Function at 0x47f28c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56925e
mov eax, dword fs:[0]
push eax
mov eax, 0x1274
call fcn.005482e0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov edi, edx
mov dword [ebp - 0x1278], edi
mov dword [ebp - 0x127c], ecx
cmp eax, ebx
jne 0x47f4df
cmp dword [edi + 0x4dc], 0
je 0x47fa6e
mov eax, dword [edi + 0x4c8]
test eax, eax
je 0x47f413
mov esi, dword [eax + 0x4c]
lea ecx, [edi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x38]
cmp eax, esi
jne 0x47f413
mov eax, dword [edi + 0x4e0]
test eax, eax
je 0x47f37a
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47f37a
mov esi, dword [edi + 0x4e0]
call fcn.0047a4d5
test eax, eax
je 0x47f37a
xor eax, eax
push 0x1048
push eax
mov word [ebp - 0x1270], ax
lea eax, [ebp - 0x126e]
push eax
call fcn.00537010
mov esi, dword [edi + 0x4c8]
add esp, 0xc
push 0x823
push 0xd
lea ebx, [ebp - 0x1270]
call fcn.004bb4fc
mov ecx, dword [edi + 0x4e0]
mov eax, ebx
push eax
call fcn.0047a111
jmp 0x47f413
xor eax, eax
push 0x1048
push eax
mov word [ebp - 0x1270], ax
lea eax, [ebp - 0x126e]
push eax
call fcn.00537010
mov esi, dword [edi + 0x4c8]
add esp, 0xc
push 0x823
push 0xd
lea ebx, [ebp - 0x1270]
call fcn.004bb4fc
mov eax, ebx
push eax
lea eax, [ebp - 0x1274]
push eax
call fcn.00408273
and dword [ebp - 4], 0
push 0x583f04
push 0x586e2c
lea eax, [ebp - 0x1274]
push eax
call fcn.00432392
mov ecx, dword [ebp - 0x1274]
call fcn.0049a47c
mov edx, dword [ebp - 0x1274]
xor ecx, ecx
push 0
push ecx
push dword [edi + 0x4dc]
inc ecx
test eax, eax
jne 0x47f3fc
mov edx, ebx
call fcn.0044f729
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1274]
add eax, 0xfffffff0
call fcn.00407d09
mov eax, dword [edi + 0x4cc]
test eax, eax
je 0x47fa6e
mov esi, dword [eax + 0x4c]
lea ecx, [edi + 0x2c0]
mov eax, dword [ecx]
call dword [eax + 0x38]
cmp eax, esi
jne 0x47fa6e
xor eax, eax
push 0x208
mov word [ebp - 0x220], ax
xor esi, esi
lea eax, [ebp - 0x21e]
push esi
push eax
call fcn.00537010
mov eax, dword [edi + 0x4cc]
add esp, 0xc
push esi
push esi
call fcn.004ce0ac
mov esi, dword [edi + 0x4cc]
push 0x103
push 0xd
lea ebx, [ebp - 0x220]
call fcn.004bb4fc
xor eax, eax
push 0x1046
push eax
mov word [ebp - 0x1270], ax
lea eax, [ebp - 0x126e]
push eax
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 0x1270]
push 0x577458
push eax
call fcn.0044bb93
mov edi, eax
mov eax, ebx
call fcn.0044bbce
test eax, eax
je 0x47fa6e
mov eax, dword [ebp - 0x1278]
push 1
push 0
push dword [eax + 0x4dc]
lea edx, [ebp - 0x1270]
push 6
pop ecx
call fcn.0044f729
jmp 0x47fa6e
cmp eax, 0xd7
jne 0x47f573
call fcn.0049a824
test al, al
je 0x47f516
call fcn.0049a86c
test al, al
je 0x47f516
push str.firstsetdef
push str.Software_shouxin
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x47fa6e
call fcn.00416b38
push dword [eax + 4]
call fcn.005519e6
push 0x1388
test al, al
je 0x47f558
push 0x5875ac
push dword [edi + 0x10]
push ecx
call fcn.00489239
pop ecx
mov esi, eax
call fcn.0048914f
cmp dword [edi + 0x598], ebx
jne 0x47fa6e
call fcn.0048338f
jmp 0x47fa6e
push 0x5875b8
push dword [edi + 0x10]
push ecx
