Function at 0x1044af5
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x23c], ebx
cmp dword [0x10742bc], ebx
je 0x1044bc5
call fcn.010418a7
call fcn.01041af8
xor esi, esi
inc esi
mov dword [0x10742c8], esi
cmp dword [0x107289c], ebx
je 0x1044bab
mov ecx, dword [0x10739c8]
cmp ecx, ebx
je 0x1044bab
call fcn.010458b7
test eax, eax
je 0x1044bab
mov ecx, dword [0x10739c8]
push ebx
call fcn.010458b7
mov ecx, eax
call fcn.010485a5
mov ecx, dword [0x10739c8]
test eax, eax
je 0x1044b7a
push ebx
call fcn.010458b7
mov ecx, eax
call fcn.010485a5
jmp 0x1044b86
call fcn.010458b7
mov ecx, eax
call fcn.010484f9
mov ecx, dword [0x10739c8]
push eax
call fcn.010458b7
mov ecx, eax
call fcn.010483d2
mov ecx, dword [0x10739c8]
call fcn.010458b7
mov ecx, eax
call fcn.0104a09e
cmp dword [ebp + 8], ebx
je 0x1044c18
mov ecx, dword [0x10739c8]
cmp ecx, ebx
je 0x1044c12
call fcn.010458b7
test eax, eax
je 0x1044c12
jmp 0x1044bfa
cmp dword [ebp + 8], ebx
je 0x1044c18
cmp dword [0x107289c], ebx
je 0x1044c18
mov ecx, dword [0x10739c8]
cmp ecx, ebx
je 0x1044c18
call fcn.010458b7
test eax, eax
je 0x1044c18
mov ecx, dword [0x10739c8]
xor esi, esi
inc esi
call fcn.010458b7
mov ecx, eax
call fcn.0104a09e
mov ecx, dword [0x10739c8]
call fcn.010458b7
mov ecx, eax
call fcn.0104851f
test eax, eax
je 0x1044c12
xor esi, esi
push esi
call fcn.010456b0
push edi
push ebx
lea eax, [ebp - 0x23c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x1001b38
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1044c96
mov dword [ebp - 0x240], 1
cmp dword [0x107399c], ebx
jne 0x1044c74
push 4
pop edi
cmp dword [ebp + 8], ebx
je 0x1044c88
push edi
lea eax, [ebp - 0x240]
push eax
push edi
push ebx
push 0x10020d0
push dword [ebp - 0x23c]
call esi
jmp 0x1044c88
push 0x10020d0
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 4
pop edi
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1044c99
push 4
pop edi
lea ecx, [ebp - 0x24c]
call fcn.0106e3dd
lea eax, [ebp - 0x24c]
push eax
call fcn.0104192f
test eax, eax
jl 0x1044d49
lea eax, [ebp - 0x23c]
push eax
push 3
push ebx
push dword [ebp - 0x24c]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1044d49
mov dword [ebp - 0x240], 1
cmp dword [0x107399c], ebx
jne 0x1044d07
cmp dword [ebp + 8], ebx
je 0x1044d1d
push edi
lea eax, [ebp - 0x240]
push eax
push edi
push ebx
push 0x10020d0
push dword [ebp - 0x23c]
call esi
jmp 0x1044d18
push 0x10020d0
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp + 8], ebx
jne 0x1044d22
cmp dword [ebp + 0xc], ebx
je 0x1044d37
push edi
push 0x10742a8
push edi
push ebx
push 0x1004708
push dword [ebp - 0x23c]
call esi
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x23c], ebx
cmp dword [ebp + 8], ebx
jne 0x1044d57
cmp dword [ebp + 0xc], ebx
je 0x1044ea9
push ebx
lea eax, [ebp - 0x23c]
push eax
push ebx
push 3
push ebx
push ebx
push ebx
push 0x1001b38
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1044e33
push edi
push 0x1074298
push edi
push ebx
push 0x10046c0
push dword [ebp - 0x23c]
call esi
push 1
push 0x107429c
push 3
push ebx
push 0x10047dc
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742a0
push edi
push ebx
push 0x10046e4
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742a8
push edi
push ebx
push 0x1004708
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742ac
push edi
push ebx
push 0x100474c
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742b0
push edi
push ebx
push 0x100476c
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742b4
push edi
push ebx
push 0x1004794
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742b8
push edi
push ebx
push 0x10047b4
push dword [ebp - 0x23c]
call esi
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x10742c0]
push 0x1004968
call fcn.01056d2e
cmp dword [ebp + 8], ebx
je 0x1044ea9
push 0xa
pop ecx
mov esi, 0x100173c
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp dword [0x10742c8], ebx
je 0x1044ea4
lea eax, [ebp - 0x240]
push eax
push 0x1004ec0
push ebx
push 0x1005784
push ebx
mov dword [ebp - 0x240], ebx
call dword [sym.imp.SHELL32.dll_SHCoCreateInstance]
test eax, eax
jl 0x1044e92
mov eax, dword [ebp - 0x240]
mov ecx, dword [eax]
lea edx, [ebp - 0x30]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x240]
cmp eax, ebx
ret
je 0x1044ea9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1044ea9
call fcn.01044a92
mov ecx, dword [0x1074294]
xor eax, eax
mov word [ebp - 0x238], ax
mov esi, 0x104
pop edi
cmp ecx, ebx
je 0x1044eeb
push esi
lea eax, [ebp - 0x238]
push eax
call fcn.01046c90
mov ecx, dword [0x1074294]
call fcn.01046cd3
mov eax, dword [0x1074294]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x1074294], ebx
cmp dword [ebp + 8], ebx
je 0x1044f29
cmp dword [ebp + 0xc], ebx
jne 0x1044f29
cmp word [ebp - 0x238], bx
je 0x1044f0c
push esi
lea eax, [ebp - 0x238]
push eax
push eax
call fcn.010582f3
cmp dword [0x1072b8c], ebx
je 0x1044f24
lea eax, [ebp - 0x238]
push eax
call fcn.01042ffc
cmp eax, ebx
jne 0x1044f29
call fcn.01058126
cmp dword [0x1073a4c], ebx
je 0x1044f7f
mov al, byte [0x1073a50]
cmp al, 4
jae 0x1044f3e
cmp al, bl
jne 0x1044f7f
mov ecx, dword [0x1073a3c]
mov edx, 0x80000000
and ecx, edx
xor eax, eax
or eax, ecx
je 0x1044f7f
mov ecx, dword [0x1073a44]
mov eax, ecx
and eax, edx
cmp ebx, dword [0x1073a40]
jne 0x1044f7f
cmp eax, ecx
jne 0x1044f7f
push 1
push 0x1001ad0
push dword [0x1073a24]
push dword [0x1073a20]
call fcn.01033385
lea ecx, [ebp - 0x24c]
call fcn.0106de2a
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01047480
leave
ret 8