Function at 0x180049e0c
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rdi, rcx
lea rdx, [rax - 0x28]
lea rcx, [0x180162940]
call fcn.18001b758
mov rdx, qword [rax]
xor ebx, ebx
cmp dword [rdx - 8], ebx
sete bl
mov rdx, qword [rsp + 0x60]
add rdx, 0xfffffffffffffff4
lea r12, [0x18015f758]
or esi, 0xffffffff
cmp rdx, r12
je 0x180049e74
mov eax, esi
lock xadd dword [rdx], eax
add eax, esi
test eax, eax
jg 0x180049e74
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
test ebx, ebx
je 0x180049e92
lea rdx, str.CDataIEStartEntity::RestoreEntry_____Start_page_is_empty._Not_restoring...
lea rcx, [0x18015f578]
call fcn.1800098e8
xor eax, eax
jmp 0x18004a0e3
lea rcx, [0x180162940]
call fcn.18000491c
test eax, eax
jne 0x180049ebc
lea rdx, str.CDataIEStartEntity::RestoreEntry_____Start_Installed_flag_is_set_to_False._Not_restoring...
lea rcx, [0x18015f578]
call fcn.1800098e8
xor eax, eax
jmp 0x18004a0e3
lea rcx, [0x180162138]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1801620e0]
lea rcx, [0x180162138]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0x180049efa
lea rdx, str.CDataIEStartEntity::RestoreEntity_____IE_Not_enabled._Not_restoring...
lea rcx, [0x18015f578]
call fcn.1800098e8
xor eax, eax
jmp 0x18004a0e3
lea rdx, str._t_t_tCDataIEStartEntity_:_Restoring_entity...
lea rcx, [0x18015f578]
call fcn.1800098e8
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
lea rcx, [rsp + 0x58]
call fcn.1800041c0
nop
lea rdx, [rsp + 0x50]
lea rcx, [0x180162940]
call fcn.18001b758
nop
and qword [rsp + 0xa8], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18004a00b
mov qword [rsp + 0x28], rbx
mov rax, qword [rdi + 0x60]
mov qword [rsp + 0x20], rax
lea r9, str._t_t_tCannot_restore_entry__s._Err_:_Cannot_open_reg_key_:__s
mov r8d, 0xb6
lea rdx, str..DataIEStartEntity.cpp
lea rcx, [0x18015f578]
call fcn.18000b1e8
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, r12
je 0x180049fe2
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x180049fe2
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff4
cmp rcx, r12
je 0x18004a001
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x18004a001
call fcn.1800d1434
mov eax, 0x80004005
jmp 0x18004a0e3
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax - 8]
lea ecx, [rcx + rcx + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov ebx, 1
mov r9d, ebx
xor r8d, r8d
lea rdx, str.Start_Page
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.Start_Page_Redirect_Cache
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x98], ebx
lea r9d, [rbx + 3]
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.RunOnceComplete
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
cmp rcx, r12
je 0x18004a0c2
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x18004a0c2
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff4
cmp rcx, r12
je 0x18004a0e1
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x18004a0e1
call fcn.1800d1434
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop r12
pop rdi
pop rsi
ret