call fcn.00489239
pop ecx
mov esi, eax
call fcn.0048914f
jmp 0x47fa6e
mov ecx, eax
shr ecx, 0x10
mov edx, ebx
movzx esi, ax
cmp dx, cx
jne 0x47f585
movzx eax, ax
mov ecx, 0xa9
cmp eax, ecx
ja 0x47f7ac
je 0x47f7a0
lea ecx, [eax - 0x6a]
cmp ecx, 0x3c
ja case.0x47f5ab.107
movzx ecx, byte [ecx + 0x47fad0]
jmp dword [ecx*4 + 0x47fa8c]
mov eax, edi
call fcn.004803c1
jmp case.0x47f5ab.107
mov eax, edi
call fcn.004803ee
jmp case.0x47f5ab.107
call fcn.00480abd
jmp case.0x47f5ab.107
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
lea esi, [edi + 0x4e0]
mov eax, dword [esi]
test eax, eax
je 0x47f5f6
push dword [eax + 0x10]
call ebx
test eax, eax
je 0x47f5f6
mov esi, dword [esi]
call fcn.0047a4c0
lea esi, [edi + 0x4e4]
mov eax, dword [esi]
test eax, eax
je 0x47f612
push dword [eax + 0x10]
call ebx
test eax, eax
je 0x47f612
mov esi, dword [esi]
call fcn.0047a4c0
mov edi, dword [edi + 0x4d8]
push 1
mov edx, edi
call fcn.0048ab3c
mov ecx, edi
call fcn.0048ac11
jmp case.0x47f5ab.107
add edi, 0x4c8
mov eax, dword [edi]
test eax, eax
je case.0x47f5ab.107
call fcn.004bd06c
mov eax, dword [edi]
push 0
push 0xffff0000
call fcn.004ce0ac
jmp case.0x47f5ab.107
push eax
push edi
call fcn.00480d58
jmp case.0x47f5ab.107
mov eax, dword [edi + 0x4dc]
call fcn.0044fdb5
test eax, eax
je case.0x47f5ab.107
call fcn.00420faf
jmp case.0x47f5ab.107
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
lea esi, [edi + 0x4e0]
mov eax, dword [esi]
test eax, eax
je 0x47f6a0
push dword [eax + 0x10]
call ebx
test eax, eax
je 0x47f6a0
mov esi, dword [esi]
call fcn.0047a4c0
lea esi, [edi + 0x4e4]
mov eax, dword [esi]
test eax, eax
je 0x47f6bc
push dword [eax + 0x10]
call ebx
test eax, eax
je 0x47f6bc
mov esi, dword [esi]
call fcn.0047a4c0
push 1
xor eax, eax
push eax
push eax
push 1
push dword [0x5d12a8]
push 1
push eax
push str.shouxin:newtab
push dword [edi + 0x4dc]
call fcn.0044fb95
jmp case.0x47f5ab.107
push edi
call fcn.00480629
jmp case.0x47f5ab.107
mov eax, dword [edi + 0x4dc]
call fcn.0044fdb5
test eax, eax
je case.0x47f5ab.107
push 8
jmp 0x47f925
xor eax, eax
cmp dword [edi + 0x5c0], eax
jne case.0x47f5ab.107
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
jmp 0x47fa21
push 0
push 0xf020
push 0x112
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.0x47f5ab.107
mov esi, edi
call fcn.00480398
jmp case.0x47f5ab.107
call fcn.00434521
mov ebx, eax
mov eax, dword [edi + 0x564]
neg eax
sbb eax, eax
not eax
and eax, edi
push eax
push 0xffffffffffffffff
push 1
xor eax, eax
call fcn.00434729
push 0
test eax, eax
je 0x47f781
mov ecx, dword [edi + 0x568]
push dword [eax + 0x4dc]
mov dword [eax + 0x568], ecx
jmp 0x47f787
push dword [edi + 0x4dc]
call fcn.0044f362
jmp case.0x47f5ab.107
mov edi, dword [edi + 0x10]
push ebx
call fcn.0041009f
pop ecx
jmp case.0x47f5ab.107
mov ecx, edi
call fcn.00485a2f
jmp case.0x47f5ab.107
mov ecx, 0xc1
cmp eax, ecx
ja 0x47f8d6
je 0x47f8b2
add ecx, 0xfffffff8
cmp eax, ecx
ja 0x47f85e
je 0x47fa2c
sub eax, 0xaa
je 0x47f854
dec eax
dec eax
je 0x47f849
dec eax
je case.0x47f5ab.158
sub eax, 0xb
jne case.0x47f5ab.107
mov eax, edi
call fcn.00484f82
