Function at 0x4278c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe43c
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
mov dword [ebp - 0x54], esi
call fcn.004d4853
xor edi, edi
add esp, 4
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 4], edi
lea ebx, [ebp - 0x30]
call fcn.004012e0
mov byte [ebp - 4], 1
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], 2
cmp dword [esi + 0x30], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x58], ebx
jb 0x42793b
mov eax, dword [esi + 0x1c]
jmp 0x42793e
lea eax, [esi + 0x1c]
push eax
mov ecx, ebx
lea edx, [ebp - 0x44]
call fcn.004d0a50
test eax, eax
jne 0x42796a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.In_CAERnswareManager::DisableMacrosAndActivex___SetMsOfficeProtection___failed__error:_d
mov ecx, esi
call fcn.004015d0
add esp, 8
mov dword [ebp - 0x50], 1
cmp dword [esi + 0x30], 8
jb 0x427975
mov eax, dword [esi + 0x1c]
jmp 0x427978
lea eax, [esi + 0x1c]
mov edi, dword [ebp - 0x4c]
mov edx, edi
sub edx, eax
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x427980
lea eax, [ebp - 0x48]
push eax
push 1
push 0
push edi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x427a02
mov edi, dword [ebp - 0x48]
push str.In_CAERnswareManager::BackupRegKey__
mov ecx, esi
call fcn.004015d0
add esp, 4
test ebx, ebx
je 0x4279ce
test edi, edi
je 0x4279ee
push str.SoftwareMicrosoftOfficeCommonSecurity
push ebx
mov edx, str.SoftwareAEBackupMSOfficeActivex_backup
jmp 0x4279de
test edi, edi
je 0x4279ee
push str.SoftwareAEBackupMSOfficeActivex_backup
push 0
mov edx, str.SoftwareMicrosoftOfficeCommonSecurity
push esi
mov ecx, str.DisableAllActiveX
mov ebx, edi
call fcn.00427d40
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x48], 0
test ebx, ebx
je 0x427aac
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x427a10
mov edx, dword [0x504a74]
mov dword [edi], edx
mov edi, dword [ebp - 0x4c]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x427a30
push 0
lea eax, [ebp - 0x48]
push eax
push 0
push 2
push 0
push 0
mov ecx, 0x15
mov esi, str.SoftwareMicrosoftOfficeCommonSecurity
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x4c]
push 0
push esi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x427a9a
mov edx, dword [ebp - 0x48]
push 4
lea ecx, [ebp - 0x58]
push ecx
push 4
push eax
push str.DisableAllActiveX
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x427a8e
mov dword [ebp - 0x50], 1
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x427aac
mov ecx, dword [ebp - 0x54]
push eax
push esi
push str.In_CAERnswareManager::DisableMacrosAndActivex__._RegCreateKeyEx_failed__key:_s__error_:__ld
call fcn.004015d0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
push ecx
call fcn.004ca500
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 4