Function at 0x473480
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5567ce
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x4734bb
xor eax, eax
jmp 0x4739f9
mov eax, dword [edi]
cmp eax, 0x8d2
ja 0x4736c9
je 0x473659
sub eax, 0x7d0
cmp eax, 7
ja case.default.0x4734dc
jmp dword [eax*4 + 0x473a24]
mov esi, dword [edi + 8]
test esi, esi
je case.default.0x4734dc
call fcn.0042df90
mov ecx, eax
call fcn.0044a770
test eax, eax
je case.default.0x4734dc
push dword [esi + 8]
mov ecx, eax
call fcn.00448b80
jmp case.default.0x4734dc
mov ebx, dword [edi + 8]
test ebx, ebx
je case.default.0x4734dc
push 0
push str.band
push 1
push 0
push str.bandclose
call fcn.00430130
mov ecx, eax
call fcn.004cfd30
push 0
push dword [ebx + 4]
push 0x8d6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x4734dc
push 0
push str.band
push 1
push 0
push str.bandopenlu
call fcn.00430130
mov ecx, eax
call fcn.004cfd30
push 0
call fcn.00433a50
add esp, 4
jmp case.default.0x4734dc
push 0
push str.band
push 1
push 0
push str.bandopen
jmp 0x473560
push str.MENU_ENTER_LEAVE_MODE
call fcn.00492250
add esp, 4
call fcn.0042df90
mov ecx, eax
call fcn.0044a770
test eax, eax
je case.default.0x4734dc
mov ecx, eax
call fcn.00447940
mov ecx, esi
test eax, eax
je 0x4735c7
push 0
call fcn.0047ac20
jmp case.default.0x4734dc
push 0xffffffffffffffff
call fcn.0046e2d0
jmp case.default.0x4734dc
call fcn.0042df90
mov ecx, eax
call fcn.0044a770
test eax, eax
je case.default.0x4734dc
push 0
push 0
push 1
push 0
push str.trayram
call fcn.00430130
mov ecx, eax
call fcn.004cfd30
push 0
push 0
push 0x8d3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x4734dc
push dword [0x5c462c]
call fcn.00433a50
add esp, 4
jmp case.default.0x4734dc
push str.MENU_ENTER_GUAJI_MODE
call fcn.00492250
add esp, 4
call fcn.0042df90
mov ecx, eax
call fcn.0044a770
test eax, eax
je case.default.0x4734dc
push 1
mov ecx, esi
call fcn.0047ac20
jmp case.default.0x4734dc
push dword [edi + 8]
lea ecx, [ebp - 0x28]
call fcn.00419490
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
push str.WM_CMD_LINE__s
call fcn.00492250
add esp, 8
lea ecx, [ebp - 0x58]
call fcn.004ed7f0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x58]
call fcn.004eee00
lea eax, [ebp - 0x58]
mov ecx, esi
push eax
push 1
call fcn.00478ba0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.004eda70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00421df0
jmp case.default.0x4734dc
cmp eax, 0x9a4
je 0x47372e
cmp eax, 0xbb9
jne case.default.0x4734dc
mov eax, dword [edi + 8]
test eax, eax
je case.default.0x4734dc
cmp word [eax], 0
je case.default.0x4734dc
push eax
lea ecx, [ebp - 0x60]
call fcn.0042b850
mov dword [ebp - 4], 0xe
lea eax, [ebp - 0x60]
push eax
lea ecx, [esi + 0x298]
call fcn.004521a0
lea ecx, [esi + 0x298]
call fcn.00452010
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.00427700
jmp case.default.0x4734dc
mov esi, dword [edi + 4]
mov eax, dword [edi + 8]
mov dword [ebp - 0x5c], eax
test esi, esi
jle case.default.0x4734dc
test eax, eax
je case.default.0x4734dc
push esi
mov dword [ebp - 0x64], esi
call fcn.004da519
push dword [ebp - 0x64]
mov ebx, eax
push 0
push ebx
call fcn.004f39e0
lea eax, [ebp - 0x64]
push eax
push ebx
push esi
push dword [ebp - 0x5c]
push str.lds_safe
call fcn.004381a0
add esp, 0x24
cmp dword [ebp - 0x64], 0
jle case.default.0x4734dc
test ebx, ebx
je case.default.0x4734dc
cmp dword [ebx + 8], 1
