Function at 0x1004de80
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10092a9c
mov eax, dword fs:[0]
push eax
sub esp, 0x8c8
mov eax, dword [0x100bb0a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor al, al
mov dword [ebp - 0x86c], 0
mov byte [ebp - 0x86d], al
mov byte [ebp - 0x86e], al
lea eax, [ebp - 0x86c]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallSkyGuardEndpoint
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1004def4
push str.update_cloudapp_port:_open_subpath_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1004e4d3
push 0x800
lea eax, [ebp - 0x814]
push 0
push eax
call fcn.100643b0
add esp, 0xc
mov dword [ebp - 0x81c], 0
lea eax, [ebp - 0x818]
mov dword [ebp - 0x818], 0x400
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x81c]
push eax
push 0
push str.InstallDir
push dword [ebp - 0x86c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1004df5a
push str.update_cloudapp_port:_get_InstallDir_value_failed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1004e4d3
xor eax, eax
mov dword [ebp - 0x820], 7
mov dword [ebp - 0x824], 0
mov word [ebp - 0x834], ax
cmp word [ebp - 0x814], ax
jne 0x1004df84
xor ecx, ecx
jmp 0x1004df9f
lea ecx, [ebp - 0x814]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004df90
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x834]
call fcn.100217e0
push 0x30
push str.EndpointAgentetcEndpointClientAgentConfig.xml
lea ecx, [ebp - 0x834]
mov dword [ebp - 4], 0
call fcn.10021210
xor eax, eax
mov byte [ebp - 4], 1
push 0xffffffffffffffff
push eax
mov word [ebp - 0x84c], ax
lea ecx, [ebp - 0x84c]
lea eax, [ebp - 0x834]
mov dword [ebp - 0x838], 7
push eax
mov dword [ebp - 0x83c], 0
call fcn.10021620
xorps xmm0, xmm0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x868]
movq qword [ebp - 0x858], xmm0
movups xmmword [ebp - 0x868], xmm0
mov dword [ebp - 0x850], 0
call fcn.100360f0
push 1
mov byte [ebp - 4], 4
call fcn.1005063f
add esp, 4
mov dword [ebp - 0x890], eax
lea eax, [ebp - 0x888]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x84c]
call fcn.1004d590
lea ecx, [ebp - 0x894]
mov byte [ebp - 4], 6
push ecx
push 0
lea ecx, [ebp - 0x868]
push ecx
push eax
call fcn.10033080
mov eax, dword [ebp - 0x874]
add esp, 0x10
mov byte [ebp - 4], 5
cmp eax, 0x10
jb 0x1004e0c7
mov ecx, dword [ebp - 0x888]
inc eax
cmp eax, 0x1000
jb 0x1004e0be
test cl, 0x1f
je 0x1004e09a
call fcn.1006fbaa
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x1004e0a6
call fcn.1006fbaa
sub ecx, eax
cmp ecx, 4
jae 0x1004e0b2
call fcn.1006fbaa
cmp ecx, 0x23
jbe 0x1004e0bc
call fcn.1006fbaa
mov ecx, eax
push ecx
call fcn.1004eb86
add esp, 4
mov dword [ebp - 0x874], 0xf
mov dword [ebp - 0x878], 0
mov byte [ebp - 0x888], 0
mov ecx, dword [ebp - 0x890]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x1004e103
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov ecx, eax
test ecx, ecx
je 0x1004e103
mov eax, dword [ecx]
push 1
call dword [eax]
push 0x17
xor eax, eax
mov byte [ebp - 4], 3
push str.root.cloudAppWebService
lea ecx, [ebp - 0x8b4]
mov dword [ebp - 0x8a0], 7
mov dword [ebp - 0x8a4], 0
mov word [ebp - 0x8b4], ax
call fcn.100217e0
cmp dword [ebp - 0x8a0], 8
mov eax, 0x2e
mov word [ebp - 0x89c], ax
lea eax, [ebp - 0x8b4]
cmovae eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x898], eax
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], 8
call fcn.100360f0
push eax
lea eax, [ebp - 0x8b4]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x868]
call fcn.10046ac0
mov esi, dword [ebp - 0x874]
mov edi, eax
mov byte [ebp - 4], 8
test esi, esi
je 0x1004e1ad
lea ecx, [esi + 9]
call fcn.100432a0
push dword [esi + 4]
call fcn.1004eb86
push 0x10
push esi
call fcn.1004f321
add esp, 0xc
mov eax, dword [ebp - 0x878]
cmp eax, 8
jb 0x1004e20f
