Function at 0x477f80
Capabilities:
Delete registry value
Get graphical window text
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x577
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x500
push esi
mov edi, eax
call sym.SystemInformer.exe_PhGetDialogItemValue
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x28
mov dword [ebp - 0xc], str.SampleCountAutomatic
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0
push 0
push 0xf0
test eax, eax
push 0x551
push esi
setne bl
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
sete al
cmp al, bl
je 0x477fff
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x28
push eax
mov dword [ebp - 0xc], str.SampleCountAutomatic
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov ebx, dword [ebp - 8]
mov eax, 1
test ebx, ebx
mov dword [ebp - 0x10], 0x16
mov dword [ebp - 0xc], str.SampleCount
cmove ebx, eax
lea eax, [ebp - 0x10]
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
mov edi, edi
cmp ebx, eax
je 0x47804b
mov byte [0x635266], 1
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x16
push eax
mov dword [ebp - 0xc], str.SampleCount
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0x477
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 8]
push ecx
push 0
push eax
call sym.SystemInformer.exe_PhGetWindowTextEx
push dword [ebp - 8]
call sym.SystemInformer.exe_PhAutoDereferenceObject
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x18
push eax
mov dword [ebp - 0xc], str.SearchEngine
call sym.SystemInformer.exe_PhSetStringRefSetting
push 0x47f
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 8]
push ecx
push 0
push eax
call sym.SystemInformer.exe_PhGetWindowTextEx
push dword [ebp - 8]
call sym.SystemInformer.exe_PhAutoDereferenceObject
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x32
push eax
mov dword [ebp - 0xc], str.ProgramInspectExecutables
call sym.SystemInformer.exe_PhSetStringRefSetting
push 0
push 0
push 0x147
push 0x478
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov dword [0x632948], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x16
mov dword [ebp - 0xc], str.MaxSizeUnit
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0x4e0
push esi
call sym.SystemInformer.exe_PhGetDialogItemValue
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1a
push eax
mov dword [ebp - 0xc], str.IconProcesses
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x22
push eax
mov dword [ebp - 0xc], str.DbgHelpSearchPath
call sym.SystemInformer.exe_PhGetStringRefSetting
mov ebx, dword [ebp - 0x14]
mov esi, eax
push 0x4c2
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
call sym.SystemInformer.exe_PhGetWindowTextEx
push esi
call sym.SystemInformer.exe_PhAutoDereferenceObject
push dword [ebp - 0x14]
mov esi, eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push 1
push esi
push eax
call sym.SystemInformer.exe_PhEqualStringRef
mov edi, edi
test al, al
jne 0x4781c4
push 0x4c2
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
call sym.SystemInformer.exe_PhGetWindowTextEx
push dword ds:[ebp - 0x14]
call sym.SystemInformer.exe_PhAutoDereferenceObject
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x22
push eax
mov dword [ebp - 0xc], str.DbgHelpSearchPath
call sym.SystemInformer.exe_PhSetStringRefSetting
mov byte [0x635266], 1
push 0xf000
push 0
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x28
xor ecx, ecx
mov dword [ebp - 0xc], str.AllowOnlyOneInstance
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 1
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x16
xor ecx, ecx
mov dword [ebp - 0xc], str.HideOnClose
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 2
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x1c
xor ecx, ecx
mov dword [ebp - 0xc], str.HideOnMinimize
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 4
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x16
xor ecx, ecx
mov dword [ebp - 0xc], str.StartHidden
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x2a
push eax
mov dword [ebp - 0xc], str.MiniInfoWindowEnabled
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0xd
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x4782f5
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x2a
push eax
mov dword [ebp - 0xc], str.MiniInfoWindowEnabled
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0xe
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x36
xor ecx, ecx
mov dword [ebp - 0xc], str.MainWindowTabRestoreEnabled
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x12
push eax
mov dword [ebp - 0xc], str.KsiEnable
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 6
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x478395
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x12
push eax
mov dword [ebp - 0xc], str.KsiEnable
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 5
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x1c
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableWarnings
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x1a
push eax
mov dword [ebp - 0xc], str.EnablePlugins
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 8
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x478435
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1a
push eax
mov dword [ebp - 0xc], str.EnablePlugins
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 9
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x22
xor ecx, ecx
mov dword [ebp - 0xc], str.DbgHelpUndecorate
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x34
push eax
mov dword [ebp - 0xc], str.TreeListEnableHeaderTotals
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0xa
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x4784d5
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x34
push eax
mov dword [ebp - 0xc], str.TreeListEnableHeaderTotals
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableGraphMaxScale
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0xc
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x478537
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableGraphMaxScale
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableCycleCpuUsage
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0xb
