004186bb
test eax, eax
jne 0x4de397
push 0x208
lea eax, [ebp - 0x614]
push ebx
push eax
call fcn.0056dc10
push 0x208
lea eax, [ebp - 0x40c]
push ebx
push eax
call fcn.0056dc10
add esp, 0x18
lea ecx, [ebp - 0x65c]
mov eax, 0x104
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x680], eax
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x614]
push eax
push str.AppPath
call fcn.004de883
test eax, eax
jne 0x4de38c
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x40c]
push eax
push str.AppName
lea ecx, [ebp - 0x65c]
call fcn.004de883
test eax, eax
jne 0x4de38c
push dword [ebp - 0x660]
lea eax, [ebp - 0x40c]
push eax
push edi
call fcn.0057f1fe
add esp, 0xc
test eax, eax
jne 0x4de38c
lea eax, [ebp - 0x40c]
push 0x104
push eax
call fcn.005766e5
pop ecx
pop ecx
cmp eax, dword [ebp - 0x660]
jne 0x4de38c
push dword [ebp - 0x684]
lea ecx, [ebp - 0x648]
call fcn.00417c00
cmp dword [ebp - 0x634], 8
lea ecx, [ebp - 0x648]
mov eax, dword [ebp - 0x638]
cmovae ecx, dword [ebp - 0x648]
push 0x5c
pop edx
cmp word [ecx + eax*2 - 2], dx
je 0x4de2c7
mov esi, 0x60de24
push esi
call fcn.005765bd
pop ecx
push eax
push esi
lea ecx, [ebp - 0x648]
call fcn.0041d7bf
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x630]
call fcn.00417c00
mov edx, dword [ebp - 0x61c]
lea eax, [ebp - 0x630]
mov esi, dword [ebp - 0x620]
cmp edx, 8
push 0x5c
cmovae eax, dword [ebp - 0x630]
pop ecx
cmp word [eax + esi*2 - 2], cx
je 0x4de324
mov esi, 0x60de24
push esi
call fcn.005765bd
pop ecx
push eax
push esi
lea ecx, [ebp - 0x630]
call fcn.0041d7bf
mov edx, dword [ebp - 0x61c]
mov esi, dword [ebp - 0x620]
cmp dword [ebp - 0x634], 8
lea ecx, [ebp - 0x648]
mov eax, dword [ebp - 0x638]
cmovae ecx, dword [ebp - 0x648]
cmp edx, 8
mov dword [ebp - 0x664], eax
lea eax, [ebp - 0x630]
push dword [ebp - 0x664]
cmovae eax, dword [ebp - 0x630]
push ecx
push eax
call fcn.0057f1fe
add esp, 0xc
test eax, eax
jne 0x4de370
cmp esi, dword [ebp - 0x664]
je 0x4de3d1
lea ecx, [ebp - 0x630]
call fcn.00417a51
lea ecx, [ebp - 0x648]
call fcn.00417a51
mov esi, dword [ebp - 0x668]
lea ecx, [ebp - 0x65c]
call fcn.00418632
inc esi
mov dword [ebp - 0x618], 0x100
mov dword [ebp - 0x668], esi
lea eax, [ebp - 0x204]
mov ecx, 0x200
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x4de3b3
lea ecx, [ebp - 0x65c]
call fcn.00418632
mov eax, dword [ebp - 0x66c]
jmp 0x4de159
xor ebx, ebx
lea ecx, [ebp - 0x65c]
inc ebx
call fcn.00418632
lea ecx, [ebp - 0x630]
call fcn.00417a51
lea ecx, [ebp - 0x648]
call fcn.00417a51
lea ecx, [ebp - 0x65c]
call fcn.00418632
lea ecx, [ebp - 0x678]
call fcn.00418632
lea ecx, [ebp - 0x678]
call fcn.00418632
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056ac5f
leave
ret 0xc