Function at 0x41d865
Capabilities:
Set registry value

Disassembly:
push 0x278
mov eax, 0x46ec02
call fcn.004492af
mov edi, ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x254], 0xf
mov dword [ebp - 0x258], eax
mov byte [ebp - 0x268], al
mov dword [ebp - 4], eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x100
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x284]
call fcn.0040dae5
push dword [eax]
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 1
call fcn.00403a00
lea eax, [ebp - 0x280]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.0040eb50
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x268]
call fcn.00404e18
push 0
push 1
lea ecx, [ebp - 0x238]
call fcn.00408c45
push 0
push 1
lea ecx, [ebp - 0x280]
call fcn.00408c9a
mov ecx, dword [ebp - 0x284]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.0040e07f
cmp dword [ebp - 0x254], 0x10
lea eax, [ebp - 0x268]
cmovae eax, dword [ebp - 0x268]
push eax
lea eax, [ebp - 0x250]
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy_S
push eax
call fcn.0040ecac
add esp, 0xc
mov cl, byte [0x49d082]
mov byte [ebp - 4], 3
test cl, cl
je 0x41d992
cmp dword [ebp - 0x23c], 8
lea eax, [ebp - 0x250]
cmovae eax, dword [ebp - 0x250]
push eax
movzx eax, cl
push str.RegisterElevationPolicy:__S
push eax
call fcn.00410896
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
push esi
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 4
push str.Failed_to_create_key_for__s_elevation_policy
push eax
call fcn.0040ec8b
add esp, 0xc
cmp dword [ebp - 0x23c], 8
lea ecx, [ebp - 0x250]
push eax
cmovae ecx, dword [ebp - 0x250]
xor eax, eax
cmp byte [edi + 0x4d], al
push eax
push eax
push 0x2001f
push eax
push eax
sete al
mov byte [ebp - 4], 5
push ecx
add eax, 0x80000001
lea ecx, [ebp - 0x21c]
push eax
call fcn.004137fb
push eax
call fcn.0041561c
pop ecx
pop ecx
xor edi, edi
mov byte [ebp - 4], 4
push 0
inc edi
lea ecx, [ebp - 0x238]
push edi
call fcn.00408c45
push esi
lea eax, [ebp - 0x238]
push str.Failed_to_create_AppName_for__s_elevation_policy
push eax
call fcn.0040ec8b
add esp, 0xc
push eax
push edi
push esi
push str.AppName
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 6
call fcn.00407e66
push eax
call fcn.0041561c
pop ecx
pop ecx
push 0
push edi
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 4
call fcn.00408c45
push esi
lea eax, [ebp - 0x238]
push str.Failed_to_create_Policy_for__s_elevation_policy
push eax
call fcn.0040ec8b
add esp, 0xc
push eax
push 4
lea eax, [ebp - 0x284]
mov byte [ebp - 4], 7
push eax
push 4
push 0
mov dword [ebp - 0x284], 3
push str.Policy
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.0041561c
pop ecx
pop ecx
push 0
push edi
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 4
call fcn.00408c45
push esi
lea eax, [ebp - 0x238]
push str.Failed_to_create_AppPath_for__s_elevation_policy
push eax
call fcn.0040ec8b
add esp, 0xc
push eax
push edi
push ebx
push str.AppPath
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 8
call fcn.00407e66
push eax
call fcn.0041561c
pop ecx
pop ecx
xor ebx, ebx
mov byte [ebp - 4], 4
push ebx
push edi
lea ecx, [ebp - 0x238]
call fcn.00408c45
lea ecx, [ebp - 0x21c]
call fcn.00405901
call fcn.0041d7b4
test eax, eax
jns 0x41db31
mov cl, byte [0x49d082]
test cl, cl
je 0x41db31
push eax
movzx eax, cl
push str.WARNING:_RefreshPolicies_failed___HR0x_X
push eax
call fcn.00410896
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.00405901
push ebx
push edi
lea ecx, [ebp - 0x250]
call fcn.00408c9a
push ebx
push edi
lea ecx, [ebp - 0x268]
call fcn.00408c45
call fcn.00449259
ret 8