Function at 0x4997d7
Capabilities:
Get system information on windows
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push str.Disable_Script_Debugger
mov dword [ebp - 0x218], esi
mov edi, str.SoftwareMicrosoftInternet_ExplorerMain
xor ebx, ebx
push edi
mov esi, 0x80000001
inc ebx
push esi
mov dword [ebp - 0x214], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49989a
mov ecx, 0x589194
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x49987c
test dx, dx
je 0x499878
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x49987c
add eax, 4
add ecx, 4
test dx, dx
jne 0x499856
xor eax, eax
jmp 0x499881
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x49989a
push 8
push 0x589194
push ebx
push str.Disable_Script_Debugger
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
mov esi, 0x57cb10
cmp dword [0x5d789c], eax
jne 0x4998c7
cmp dword [0x5d78a0], eax
jne 0x4998da
cmp dword [0x5d78a4], eax
jne 0x4998da
cmp dword [0x5d78a8], eax
je 0x499a56
jmp 0x4998da
push 0x1f40
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
call fcn.00499407
add esp, 0xc
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_DISABLE_SQM_UPLOAD_FOR_APP
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_XSSFILTER
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_RESTRICT_ABOUT_PROTOCOL_IE7
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_AJAX_CONNECTIONEVENTS
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_SHOW_APP_PROTOCOL_WARN_DIALOG
call fcn.00499407
xor edi, edi
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_FEEDS
call fcn.00499407
add esp, 0x48
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_VIEWLINKEDWEBOC_IS_UNSAFE
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_PRIVATE_FONT_SETTING
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_USE_QME_FOR_TOPLEVEL_DOCS
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_USE_SECURITY_THUNKS
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_ACTIVEX_REPURPOSEDETECTION
call fcn.00499407
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_PAINT_INSIDE_WMPAINT
call fcn.00499407
add esp, 0x48
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_LEGACY_DISPPARAMS
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_HIGH_RESOLUTION_AWARE
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_FORCE_DISABLE_UNTRUSTEDPROTOCOL
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_ENFORCE_BSTR
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_ENABLE_WEB_CONTROL_VISUALS
call fcn.00499407
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_ENABLE_DYNAMIC_OBJECT_CACHING
call fcn.00499407
add esp, 0x48
cmp dword [0x5d78a0], edi
jne 0x499ab8
cmp dword [0x5d78a4], edi
jne 0x499abf
cmp dword [0x5d78a8], edi
je 0x499a56
push 0x2af8
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
call fcn.00499407
add esp, 0xc
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_USE_LEGACY_JSCRIPT
call fcn.00499407
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_LAYOUT9_QUIRKS_EMULATION
call fcn.00499407
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_USE_WEBOC_OMNAVIGATOR_IMPLEMENTATION
call fcn.00499407
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFeature_Enable_Compat_Logging
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_GPU_RENDERING
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_ALIGNED_TIMERS
call fcn.00499407
add esp, 0x48
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_ALLOW_HIGHFREQ_TIMERS
call fcn.00499407
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI
call fcn.00499407
add esp, 0x18
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_SCRIPTURL_MITIGATION
call fcn.00499407
and dword [ebp - 0x23c], 0
add esp, 0xc
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x238]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x5d7884]
mov dword [ebp - 0x210], 8
test eax, eax
je 0x499aa3
mov dword [ebp - 0x210], 0xa
cmp dword [ebp - 0x228], 2
jne 0x499ad7
mov dword [ebp - 0x210], 0xc
jmp 0x499ae3
push 0x2328
jmp 0x499ac4
push 0x2710
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
call fcn.00499407
add esp, 0xc
jmp 0x4999f0
jbe 0x499ae3
mov dword [ebp - 0x210], 0x10
test eax, eax
je 0x499b0c
push dword [ebp - 0x210]
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_MAXCONNECTIONSPERSERVER
call fcn.00499407
push dword [ebp - 0x210]
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_MAXCONNECTIONSPER1_0SERVER
call fcn.00499407
add esp, 0x18
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea eax, [ebp - 0x210]
push eax
push 0x49
push 0
call edi
push 4
lea eax, [ebp - 0x210]
push eax
push 0x4a
push 0
call edi
xor edi, edi
cmp dword [0x5d787c], edi
je 0x499b49
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_INTERNET_SHELL_FOLDERS
call fcn.00499407
add esp, 0xc
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_HTTP_USERNAME_PASSWORD_DISABLE
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BLOCK_LMZ_OBJECT
call fcn.00499407
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BLOCK_LMZ_IMG
call fcn.00499407
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BLOCK_LMZ_SCRIPT
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BEHAVIORS
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_DISABLE_ISO_2022_JP_SNIFFING
call fcn.00499407
add esp, 0x48
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_DISABLE_ISO_2022_JP_SNIFFING_V2
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_DISABLE_MK_PROTOCOL
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_LOCALMACHINE_LOCKDOWN
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_MIME_HANDLING
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_MIME_SNIFFING
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_OBJECT_CACHING
call fcn.00499407
add esp, 0x48
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_PROTOCOL_LOCKDOWN
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_SAFE_BINDTOOBJECT
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_WINDOW_RESTRICTIONS
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_ZONE_ELEVATION
call fcn.00499407
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_SECURITYBAND
call fcn.00499407
add esp, 0x48
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_TABBED_BROWSING
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_VALIDATE_NAVIGATE_URL
call fcn.00499407
push ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_WEBOC_DOCUMENT_ZOOM
call fcn.00499407
push edi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION
call fcn.00499407
mov ecx, dword [ebp - 4]
add esp, 0x30
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052f7d0
leave
ret