jmp case.0x47f5ab.107
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
lea esi, [edi + 0x4e0]
mov eax, dword [esi]
test eax, eax
je 0x47f815
push dword [eax + 0x10]
call ebx
test eax, eax
je 0x47f815
mov esi, dword [esi]
call fcn.0047a4c0
lea esi, [edi + 0x4e4]
mov eax, dword [esi]
test eax, eax
je 0x47f831
push dword [eax + 0x10]
call ebx
test eax, eax
je 0x47f831
mov esi, dword [esi]
call fcn.0047a4c0
mov eax, dword [edi + 0x4dc]
call fcn.0044fdb5
push eax
mov eax, edi
call fcn.0047fb0d
jmp case.0x47f5ab.107
push edi
call fcn.00486752
jmp case.0x47f5ab.107
call fcn.004801e3
jmp case.0x47f5ab.107
sub eax, 0xbb
je 0x47f893
sub eax, 3
je 0x47f87c
dec eax
jne case.0x47f5ab.107
push edi
call fcn.004804d2
jmp case.0x47f5ab.107
mov eax, dword [edi + 0x4dc]
call fcn.0044fdb5
test eax, eax
je case.0x47f5ab.107
push 6
jmp 0x47f8a8
mov eax, dword [edi + 0x4dc]
call fcn.0044fdb5
test eax, eax
je case.0x47f5ab.107
push 4
call fcn.0047d4a9
jmp case.0x47f5ab.107
xor eax, eax
cmp dword [0x64a620], eax
mov edx, 0x64a620
sete al
mov dword [0x64a620], eax
call fcn.0044d1e2
call fcn.00485562
jmp case.0x47f5ab.107
mov ecx, 0xc7
cmp eax, ecx
ja 0x47f96b
je 0x47f93f
sub eax, 0xc3
je 0x47f92f
dec eax
je 0x47f90e
dec eax
je 0x47f8fc
dec eax
jne case.0x47f5ab.107
push ebx
jmp 0x47f8fe
push 0
mov edx, dword [edi + 0x4d8]
call fcn.0048ab6e
jmp case.0x47f5ab.107
mov eax, dword [edi + 0x4dc]
call fcn.0044fdb5
test eax, eax
je case.0x47f5ab.107
movzx ecx, si
push ecx
call fcn.004257dd
jmp case.0x47f5ab.107
push dword [edi + 0x4d8]
call fcn.0048d813
jmp case.0x47f5ab.107
mov eax, dword [edi + 0x4dc]
call fcn.0044fdb5
test eax, eax
je case.0x47f5ab.107
cmp dword [eax + 0x76a0], 0
je case.0x47f5ab.107
push 0
push 0x204
jmp 0x47fa5b
sub eax, 0x1fb
je 0x47fa2c
sub eax, 9
je 0x47fa10
dec eax
jne case.0x47f5ab.107
mov esi, dword [ebp + 0xc]
mov eax, dword [0x5beb28]
mov ebx, 0x5beb28
mov ecx, ebx
shr esi, 0x10
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1278], eax
mov dword [ebp - 4], 1
mov eax, dword [0x5beb28]
mov ecx, ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1274], eax
lea eax, [ebp - 0x1274]
push eax
lea eax, [ebp - 0x1278]
push eax
movzx eax, si
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0x5d8c90
xor ebx, ebx
mov byte [ebp - 4], 2
call fcn.00418fb8
mov ebx, dword [ebp - 0x1274]
test eax, eax
je 0x47f9f8
push 3
mov esi, edi
call fcn.00482512
lea eax, [ebx - 0x10]
call fcn.00407d09
mov eax, dword [ebp - 0x1278]
add eax, 0xfffffff0
call fcn.00407d09
jmp case.0x47f5ab.107
cmp dword [edi + 0x5c0], 0
jne case.0x47f5ab.107
push ebx
push dword [ebp + 0xc]
push 0xffffffffffffffff
push 0
xor edx, edx
mov ecx, edi
call fcn.00482646
jmp case.0x47f5ab.107
xor esi, esi
cmp dword [0x5d7894], esi
jne case.0x47f5ab.107
cmp dword [0x5d7898], esi
jne case.0x47f5ab.107
mov eax, dword [edi + 0x4dc]
call fcn.0044fdb5
cmp eax, esi
je case.0x47f5ab.107
cmp dword [eax + 0x76a0], esi
je case.0x47f5ab.107
push esi
push 0x208
mov esi, eax
call fcn.00422cb5
mov eax, dword [ebp - 0x127c]
mov dword [eax], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052f7d0
leave
ret 8