Function at 0x470fc0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x64c1b2
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0x2b8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x2d0]
mov dword fs:[0], eax
lea ecx, [esp + 0x2c]
call fcn.004024f0
xor ebp, ebp
mov dword [esp + 0x2d8], ebp
lea ecx, [esp + 0x28]
call fcn.004024f0
mov byte [esp + 0x2d8], 1
lea ecx, [esp + 0x30]
call fcn.004024f0
mov byte [esp + 0x2d8], 2
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.00468f20
add esp, 0xc
test eax, eax
je 0x471299
mov edx, dword [0x75dbac]
mov ecx, dword [esp + 0x2c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x14]
push eax
push 0x20019
xor bl, bl
neg edx
push ebp
sbb edx, edx
push ecx
add edx, 0x80000002
push edx
mov dword [esp + 0x28], ebp
call edi
cmp eax, ebp
jne 0x4711fb
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0xd0]
push ecx
push ebp
push ebp
push ebp
push edx
mov dword [esp + 0x4c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
cmp eax, ebp
jne 0x4710b8
mov bl, 1
jmp 0x4711e8
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0xd4]
push edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0xb0], ebp
call fcn.0057bd10
add esp, 0xc
test eax, eax
je 0x4711d7
mov eax, dword [esp + 0xa4]
cmp eax, 8
jbe 0x4711d7
mov ecx, dword [0x75e284]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push 0x14c9
push 0x111
push ecx
call esi
lea ecx, [esp + 0x1c]
call fcn.004024f0
mov byte [esp + 0x2d8], 3
mov eax, dword [0x75e284]
lea edx, [esp + 0x1c]
push edx
push 0x14cc
push 0x111
push eax
call esi
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push 8
push ecx
push edx
call fcn.006282cf
add esp, 0xc
test eax, eax
je 0x4711c6
lea ecx, [esp + 0x18]
mov bl, 1
call fcn.004024f0
mov byte [esp + 0x2d8], 4
mov ecx, dword [0x75e284]
lea eax, [esp + 0x18]
push eax
push 0x14c6
push 0x111
push ecx
call esi
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], ebp
jge 0x47119c
push 0x80070057
call fcn.00401090
cmp byte [eax], 0x7b
jne 0x4711b5
mov edx, dword [esp + 0x20]
push edx
push eax
call fcn.006226ae
add esp, 8
test eax, eax
jne 0x4711b5
xor bl, bl
mov byte [esp + 0x2d8], 3
lea ecx, [esp + 0x18]
call fcn.00402560
mov byte [esp + 0x2d8], 2
lea ecx, [esp + 0x1c]
call fcn.00402560
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x4711e8
push eax
call fcn.006220cc
add esp, 4
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x47149a
mov eax, dword [0x75dbac]
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push ecx
push 1
neg eax
push ebp
sbb eax, eax
push edx
add eax, 0x80000002
push eax
call edi
cmp dword [esp + 0x14], ebp
je 0x47124b
cmp eax, ebp
jne 0x47124b
mov ecx, dword [0x75e284]
push ebp
push 0x14e3
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47149a
mov eax, dword [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x471252
sub eax, edx
inc eax
push eax
call fcn.005f4e47
add esp, 4
cmp eax, ebp
je 0x47149a
mov edx, dword [esp + 0x28]
mov esi, eax
mov cl, byte [edx]
mov byte [esi], cl
inc edx
inc esi
test cl, cl
jne 0x471273
push eax
mov eax, dword [0x75e284]
push 0x14ce
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x47149a
mov eax, dword [0x75dbac]
mov edx, dword [esp + 0x30]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ebp
lea ecx, [esp + 0x1c]
push ecx
push ebp
push 0xf003f
push ebp
push ebp
neg eax
push ebp
sbb eax, eax
push edx
add eax, 0x80000002
push eax
mov dword [esp + 0x3c], ebp
call esi
cmp eax, ebp
jne 0x47149a
lea ecx, [esp + 0xa4]
push ecx
mov byte [esp + 0xa8], 0x4b
mov byte [esp + 0xa9], 0x78
mov byte [esp + 0xaa], 0x6f
mov byte [esp + 0xab], 0x6e
mov byte [esp + 0xac], 0x74
mov byte [esp + 0xad], 0x72
mov byte [esp + 0xae], 0x73
mov byte [esp + 0xaf], 0
call fcn.00453b40
mov ecx, dword [esp + 0x1c]
add esp, 4
push ebp
lea edx, [esp + 0x18]
push edx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
lea eax, [esp + 0xc0]
push eax
push ecx
mov dword [esp + 0x38], ebp
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x471493
push ebp
call fcn.00624b1c
mov dword [esp + 0x28], edx
lea edx, [esp + 0x24]
mov dword [esp + 0x24], eax
push edx
lea eax, [esp + 0x64]
push eax
call fcn.00621d91
add esp, 0xc
cmp eax, ebp
jne 0x471380
mov esi, dword [esp + 0x70]
add esi, 0x76c
jmp 0x471382
xor esi, esi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x84]
push edx
call fcn.00621d91
add esp, 8
cmp eax, ebp
jne 0x4713a5
mov edi, dword [esp + 0x90]
inc edi
jmp 0x4713a7
xor edi, edi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.00621d91
add esp, 8
neg eax
sbb eax, eax
lea edx, [esi + esi*2 - 0x1644]
lea ecx, [edi + edx*4]
mov edx, ecx
not eax
and eax, dword [esp + 0x44]
shl edx, 4
sub edx, ecx
lea esi, [eax + edx*2]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0xb0]
push ecx
push ebp
push ebp
push ebp
push edx
mov dword [esp + 0x4c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x471433
lea eax, [esp + 0xac]
push eax
call fcn.006223ab
add esp, 4
cmp eax, ebp
je 0x47148c
sub esi, eax
cmp esi, 0x23
jbe 0x47148c
mov ecx, dword [0x75e284]
push ebp
push 0x14d0
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x47148c
lea ecx, [esp + 0x1c]
call fcn.004024f0
mov byte [esp + 0x2d8], 5
push esi
lea edx, [esp + 0x20]
push 0x6795fc
push edx
call fcn.00402f60
mov edx, dword [esp + 0x28]
mov eax, edx
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x471460
sub eax, esi
inc eax
push eax
mov eax, dword [esp + 0x18]
push edx
push 1
push ebp
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [esp + 0x2d8], 2
lea ecx, [esp + 0x1c]
call fcn.00402560
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov edx, dword [esp + 0x18]
push edx
call ebx
mov byte [esp + 0x2d8], 1
lea ecx, [esp + 0x30]
call fcn.00402560
mov byte [esp + 0x2d8], 0
lea ecx, [esp + 0x28]
call fcn.00402560
mov dword [esp + 0x2d8], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.00402560
mov ecx, dword [esp + 0x2d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.00620b8d
add esp, 0x2c8
ret