Function at 0x402234
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov eax, dword [0x00411680]
mov r15d, 1
mov ebx, r9d
mov r12d, r8d
mov r13d, edx
mov rsi, rcx
test r15b, al
jne 0x402294
or eax, r15d
lea rcx, [0x00411640]
mov dword [0x00411680], eax
call fcn.004013e4
lea rcx, [0x004082c8]
call fcn.004029dc
mov eax, dword [0x00411680]
xor r14d, r14d
mov ebp, r14d
cmp dword [0x00411650], r14d
jne 0x4022c0
lea rcx, [0x00411640]
call fcn.00402ec0
cmp eax, r14d
mov ebp, eax
jl 0x402550
mov eax, dword [0x00411680]
mov ecx, dword [0x00411640]
cmp ecx, r15d
jne 0x4022d4
lea rdi, str.iexplore.exe
jmp 0x4022e6
lea rdi, str.explorer.exe
cmp ecx, r14d
cmovne rdi, qword [0x00411648]
cmp ebp, r14d
jl 0x402550
test al, 2
jne 0x40235e
or eax, 2
lea r8, str.Security_HKLM_only
lea rdx, str.SoftwarePoliciesMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [0x00411680], eax
lea rax, [rsp + 0x40]
mov r9d, 0x10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 4
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
cmp eax, r14d
jne 0x402353
cmp dword [rsp + 0x44], r15d
jne 0x402353
mov byte [0x0041163b], r15b
jmp 0x402371
mov al, r14b
mov byte [0x0041163b], al
jmp 0x402364
mov al, byte [0x0041163b]
cmp al, r14b
jne 0x402371
cmp ebx, r14d
mov ebx, r14d
je 0x402374
mov ebx, r15d
cmp byte [0x0041163a], r14b
jne 0x4023ad
lea rax, [rsp + 0x48]
lea rdx, str.SoftwarePoliciesMicrosoftInternet_ExplorerMainFeatureControl
mov r9d, r15d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
je 0x4023b2
mov byte [0x0041163a], r15b
mov qword [rsp + 0x48], r14
cmp byte [0x00411639], r14b
jne 0x4023f0
cmp ebx, r14d
jne 0x4023f0
lea rax, [rsp + 0x50]
lea rdx, str.SoftwarePoliciesMicrosoftInternet_ExplorerMainFeatureControl
mov r9d, r15d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
je 0x4023f5
mov byte [0x00411639], r15b
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x58]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
mov r9d, r15d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r8, qword [rsp + 0x58]
cmp eax, r14d
cmovne r8, r14
mov qword [rsp + 0x58], r8
cmp byte [0x00411638], r14b
jne 0x402468
cmp ebx, r14d
jne 0x402468
lea rax, [rsp + 0x60]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
mov r9d, r15d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
je 0x40246d
mov byte [0x00411638], r15b
mov qword [rsp + 0x60], r14
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x40], r14d
cmp rcx, r14
je 0x402499
mov rdx, qword [rsi]
lea rax, [rsp + 0x40]
mov r9d, r12d
mov r8, rdi
mov qword [rsp + 0x20], rax
call fcn.0040585c
cmp al, r14b
jne 0x40250e
mov rcx, qword [rsp + 0x50]
cmp rcx, r14
je 0x4024c0
mov rdx, qword [rsi]
lea rax, [rsp + 0x40]
mov r9d, r12d
mov r8, rdi
mov qword [rsp + 0x20], rax
call fcn.0040585c
cmp al, r14b
jne 0x40250e
mov rcx, qword [rsp + 0x60]
cmp rcx, r14
je 0x4024e7
mov rdx, qword [rsi]
lea rax, [rsp + 0x40]
mov r9d, r12d
mov r8, rdi
mov qword [rsp + 0x20], rax
call fcn.00402578
cmp al, r14b
jne 0x40250e
mov rcx, qword [rsp + 0x58]
cmp rcx, r14
je 0x402517
mov rdx, qword [rsi]
lea rax, [rsp + 0x40]
mov r9d, r12d
mov r8, rdi
mov qword [rsp + 0x20], rax
call fcn.00402578
cmp al, r14b
je 0x402517
mov eax, dword [rsp + 0x40]
mov dword [rsi + 8], eax
jmp 0x402524
cmp dword [0x00411640], 0xffffffff
jne 0x402524
mov dword [rsi + 8], r13d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov eax, ebp
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret