Function at 0x6ce02ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ce1b531
mov eax, dword fs:[0]
push eax
sub esp, 0xa40
mov eax, dword [0x6ce5c008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xa38]
mov dword [ebp - 0xa40], eax
xor eax, eax
push 0x4c
push str.SOFTWAREMicrosoftEdgeUpdateClientsF3017226_FE2A_4295_8BDF_00C3A9A7E4C5
mov dword [ebp - 0xa4c], 0
mov dword [ebp - 0xa24], 7
mov dword [ebp - 0xa28], 0
mov word [ebp - 0xa38], ax
call fcn.6cdbf0d0
mov dword [ebp - 4], 0
xor ebx, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xa48], 0x80000002
mov dword [ebp - 0xa44], 0x80000001
nop dword [eax]
nop word [eax + eax]
cmp dword [ebp - 0xa24], 8
lea ecx, [ebp - 0xa3c]
push ecx
push 0x20019
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xa3c], 0
cmovae eax, dword [ebp - 0xa38]
push 0
push eax
push dword [ebp + ebx*4 - 0xa48]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6ce030c9
lea eax, [ebp - 0xa1c]
mov dword [ebp - 0xa1c], 0x800
push eax
lea eax, [ebp - 0xa10]
mov dword [ebp - 0xa20], 0x200
push eax
push 0
push 0
push str.location
push dword [ebp - 0xa3c]
call edi
mov esi, eax
lea eax, [ebp - 0xa20]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x6ce465ac
push dword [ebp - 0xa3c]
call edi
push dword [ebp - 0xa3c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x6ce030c3
test edi, edi
jne 0x6ce030c3
lea eax, [ebp - 0xa10]
mov dword [ebp - 0xa14], edi
push eax
lea ecx, [ebp - 0xa14]
call fcn.6cdbef90
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xa18]
mov dword [ebp - 0xa18], edi
call fcn.6cdbef90
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xa18]
cmp dword [eax - 0xc], edi
je 0x6ce03084
mov ecx, str.0.0.0.0
mov edx, eax
nop
mov si, word [edx]
cmp si, word [ecx]
jne 0x6ce03066
test si, si
je 0x6ce03062
mov si, word [edx + 2]
cmp si, word [ecx + 2]
jne 0x6ce03066
add edx, 4
add ecx, 4
test si, si
jne 0x6ce03040
xor ecx, ecx
jmp 0x6ce0306b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
setne cl
test cl, cl
je 0x6ce03084
mov ecx, dword [ebp - 0xa14]
cmp dword [ecx - 0xc], 0
jne 0x6ce0311b
or esi, 0xffffffff
mov byte [ebp - 4], 1
lea edx, [eax - 0x10]
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x6ce030a2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0xa14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x6ce030c3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc ebx
cmp ebx, 2
jb 0x6ce02f40
mov edi, dword [ebp - 0xa40]
mov ecx, edi
push 0x6ce4378c
call fcn.6cdbef90
mov eax, dword [ebp - 0xa24]
cmp eax, 8
jb 0x6ce030fd
inc eax
push eax
push dword [ebp - 0xa38]
call fcn.6cdbf220
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.6ce11901
mov esp, ebp
pop ebp
ret
push 0x6ce43790
lea ecx, [ebp - 0xa14]
call fcn.6cde9200
mov eax, dword [ebp - 0xa18]
lea ecx, [ebp - 0xa14]
push dword [eax - 0xc]
push eax
call fcn.6cdddb50
mov ecx, dword [ebp - 0xa14]
lea ecx, [ecx - 0x10]
call fcn.6cddbc30
mov edi, dword [ebp - 0xa40]
add eax, 0x10
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0xa18]
add edx, 0xfffffff0
mov dword [edi], eax
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x6ce0317d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xa14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x6ce0319c
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0xa38]
call fcn.6cdbee70
jmp 0x6ce030fd