Function at 0x4022b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov eax, dword [0x00411680]
mov r15d, 1
mov ebx, r9d
mov r12d, r8d
mov r13d, edx
mov rsi, rcx
test r15b, al
jne 0x402314
or eax, r15d
lea rcx, [0x00411640]
mov dword [0x00411680], eax
call fcn.004013e4
lea rcx, [0x00408e38]
call fcn.00402a5c
mov eax, dword [0x00411680]
xor r14d, r14d
mov ebp, r14d
cmp dword [0x00411650], r14d
jne 0x402340
lea rcx, [0x00411640]
call fcn.00402f40
cmp eax, r14d
mov ebp, eax
jl 0x4025d0
mov eax, dword [0x00411680]
mov ecx, dword [0x00411640]
cmp ecx, r15d
jne 0x402354
lea rdi, str.iexplore.exe
jmp 0x402366
lea rdi, str.explorer.exe
cmp ecx, r14d
cmovne rdi, qword [0x00411648]
cmp ebp, r14d
jl 0x4025d0
test al, 2
jne 0x4023de
or eax, 2
lea r8, str.Security_HKLM_only
lea rdx, str.SoftwarePoliciesMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [0x00411680], eax
lea rax, [rsp + 0x40]
mov r9d, 0x10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 4
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp eax, r14d
jne 0x4023d3
cmp dword [rsp + 0x44], r15d
jne 0x4023d3
mov byte [0x0041163b], r15b
jmp 0x4023f1
mov al, r14b
mov byte [0x0041163b], al
jmp 0x4023e4
mov al, byte [0x0041163b]
cmp al, r14b
jne 0x4023f1
cmp ebx, r14d
mov ebx, r14d
je 0x4023f4
mov ebx, r15d
cmp byte [0x0041163a], r14b
jne 0x40242d
lea rax, [rsp + 0x48]
lea rdx, str.SoftwarePoliciesMicrosoftInternet_ExplorerMainFeatureControl
mov r9d, r15d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
je 0x402432
mov byte [0x0041163a], r15b
mov qword [rsp + 0x48], r14
cmp byte [0x00411639], r14b
jne 0x402470
cmp ebx, r14d
jne 0x402470
lea rax, [rsp + 0x50]
lea rdx, str.SoftwarePoliciesMicrosoftInternet_ExplorerMainFeatureControl
mov r9d, r15d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
je 0x402475
mov byte [0x00411639], r15b
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x58]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
mov r9d, r15d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r8, qword [rsp + 0x58]
cmp eax, r14d
cmovne r8, r14
mov qword [rsp + 0x58], r8
cmp byte [0x00411638], r14b
jne 0x4024e8
cmp ebx, r14d
jne 0x4024e8
lea rax, [rsp + 0x60]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
mov r9d, r15d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
je 0x4024ed
mov byte [0x00411638], r15b
mov qword [rsp + 0x60], r14
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x40], r14d
cmp rcx, r14
je 0x402519
mov rdx, qword [rsi]
lea rax, [rsp + 0x40]
mov r9d, r12d
mov r8, rdi
mov qword [rsp + 0x20], rax
call fcn.004058cc
cmp al, r14b
jne 0x40258e
mov rcx, qword [rsp + 0x50]
cmp rcx, r14
je 0x402540
mov rdx, qword [rsi]
lea rax, [rsp + 0x40]
mov r9d, r12d
mov r8, rdi
mov qword [rsp + 0x20], rax
call fcn.004058cc
cmp al, r14b
jne 0x40258e
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x402567
mov rdx, qword [rsi]
lea rax, [rsp + 0x40]
mov r9d, r12d
mov r8, rdi
mov qword [rsp + 0x20], rax
call fcn.004025f8
cmp al, r14b
jne 0x40258e
mov rcx, qword [rsp + 0x58]
cmp rcx, r14
je 0x402597
mov rdx, qword [rsi]
lea rax, [rsp + 0x40]
mov r9d, r12d
mov r8, rdi
mov qword [rsp + 0x20], rax
call fcn.004025f8
cmp al, r14b
je 0x402597
mov eax, dword [rsp + 0x40]
mov dword [rsi + 8], eax
jmp 0x4025a4
cmp dword [0x00411640], 0xffffffff
jne 0x4025a4
mov dword [rsi + 8], r13d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov eax, ebp
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret