Function at 0x1044ad8
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x23c], ebx
cmp dword [0x10742bc], ebx
je 0x1044ba8
call fcn.0104188a
call fcn.01041adb
xor esi, esi
inc esi
mov dword [0x10742c8], esi
cmp dword [0x107289c], ebx
je 0x1044b8e
mov ecx, dword [0x10739c8]
cmp ecx, ebx
je 0x1044b8e
call fcn.0104589a
test eax, eax
je 0x1044b8e
mov ecx, dword [0x10739c8]
push ebx
call fcn.0104589a
mov ecx, eax
call fcn.01048585
mov ecx, dword [0x10739c8]
test eax, eax
je 0x1044b5d
push ebx
call fcn.0104589a
mov ecx, eax
call fcn.01048585
jmp 0x1044b69
call fcn.0104589a
mov ecx, eax
call fcn.010484d9
mov ecx, dword [0x10739c8]
push eax
call fcn.0104589a
mov ecx, eax
call fcn.010483b2
mov ecx, dword [0x10739c8]
call fcn.0104589a
mov ecx, eax
call fcn.0104a07e
cmp dword [ebp + 8], ebx
je 0x1044bfb
mov ecx, dword [0x10739c8]
cmp ecx, ebx
je 0x1044bf5
call fcn.0104589a
test eax, eax
je 0x1044bf5
jmp 0x1044bdd
cmp dword [ebp + 8], ebx
je 0x1044bfb
cmp dword [0x107289c], ebx
je 0x1044bfb
mov ecx, dword [0x10739c8]
cmp ecx, ebx
je 0x1044bfb
call fcn.0104589a
test eax, eax
je 0x1044bfb
mov ecx, dword [0x10739c8]
xor esi, esi
inc esi
call fcn.0104589a
mov ecx, eax
call fcn.0104a07e
mov ecx, dword [0x10739c8]
call fcn.0104589a
mov ecx, eax
call fcn.010484ff
test eax, eax
je 0x1044bf5
xor esi, esi
push esi
call fcn.01045693
push edi
push ebx
lea eax, [ebp - 0x23c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x1001b38
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1044c79
mov dword [ebp - 0x240], 1
cmp dword [0x107399c], ebx
jne 0x1044c57
push 4
pop edi
cmp dword [ebp + 8], ebx
je 0x1044c6b
push edi
lea eax, [ebp - 0x240]
push eax
push edi
push ebx
push 0x10020d0
push dword [ebp - 0x23c]
call esi
jmp 0x1044c6b
push 0x10020d0
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 4
pop edi
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1044c7c
push 4
pop edi
lea ecx, [ebp - 0x24c]
call fcn.0106e3bd
lea eax, [ebp - 0x24c]
push eax
call fcn.01041912
test eax, eax
jl 0x1044d2c
lea eax, [ebp - 0x23c]
push eax
push 3
push ebx
push dword [ebp - 0x24c]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1044d2c
mov dword [ebp - 0x240], 1
cmp dword [0x107399c], ebx
jne 0x1044cea
cmp dword [ebp + 8], ebx
je 0x1044d00
push edi
lea eax, [ebp - 0x240]
push eax
push edi
push ebx
push 0x10020d0
push dword [ebp - 0x23c]
call esi
jmp 0x1044cfb
push 0x10020d0
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp + 8], ebx
jne 0x1044d05
cmp dword [ebp + 0xc], ebx
je 0x1044d1a
push edi
push 0x10742a8
push edi
push ebx
push 0x1004708
push dword [ebp - 0x23c]
call esi
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x23c], ebx
cmp dword [ebp + 8], ebx
jne 0x1044d3a
cmp dword [ebp + 0xc], ebx
je 0x1044e8c
push ebx
lea eax, [ebp - 0x23c]
push eax
push ebx
push 3
push ebx
push ebx
push ebx
push 0x1001b38
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1044e16
push edi
push 0x1074298
push edi
push ebx
push 0x10046c0
push dword [ebp - 0x23c]
call esi
push 1
push 0x107429c
push 3
push ebx
push 0x10047dc
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742a0
push edi
push ebx
push 0x10046e4
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742a8
push edi
push ebx
push 0x1004708
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742ac
push edi
push ebx
push 0x100474c
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742b0
push edi
push ebx
push 0x100476c
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742b4
push edi
push ebx
push 0x1004794
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742b8
push edi
push ebx
push 0x10047b4
push dword [ebp - 0x23c]
call esi
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x10742c0]
push 0x1004968
call fcn.01056d0d
cmp dword [ebp + 8], ebx
je 0x1044e8c
push 0xa
pop ecx
mov esi, 0x100173c
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp dword [0x10742c8], ebx
je 0x1044e87
lea eax, [ebp - 0x240]
push eax
push 0x1004ec0
push ebx
push 0x1005784
push ebx
mov dword [ebp - 0x240], ebx
call dword [sym.imp.SHELL32.dll_SHCoCreateInstance]
test eax, eax
jl 0x1044e75
mov eax, dword [ebp - 0x240]
mov ecx, dword [eax]
lea edx, [ebp - 0x30]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x240]
cmp eax, ebx
je 0x1044e8c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1044e8c
call fcn.01044a75
mov ecx, dword [0x1074294]
xor eax, eax
mov word [ebp - 0x238], ax
mov esi, 0x104
pop edi
cmp ecx, ebx
je 0x1044ece
push esi
lea eax, [ebp - 0x238]
push eax
call fcn.01046c73
mov ecx, dword [0x1074294]
call fcn.01046cb6
mov eax, dword [0x1074294]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x1074294], ebx
cmp dword [ebp + 8], ebx
je 0x1044f0c
cmp dword [ebp + 0xc], ebx
jne 0x1044f0c
cmp word [ebp - 0x238], bx
je 0x1044eef
push esi
lea eax, [ebp - 0x238]
push eax
push eax
call fcn.010582d2
cmp dword [0x1072b8c], ebx
je 0x1044f07
lea eax, [ebp - 0x238]
push eax
call fcn.01042fe2
cmp eax, ebx
jne 0x1044f0c
call fcn.01058105
cmp dword [0x1073a4c], ebx
je 0x1044f62
mov al, byte [0x1073a50]
cmp al, 4
jae 0x1044f21
cmp al, bl
jne 0x1044f62
mov ecx, dword [0x1073a3c]
mov edx, 0x80000000
and ecx, edx
xor eax, eax
or eax, ecx
je 0x1044f62
mov ecx, dword [0x1073a44]
mov eax, ecx
and eax, edx
cmp ebx, dword [0x1073a40]
jne 0x1044f62
cmp eax, ecx
jne 0x1044f62
push 1
push 0x1001ad0
push dword [0x1073a24]
push dword [0x1073a20]
call fcn.01033365
lea ecx, [ebp - 0x24c]
call fcn.0106de0a
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01047464
leave
ret 8