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x47859e
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableCycleCpuUsage
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x24
push eax
mov dword [ebp - 0xc], str.EnableThemeSupport
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0xf
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x478600
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x24
push eax
mov dword [ebp - 0xc], str.EnableThemeSupport
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x10
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x24
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableStartAsAdmin
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x24
push eax
mov dword [ebp - 0xc], str.EnableStreamerMode
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x11
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x47869e
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x24
push eax
mov dword [ebp - 0xc], str.EnableStreamerMode
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x12
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x2e
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableSilentCrashNotify
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 7
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x26
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableMonospaceFont
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x28
push eax
mov dword [ebp - 0xc], str.EnableNetworkResolve
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x13
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x478775
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x28
push eax
mov dword [ebp - 0xc], str.EnableNetworkResolve
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x2e
push eax
mov dword [ebp - 0xc], str.EnableNetworkResolveDoH
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x14
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x4787d7
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x2e
push eax
mov dword [ebp - 0xc], str.EnableNetworkResolveDoH
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x15
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x2a
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableInstantTooltips
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x36
push eax
mov dword [ebp - 0xc], str.EnableImageCoherencySupport
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x16
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x478875
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x36
push eax
mov dword [ebp - 0xc], str.EnableImageCoherencySupport
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x18
push eax
mov dword [ebp - 0xc], str.EnableStage2
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x17
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x4788d7
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x18
push eax
mov dword [ebp - 0xc], str.EnableStage2
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableServiceStage2
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x18
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x47893e
mov byte [0x635266], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableServiceStage2
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x19
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x1e
xor ecx, ecx
mov dword [ebp - 0xc], str.IconSingleClick
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x1a
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x2a
xor ecx, ecx
mov dword [ebp - 0xc], str.IconTogglesVisibility
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x1b
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x22
xor ecx, ecx
mov dword [ebp - 0xc], str.PropagateCpuUsage
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x1c
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x2a
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableAdvancedOptions
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x24
push eax
mov dword [ebp - 0xc], str.EnableThemeSupport
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x478a85
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1c
push eax
mov dword [ebp - 0xc], str.GraphColorMode
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 4
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xf000
push 3
push 0x102c
shr eax, 0xc
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
shr esi, 0xc
cmp esi, 2
sete cl
cmp byte [0x635267], cl
je 0x478c0f
push 0
push 0x62ff28
push 0xfffffffffffffff7
push 0x20006
lea eax, [ebp - 8]
push eax
call sym.SystemInformer.exe_PhOpenKey
test eax, eax
js 0x478c0f
cmp esi, 2
jne 0x478bd2
call sym.SystemInformer.exe_PhGetApplicationFileNameWin32
mov ebx, eax
test ebx, ebx
je 0x478c06
push 0x630018
push ebx
push 0x630018
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edi, eax
cmp dword [ebp - 0x14], esi
jne 0x478b7b
mov ecx, dword ds:[edi]
lea eax, [ebp - 0x10]
push 0
push 0
add ecx, 0xc
mov dword [ebp - 0xc], 0
push eax
mov dword [ebp - 0x10], ecx
call sym.SystemInformer.exe_PhCreateString3
push dword [edi]
mov esi, eax
push dword [edi + 4]
push dword [esi + 4]
call fcn.005823b0
mov ecx, dword [edi]
add esp, 0xc
add ecx, dword [esi + 4]
mov eax, dword [str.__hide]
push esi
mov dword [ecx], eax
mov eax, dword [0x5d09cc]
mov dword [ecx + 4], eax
mov eax, dword [0x5d09d0]
mov dword [ecx + 8], eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edi, eax
mov ecx, dword [0x630020]
mov edx, dword ds:[edi]
add edx, 2
mov word [ebp - 0x18], cx
lea eax, [ecx + 2]
mov word [ebp - 0x16], ax
mov eax, dword [0x630024]
mov dword [ebp - 0x14], eax
cmp ecx, 0xfffe
ja 0x478bbd
push edx
push dword [edi + 4]
lea eax, [ebp - 0x18]
push 1
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x478c06
call fcn.004fc020
jmp 0x478c06
mov ecx, dword [0x630020]
mov word [ebp - 0x18], cx
lea eax, [ecx + 2]
mov word [ebp - 0x16], ax
mov eax, dword [0x630024]
mov dword [ebp - 0x14], eax
cmp ecx, 0xfffe
ja 0x478c06
lea eax, ds:[ebp - 0x18]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
push 0x477d00
push 0
push 0xf
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005802ef
mov esp, ebp
pop ebp
ret