Function at 0x1000ee22
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1058
call fcn.1002b1b0
mov eax, dword [0x10065040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x10067a80]
mov ecx, dword [0x10066de4]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1000eed6
mov esi, dword [ebp + 8]
cmp byte [0x10067a7f], 0
js 0x1000ee90
mov eax, dword [0x10067a7c]
mov dword [esi + 8], eax
movsd xmm0, qword [0x10067a74]
movsd qword [esi], xmm0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002aa2a
mov eax, esi
add esp, 0x1058
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
push dword [0x10067a78]
push dword [0x10067a74]
call fcn.10028af6
jmp 0x1000ee79
xorps xmm0, xmm0
movsd qword [0x10067a74], xmm0
mov dword [0x10067a7c], 0
push 0x1000f130
call fcn.1002a1fa
add esp, 4
push 0x10067a80
call fcn.1002a194
add esp, 4
jmp 0x1000ee59
push 0x10067a80
call fcn.1002a11a
add esp, 4
cmp dword [0x10067a80], 0xffffffff
jne 0x1000ee59
mov edi, 0xffffffa0
jmp 0x1000ef11
cmp dword [ebp - 0x1064], 0
je 0x1000ef0c
push dword [ebp - 0x1064]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 0xc
je 0x1000eea5
mov eax, dword [edi + 0x1005da74]
mov ecx, dword [edi + str.SoftwarePoliciesMicrosoftInternet_ExplorerMainEnterpriseMode]
xor esi, esi
mov dword [ebp - 0x1058], esi
lea edx, [ebp - 0x1058]
push edx
push 0x20119
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000ef0c
mov ebx, dword [ebp - 0x1058]
mov esi, 0x1048
push esi
xor eax, eax
push eax
lea eax, [ebp - 0x1058]
push eax
call fcn.1002dc40
add esp, 0xc
mov eax, dword [edi + 0x1005da78]
mov dword [ebp - 0x105c], 0xffffffff
mov dword [ebp - 0x1060], esi
lea ecx, [ebp - 0x1060]
push ecx
lea ecx, [ebp - 0x1058]
push ecx
lea ecx, [ebp - 0x105c]
push ecx
xor ecx, ecx
push ecx
push eax
mov dword [ebp - 0x1064], ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000eef7
mov eax, dword [ebp - 0x105c]
add eax, 0xfffffffd
cmp eax, 0xfffffffe
jb 0x1000eef7
mov eax, dword [ebp - 0x1060]
test eax, eax
je 0x1000efd5
test al, 1
jne 0x1000eef7
cmp word [ebp + eax - 0x105a], 0
jne 0x1000eef7
jmp 0x1000efde
mov word [ebp - 0x1058], 0
xor eax, eax
mov dword [ebp - 0x105c], eax
lea ecx, [ebp - 0x105c]
push ecx
push eax
push 0x104
lea eax, [ebp - 0x1058]
push eax
call sub.urlmon.dll_CreateUri
test eax, eax
je 0x1000f058
xorps xmm0, xmm0
movsd qword [0x10067a74], xmm0
mov dword [0x10067a7c], 0
mov esi, dword [ebp - 0x105c]
test esi, esi
je 0x1000f03a
mov dword [ebp - 0x105c], 0
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [0x10060ec8]
push esi
call ecx
cmp dword [ebp - 0x1064], 0
je 0x1000eeba
push dword [ebp - 0x1064]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000eeba
mov dword [ebp - 0x1060], 0
mov esi, dword [ebp - 0x105c]
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
call dword [0x10060ec8]
lea eax, [ebp - 0x1060]
push eax
push esi
call ecx
mov esi, dword [ebp - 0x1060]
test eax, eax
je 0x1000f093
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1000f003
test esi, esi
je 0x1000f11d
push esi
call fcn.100406c7
add esp, 4
cmp eax, 0x7ffffff8
jae 0x1000f11f
mov ebx, eax
cmp eax, 4
jbe 0x1000f0df
mov edi, ebx
or edi, 3
inc edi
js 0x1000f129
lea eax, [edi + edi]
push eax
call fcn.1002a04f
add esp, 4
mov dword [0x10067a74], eax
or edi, 0x80000000
mov dword [0x10067a7c], edi
mov dword [0x10067a78], ebx
jmp 0x1000f0ea
mov byte [0x10067a7f], bl
mov eax, 0x10067a74
lea edi, [eax + ebx*2]
cmp eax, esi
seta cl
cmp edi, esi
setbe dl
or dl, cl
je 0x1000f11d
test ebx, ebx
je 0x1000f10c
add ebx, ebx
push ebx
push esi
push eax
call fcn.1002d6c0
add esp, 0xc
mov word [edi], 0
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1000f018
ud2
mov ecx, 0x10067a74
call fcn.10006364
call fcn.1005282d
int3