Function at 0x478bc0
Capabilities:
Delete registry value
Get graphical window text
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x577
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x500
xorps xmm0, xmm0
mov edi, eax
push esi
movlpd qword [esp + 0x18], xmm0
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x478c3f
lea ecx, [esp + 0x24]
push ecx
push 0
push eax
call sym.SystemInformer.exe_Ordinal_1803
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x478c3f
lea eax, [esp + 0x10]
push eax
push 0xa
push ebx
call sym.SystemInformer.exe_Ordinal_1451
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x478c3f
call fcn.004fe0c0
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x28
push eax
mov dword [esp + 0x2c], str.SampleCountAutomatic
call sym.SystemInformer.exe_Ordinal_1886
push 0
push 0
push 0xf0
test eax, eax
push 0x551
push esi
setne bl
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
sete al
cmp al, bl
je 0x478c8b
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x28
push eax
mov dword [esp + 0x30], str.SampleCountAutomatic
call sym.SystemInformer.exe_Ordinal_1904
mov ebx, dword [esp + 0x10]
mov eax, 1
test ebx, ebx
mov dword [esp + 0x10], 0x16
mov dword [esp + 0x14], str.SampleCount
cmove ebx, eax
lea eax, [esp + 0x10]
push eax
call sym.SystemInformer.exe_Ordinal_1886
cmp ebx, eax
je 0x478cdc
mov byte [0x633f5c], 1
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x16
push eax
mov dword [esp + 0x1c], str.SampleCount
call sym.SystemInformer.exe_Ordinal_1904
push 0x477
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x24]
push ecx
push 0
push eax
call sym.SystemInformer.exe_Ordinal_1803
push dword [esp + 0x24]
call sym.SystemInformer.exe_Ordinal_1238
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x18
push eax
mov dword [esp + 0x1c], str.SearchEngine
call sym.SystemInformer.exe_Ordinal_1908
push 0x47f
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x24]
push ecx
push 0
push eax
call sym.SystemInformer.exe_Ordinal_1803
push dword [esp + 0x24]
call sym.SystemInformer.exe_Ordinal_1238
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x32
push eax
mov dword [esp + 0x1c], str.ProgramInspectExecutables
call sym.SystemInformer.exe_Ordinal_1908
push 0
push 0
push 0x147
push 0x478
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov dword [0x6314c0], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x16
mov dword [esp + 0x1c], str.MaxSizeUnit
call sym.SystemInformer.exe_Ordinal_1904
push 0x4e0
xorps xmm0, xmm0
push esi
movlpd qword [esp + 0x18], xmm0
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x478e05
lea ecx, [esp + 0x24]
push ecx
push 0
push eax
call sym.SystemInformer.exe_Ordinal_1803
mov esi, dword ds:[esp + 0x24]
test esi, esi
je 0x478e05
lea eax, [esp + 0x10]
push eax
push 0xa
push esi
call sym.SystemInformer.exe_Ordinal_1451
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x478e05
nop
call fcn.004fe0c0
push dword ds:[esp + 0x10]
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x1a
push eax
mov dword [esp + 0x30], str.IconProcesses
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x22
push eax
mov dword [esp + 0x18], str.DbgHelpSearchPath
call sym.SystemInformer.exe_Ordinal_1889
mov ebx, dword [esp + 0x1c]
mov esi, eax
push 0x4c2
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x1c]
push ecx
push 0
push eax
call sym.SystemInformer.exe_Ordinal_1803
push esi
call sym.SystemInformer.exe_Ordinal_1238
push dword [esp + 0x1c]
mov esi, eax
call sym.SystemInformer.exe_Ordinal_1238
push 1
push esi
push eax
call sym.SystemInformer.exe_Ordinal_1351
test al, al
jne 0x478ec1
push 0x4c2
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0x1c]
push ecx
push 0
push eax
call sym.SystemInformer.exe_Ordinal_1803
push dword [esp + 0x1c]
call sym.SystemInformer.exe_Ordinal_1238
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x22
push eax
mov dword [esp + 0x1c], str.DbgHelpSearchPath
call sym.SystemInformer.exe_Ordinal_1908
mov byte [0x633f5c], 1
push 0xf000
push 0
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x28
xor ecx, ecx
mov dword [esp + 0x14], str.AllowOnlyOneInstance
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 1
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x16
xor ecx, ecx
mov dword [esp + 0x14], str.HideOnClose
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 2
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x1c
xor ecx, ecx
mov dword [esp + 0x14], str.HideOnMinimize
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 4
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x16
xor ecx, ecx