mov ecx, dword [ebp - 0x88c]
inc eax
cmp eax, 0x7fffffff
jbe 0x1004e1cb
call fcn.1006fbaa
add eax, eax
cmp eax, 0x1000
jb 0x1004e206
test byte [ebp - 0x88c], 0x1f
je 0x1004e1e2
call fcn.1006fbaa
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x1004e1ee
call fcn.1006fbaa
sub ecx, eax
cmp ecx, 4
jae 0x1004e1fa
call fcn.1006fbaa
cmp ecx, 0x23
jbe 0x1004e204
call fcn.1006fbaa
mov ecx, eax
push ecx
call fcn.1004eb86
add esp, 4
xor eax, eax
mov dword [ebp - 0x878], 7
mov word [ebp - 0x88c], ax
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x87c], 0
mov byte [ebp - 4], 3
cmp eax, 8
jb 0x1004e292
mov ecx, dword [ebp - 0x8b4]
inc eax
cmp eax, 0x7fffffff
jbe 0x1004e24e
call fcn.1006fbaa
add eax, eax
cmp eax, 0x1000
jb 0x1004e289
test byte [ebp - 0x8b4], 0x1f
je 0x1004e265
call fcn.1006fbaa
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x1004e271
call fcn.1006fbaa
sub ecx, eax
cmp ecx, 4
jae 0x1004e27d
call fcn.1006fbaa
cmp ecx, 0x23
jbe 0x1004e287
call fcn.1006fbaa
mov ecx, eax
push ecx
call fcn.1004eb86
add esp, 4
xor eax, eax
mov dword [ebp - 0x8a0], 7
push 4
push str.Port
lea ecx, [ebp - 0x8d4]
mov dword [ebp - 0x8a4], 0
mov word [ebp - 0x8b4], ax
mov dword [ebp - 0x8c0], 7
mov dword [ebp - 0x8c4], eax
mov word [ebp - 0x8d4], ax
call fcn.100217e0
cmp dword [ebp - 0x8c0], 8
mov eax, 0x2e
mov word [ebp - 0x8bc], ax
lea eax, [ebp - 0x8d4]
cmovae eax, dword [ebp - 0x8d4]
mov dword [ebp - 0x8b8], eax
lea eax, [ebp - 0x8d4]
mov byte [ebp - 4], 0xa
push eax
mov ecx, edi
call fcn.100469a0
mov edi, eax
push 1
mov byte [ebp - 4], 0xb
call fcn.1005063f
push ecx
mov esi, eax
mov eax, esp
mov dword [ebp - 0x890], eax
mov dword [eax + 4], esi
mov ecx, esi
mov eax, dword [esi]
mov byte [ebp - 4], 0xc
call dword [eax + 4]
mov byte [ebp - 4], 0xd
test esi, esi
je 0x1004e353
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 8]
call eax
mov ecx, eax
test ecx, ecx
je 0x1004e353
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.1002e770
mov esi, eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x8c0]
cmp eax, 8
jb 0x1004e3c6
mov ecx, dword [ebp - 0x8d4]
inc eax
cmp eax, 0x7fffffff
jbe 0x1004e382
call fcn.1006fbaa
add eax, eax
cmp eax, 0x1000
jb 0x1004e3bd
test byte [ebp - 0x8d4], 0x1f
je 0x1004e399
call fcn.1006fbaa
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x1004e3a5
call fcn.1006fbaa
sub ecx, eax
cmp ecx, 4
jae 0x1004e3b1
call fcn.1006fbaa
cmp ecx, 0x23
jbe 0x1004e3bb
call fcn.1006fbaa
mov ecx, eax
push ecx
call fcn.1004eb86
add esp, 4
lea eax, [ebp - 0x888]
push esi
push eax
call fcn.1004d9b0
add esp, 8
mov edi, eax
mov esi, 0x100c6d74
cmp edi, esi
je 0x1004e41d
mov eax, dword [0x100c6d88]
cmp eax, 0x10
jb 0x1004e3fa
inc eax
mov ecx, esi
push eax
push dword [0x100c6d74]
call fcn.100024a0
push edi
mov ecx, esi
mov dword [0x100c6d88], 0xf
mov dword [0x100c6d84], 0
mov byte [0x100c6d74], 0
call fcn.1001d6b0
mov eax, dword [ebp - 0x874]
cmp eax, 0x10
jb 0x1004e43b
inc eax
lea ecx, [ebp - 0x888]
push eax
push dword [ebp - 0x888]
call fcn.100024a0
push str.update_cloudapp_port:_parse_cloudAppWebService.Port_is
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x100c6d88], 0x10
cmovae esi, dword [0x100c6d74]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x868]
call fcn.10037b10
mov eax, dword [ebp - 0x838]
cmp eax, 8
jb 0x1004e484
inc eax
lea ecx, [ebp - 0x84c]
push eax
push dword [ebp - 0x84c]
call fcn.10022f70
mov eax, dword [ebp - 0x820]
mov byte [ebp - 0x86d], 1
cmp eax, 8
jb 0x1004e4d3
inc eax
lea ecx, [ebp - 0x834]
push eax
push dword [ebp - 0x834]
call fcn.10022f70
jmp 0x1004e4d3
mov ecx, dword [ebp - 0x86c]
test ecx, ecx
je 0x1004e4e4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x86d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1004eb8b
mov esp, ebp
pop ebp
ret