jne case.default.0x4734dc
mov ecx, dword [0x5cc350]
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test ecx, ecx
jne 0x4737f5
push 0x5c43b0
call esi
cmp dword [0x5cc350], 0
jne 0x4737e4
push 0x2c
call fcn.004d9f7d
add esp, 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], 5
test eax, eax
je 0x4737d2
mov ecx, eax
call fcn.00458b60
mov ecx, eax
jmp 0x4737d4
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
xchg dword [ebp - 0x5c], eax
mov dword [0x5cc350], ecx
push 0x5c43b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x5cc350]
push dword [ebx]
call fcn.00459cc0
test eax, eax
je case.default.0x4734dc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.__tid:_d__safe_lock
call fcn.00492250
mov ecx, dword [0x5cb884]
add esp, 8
test ecx, ecx
jne 0x473878
push 0x5c313c
call esi
cmp dword [0x5cb884], 0
jne 0x473867
push 0x14
call fcn.004d9f7d
add esp, 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], 6
test eax, eax
je 0x473855
mov ecx, eax
call fcn.0044a040
mov ecx, eax
jmp 0x473857
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
xchg dword [ebp - 0x5c], eax
mov dword [0x5cb884], ecx
push 0x5c313c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x5cb884]
call fcn.0044a770
mov esi, eax
test esi, esi
je case.default.0x4734dc
push 1
mov ecx, esi
call fcn.00448a80
push 2
push 0x571af8
push 1
push str.360lock
push str.SOFTWARELudashi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.00428a60
mov ecx, eax
call fcn.00429850
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0045f2d0
add esp, 8
mov dword [ebp - 4], 7
mov ecx, esi
call fcn.004460f0
mov ecx, dword [ebp - 0x60]
or esi, 0xffffffff
cmp dword [ecx - 0xc], 0
je 0x4739aa
test eax, eax
jne 0x4739aa
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x473a17
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 9
lea eax, [ebp - 0x5c]
push eax
call fcn.00428a60
mov ecx, eax
call fcn.00428f70
test eax, eax
je 0x47398c
mov eax, dword [ebp - 0x5c]
cmp dword [eax - 0xc], 0
je 0x47398c
push 0
push 0x57235c
push 1
push 0
push str.unlock
call fcn.00430130
mov ecx, eax
call fcn.004cfd30
call fcn.0046f5f0
sub esp, 0x28
mov esi, eax
mov ecx, esp
mov dword [ebp - 0x6c], esp
mov dword [ebp - 0x70], ecx
mov dword [ecx + 0x24], 0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
mov edx, dword [esi]
push 1
push ecx
push eax
push str.unlock
push 0x57235c
push esi
mov byte [ebp - 4], 9
call dword [edx + 4]
or esi, 0xffffffff
mov byte [ebp - 4], 7
mov eax, esi
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4739aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
call fcn.004da522
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg case.default.0x4734dc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 8]
test eax, eax
je 0x4739e9
push eax
call fcn.004da522
add esp, 4
mov dword [edi + 8], 0
push 0xc
push edi
call fcn.004d9fad
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004225f0
nop dword [eax]
jecxz 0x473a5a
inc edi
add byte [ecx], dl
xor eax, 0x35500047
inc edi
add byte [ebx + 0x35], bh
inc edi
add byte [ebp - 0x2cffb8cb], cl
xor eax, 0x36170047
inc edi
add byte [edx], ch
inc edi
add ah, cl
int3
add byte [eax], al
add byte [eax], al
push eax
call fcn.0046f550
mov ecx, eax
call fcn.004893b0
push dword [ebp - 4]
push str.PopupCheker_get_status_d
call fcn.00492250
mov eax, dword [ebp - 4]
add esp, 8
mov esp, ebp
pop ebp
ret 0x10