mov dword [esp + 0x14], str.StartHidden
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x2a
push eax
mov dword [esp + 0x18], str.MiniInfoWindowEnabled
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 0xe
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x478fff
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x2a
push eax
mov dword [esp + 0x1c], str.MiniInfoWindowEnabled
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 0xf
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x36
xor ecx, ecx
mov dword [esp + 0x14], str.MainWindowTabRestoreEnabled
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x12
push eax
mov dword [esp + 0x18], str.KsiEnable
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 6
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x4790a4
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x12
push eax
mov dword [esp + 0x1c], str.KsiEnable
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 5
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x1c
xor ecx, ecx
mov dword [esp + 0x14], str.EnableWarnings
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1a
push eax
mov dword [esp + 0x18], str.EnablePlugins
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 8
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x47914f
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1a
push eax
mov dword [esp + 0x1c], str.EnablePlugins
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 0xa
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x22
xor ecx, ecx
mov dword [esp + 0x14], str.DbgHelpUndecorate
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 9
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x20
xor ecx, ecx
mov dword [esp + 0x14], str.EnableAvxSupport
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x34
push eax
mov dword [esp + 0x18], str.TreeListEnableHeaderTotals
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 0xb
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x47923e
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x34
push eax
mov dword [esp + 0x1c], str.TreeListEnableHeaderTotals
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x26
push eax
mov dword [esp + 0x18], str.EnableGraphMaxScale
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 0xd
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x4792a6
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x26
push eax
mov dword [esp + 0x1c], str.EnableGraphMaxScale
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x26
push eax
mov dword [esp + 0x18], str.EnableCycleCpuUsage
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 0xc
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x47930f
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x26
push eax
mov dword [esp + 0x1c], str.EnableCycleCpuUsage
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x24
push eax
mov dword [esp + 0x18], str.EnableThemeSupport
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 0x10
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x479377
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x24
push eax
mov dword [esp + 0x1c], str.EnableThemeSupport
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 0x11
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x24
xor ecx, ecx
mov dword [esp + 0x14], str.EnableStartAsAdmin
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x24
push eax
mov dword [esp + 0x18], str.EnableStreamerMode
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 0x12
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x47941e
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x24
push eax
mov dword [esp + 0x1c], str.EnableStreamerMode
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 0x13
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x2e
xor ecx, ecx
mov dword [esp + 0x14], str.EnableSilentCrashNotify
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 7
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x26
xor ecx, ecx
mov dword [esp + 0x14], str.EnableMonospaceFont
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x28
push eax
mov dword [esp + 0x18], str.EnableNetworkResolve
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 0x14
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x479500
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x28
push eax
mov dword [esp + 0x1c], str.EnableNetworkResolve
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x2e
push eax
mov dword [esp + 0x18], str.EnableNetworkResolveDoH
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 0x15
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x47956b
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x2e
push eax
mov dword [esp + 0x1c], str.EnableNetworkResolveDoH
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 0x16
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x2a
xor ecx, ecx
mov dword [esp + 0x14], str.EnableInstantTooltips
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
lea eax, ds:[esp + 0x10]
mov dword [esp + 0x10], 0x36
push eax
mov dword [esp + 0x18], str.EnableImageCoherencySupport
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 0x17
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x479615
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x36
push eax
mov dword [esp + 0x1c], str.EnableImageCoherencySupport
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x18
push eax
mov dword [esp + 0x18], str.EnableStage2
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 0x18
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x47967e
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x18
push eax
mov dword [esp + 0x1c], str.EnableStage2
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x26
push eax
mov dword [esp + 0x18], str.EnableServiceStage2
call sym.SystemInformer.exe_Ordinal_1886
push 0xf000
push 0x19
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x4796e6
mov byte [0x633f5c], 1
movzx eax, al
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x26
push eax
mov dword [esp + 0x1c], str.EnableServiceStage2
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 0x1a
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x1e
xor ecx, ecx
mov dword [esp + 0x14], str.IconSingleClick
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 0x1b
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x2a
xor ecx, ecx
mov dword [esp + 0x14], str.IconTogglesVisibility
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 0x1c
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x22
xor ecx, ecx
mov dword [esp + 0x14], str.PropagateCpuUsage
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 0x1d
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [esp + 0x10], 0x2a
xor ecx, ecx
mov dword [esp + 0x14], str.EnableAdvancedOptions
cmp eax, 0x2000
lea eax, [esp + 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1904
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x24
push eax
mov dword [esp + 0x18], str.EnableThemeSupport
call sym.SystemInformer.exe_Ordinal_1886
nop
test eax, eax
je 0x479845
push 1
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
mov dword [esp + 0x1c], str.GraphColorMode
call sym.SystemInformer.exe_Ordinal_1904
push 0xf000
push 4
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xf000
push 3
push 0x102c
shr eax, 0xc
push edi
mov dword [esp + 0x2c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
shr esi, 0xc
cmp esi, 2
sete cl
cmp byte [0x633f5d], cl
je 0x4799d1
push 0
push 0x62ee78
push 0xfffffffffffffff7
push 0x20006
lea eax, [esp + 0x34]
push eax
call sym.SystemInformer.exe_Ordinal_1555
test eax, eax
js 0x4799d1
cmp esi, 2
jne 0x479994
call sym.SystemInformer.exe_Ordinal_1639
mov ebx, eax
test ebx, ebx
je 0x4799c7
push 0x62ef68
push ebx
push 0x62ef68
call sym.SystemInformer.exe_Ordinal_1299
push eax
call sym.SystemInformer.exe_Ordinal_1238
mov edi, eax
cmp dword [esp + 0x1c], esi
jne 0x479938
mov ecx, dword [edi]
lea eax, [esp + 0x10]
push 0
push 0
add ecx, 0xc
mov dword [esp + 0x1c], 0
push eax
mov dword [esp + 0x1c], ecx
call sym.SystemInformer.exe_Ordinal_1331
push dword [edi]
mov esi, eax
push dword [edi + 4]
push dword [esi + 4]
call fcn.00586310
mov ecx, dword [esi + 4]
add esp, 0xc
add ecx, dword [edi]
movq xmm0, qword [str.__hide]
push esi
movq qword [ecx], xmm0
mov eax, dword [0x5fbc78]
mov dword [ecx + 8], eax
call sym.SystemInformer.exe_Ordinal_1238
mov edi, eax
mov ecx, dword [0x62ef70]
mov edx, dword ds:[edi]
add edx, 2
mov word [esp + 0x1c], cx
lea eax, [ecx + 2]
mov word [esp + 0x1e], ax
mov eax, dword [0x62ef74]
mov dword [esp + 0x20], eax
cmp ecx, 0xfffe
ja 0x47997f
push edx
push dword [edi + 4]
lea eax, [esp + 0x24]
push 1
push 0
push eax
push dword [esp + 0x38]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4799c7
call fcn.004fe0c0
jmp 0x4799c7
mov ecx, dword [0x62ef70]
mov word [esp + 0x1c], cx
lea eax, [ecx + 2]
mov word [esp + 0x1e], ax
mov eax, dword [0x62ef74]
mov dword [esp + 0x20], eax
cmp ecx, 0xfffe
ja 0x4799c7
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [esp + 0x24]
call dword [sym.imp.ntdll.dll_NtClose]
push 0x478960
push 0
push 0x10
call sym.SystemInformer.exe_Ordinal_1172
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret