Function at 0x47a3e0
Capabilities:
Delete registry key
Delete registry value
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59486b
mov eax, dword fs:[0]
push eax
mov eax, 0x2248
call fcn.004c6d00
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2224], ecx
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2220], eax
xor eax, eax
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], ebx
mov dword [ebp - 0x2228], eax
push edi
mov dword [ebp - 4], eax
call fcn.004796f0
mov esi, eax
test esi, esi
js 0x47adf3
cmp word [edi], 0x7d
je 0x47ade0
nop word [eax + eax]
push 0x5d90e0
push edi
mov dword [ebp - 0x2234], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x5d90b4
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x2238], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x47a499
test esi, esi
je 0x47a5a2
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.004796f0
mov esi, eax
test esi, esi
js 0x47ade0
cmp dword [ebp + 0x10], 0
je 0x47a5a2
movzx ecx, word [edi]
mov eax, edi
mov dword [ebp - 0x2248], 0
mov dword [ebp - 0x2240], 0
test cx, cx
je 0x47a501
mov edx, ecx
nop dword [eax]
cmp dx, 0x5c
je 0x47a4f9
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x47a4e0
jmp 0x47a501
test eax, eax
jne 0x47adc9
mov esi, 0x5e4e00
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x47a554
add esi, 4
cmp esi, 0x5e4e30
jl 0x47a506
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2248]
push edi
mov dword [ebp - 0x2248], eax
mov dword [ebp - 0x2244], 0
call fcn.00478e50
mov dword [ebp - 0x2248], 0
mov dword [ebp - 0x2240], 0
cmp dword [ebp - 0x2238], 0
je 0x47a598
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.004796f0
mov esi, eax
test esi, esi
js 0x47ade0
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.00479dd0
mov esi, eax
test esi, esi
js 0x47ade0
mov dword [ebp - 0x2244], 0
jmp 0x47aa1b
mov dword [ebp - 0x2244], 0
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x47a5ce
mov ecx, dword [ebp - 0x2224]
push edi
mov dword [ebp - 0x2234], eax
call fcn.004796f0
mov esi, eax
test esi, esi
js 0x47ade0
push 0x5d90ac
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x47a725
mov ecx, dword [ebp - 0x2224]
lea eax, [ebp - 0x2218]
push eax
call fcn.004796f0
mov esi, eax
test esi, esi
js 0x47ade0
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.004796f0
mov esi, eax
test esi, esi
js 0x47ade0
cmp word [edi], 0x3d
jne 0x47adc9
cmp dword [ebp + 0x10], 0
je 0x47a69d
mov eax, dword [ebp - 0x2220]
mov ecx, dword [ebp - 0x2224]
mov byte [ebp - 4], 1
mov dword [ebp - 0x2254], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2254]
mov dword [ebp - 0x2250], 0
push eax
mov dword [ebp - 0x224c], 0
call fcn.004798a0
mov esi, eax
mov dword [ebp - 0x2254], 0
mov dword [ebp - 0x2250], 0
mov dword [ebp - 0x224c], 0
test esi, esi
js 0x47ade0
mov byte [ebp - 4], 0
mov dword [ebp - 0x2250], 0
jmp 0x47aa1b
cmp dword [ebp + 0x14], 0
jne 0x47a70a
cmp dword [ebp - 0x2234], 0
je 0x47a70a
xor ebx, ebx
lea eax, [ebp - 0x2234]
mov dword [ebp - 0x2234], ebx
push eax
push 0x20006
push ebx
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47a6d8
mov ebx, dword [ebp - 0x2234]
mov byte [ebp - 4], 0
test eax, eax
jne 0x47adb3
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x47a6ff
cmp eax, 2
jne 0x47adb3
test ebx, ebx
je 0x47a70a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.00479dd0
mov esi, eax
test esi, esi
js 0x47ade0
jmp 0x47ada2
movzx ecx, word [edi]
mov eax, edi
test cx, cx
je 0x47a752
mov edx, ecx
cmp dx, 0x5c
je 0x47a74a
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x47a731
jmp 0x47a752
test eax, eax
jne 0x47add0
cmp dword [ebp + 0x10], 0
je 0x47aa6c
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x2228]
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x47a7dc
cmp dword [esi], 0
je 0x47a7cf
push 0x5e22bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x47a792
mov eax, 1
jmp 0x47a822
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x47a7d5
mov eax, dword [ebp - 0x2228]
mov ecx, esi
push 0
push dword [eax]
lea eax, [ebp - 0x221c]
push eax
push 0x2001f
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x5c3794]
call esi
jmp 0x47a7f7
cmp dword [esi + 4], 0
jne 0x47a7dc
mov eax, 1
jmp 0x47a7f7
lea eax, [ebp - 0x221c]
push eax
push 0x2001f
push 0
push edi
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47a81c
test ebx, ebx
je 0x47a806
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], 0
mov esi, dword [ebp - 0x2228]
mov byte [ebp - 4], 0
test eax, eax
je 0x47a9da
mov byte [ebp - 4], 4
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x47a8a8
cmp dword [esi], 0
je 0x47a89b
push 0x5e22bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x47a85e
mov eax, 1
jmp 0x47a8ee
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x47a8a1
mov eax, dword [ebp - 0x2228]
mov ecx, esi
push 0
push dword [eax]
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x5c3794]
call esi
jmp 0x47a8c3
cmp dword [esi + 4], 0
jne 0x47a8a8
mov eax, 1
jmp 0x47a8c3
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47a8e8
test ebx, ebx
je 0x47a8d2
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], 0
mov esi, dword [ebp - 0x2228]
mov byte [ebp - 4], 0
test eax, eax
je 0x47a9da
mov byte [ebp - 4], 5
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x47a981
cmp dword [esi], 0
je 0x47a974
push 0x5e22bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x47a92a
mov eax, 1
jmp 0x47a9ce
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x47a97a
mov eax, dword [ebp - 0x2228]
mov ecx, esi
push 0
push dword [eax]
lea eax, [ebp - 0x223c]
push eax
lea eax, [ebp - 0x221c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x5c3794]
call esi
jmp 0x47a9a9
cmp dword [esi + 4], 0
jne 0x47a981
mov eax, 1
jmp 0x47a9a9
lea eax, [ebp - 0x223c]
push eax
lea eax, [ebp - 0x221c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x47a9ce
test ebx, ebx
je 0x47a9b8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], 0
mov byte [ebp - 4], 0
test eax, eax
jne 0x47add7
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.004796f0
mov esi, eax
test esi, esi
js 0x47ade0
cmp word [edi], 0x3d
jne 0x47aa1b
mov ecx, dword [ebp - 0x2224]
lea eax, [ebp - 0x2230]
push edi
push 0
push eax
call fcn.004798a0
mov esi, eax
test esi, esi
js 0x47ade0
mov ebx, dword [ebp - 0x2230]
cmp word [edi], 0x7b
jne 0x47ada2
push edi
call fcn.004d4367
add esp, 4
cmp eax, 1
jne 0x47ada2
push 0
push dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp - 0x2224]
mov ecx, ebx
push edi
call fcn.0047a3e0
mov esi, eax
test esi, esi
js 0x47ade0
push edi
mov ecx, ebx
call fcn.004796f0
mov esi, eax
test esi, esi
js 0x47ade0
jmp 0x47ada2
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x47ab40
mov byte [ebp - 4], 6
mov ebx, dword [ebp - 0x2228]
mov dword [ebp - 0x221c], esi
test ebx, ebx
je 0x47aaed
cmp dword [ebx], esi
je 0x47aae0
push 0x5e22bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x47aaa9
lea ebx, [esi + 1]
mov byte [ebp - 4], al
jmp 0x47ab45
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x47aae6
push 0
push dword [ebx]
lea eax, [ebp - 0x221c]
mov ecx, esi
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x5c3794]
call esi
jmp 0x47ab08
cmp dword [ebx + 4], 0
jne 0x47aaed
mov ebx, 1
jmp 0x47ab0a
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x47ab37
mov eax, dword [ebp - 0x2230]
test eax, eax
je 0x47ab21
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov eax, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], 0
mov esi, dword [ebp + 0x14]
mov byte [ebp - 4], 0
jmp 0x47ab45
mov ebx, 2
test ebx, ebx
mov eax, 1
push 0xffffffffffffffff
cmove eax, esi
push edi
mov dword [ebp - 0x221c], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004d11b1
push eax
call fcn.00443050
mov ecx, dword [ebp - 0x2224]
add esp, 0x14
push edi
call fcn.004796f0
mov esi, eax
test esi, esi
js 0x47ade0
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.00479dd0
mov esi, eax
test esi, esi
js 0x47ade0
cmp word [edi], 0x7b
jne 0x47abf6
push edi
call fcn.004d4367
add esp, 4
cmp eax, 1
jne 0x47abf6
push dword [ebp - 0x221c]
mov eax, dword [ebp - 0x2230]
mov ecx, dword [ebp - 0x2224]
push 0
push eax
push edi
call fcn.0047a3e0
mov esi, eax
test esi, esi
jns 0x47abe0
cmp dword [ebp - 0x221c], 0
je 0x47ade0
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.004796f0
mov esi, eax
test esi, esi
js 0x47ade0
cmp ebx, 2
je 0x47ada2
test ebx, ebx
je 0x47ac14
cmp dword [ebp + 0x14], 0
jne 0x47ada2
mov ecx, ebx
jmp 0x47add9
cmp dword [ebp + 0x14], 0
mov ebx, dword [ebp - 0x2230]
je 0x47ac90
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x47ac90
cmp dword [ebp - 0x221c], eax
jbe 0x47ac90
lea eax, [ebp - 0x218]
push eax
call fcn.00479d90
test eax, eax
je 0x47ada2
cmp dword [ebp - 0x2234], 0
je 0x47ada2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2230]
call fcn.00478e50
jmp 0x47ada2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x47accc
mov dword [ebp - 0x2238], 0
jmp 0x47acde
xor eax, eax
cmp eax, dword [ebp - 0x221c]
sbb eax, eax
neg eax
mov dword [ebp - 0x2238], eax
xor eax, eax
test ebx, ebx
je 0x47acf5
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2230], 0
mov dword [ebp - 0x222c], 0
test eax, eax
jne 0x47add7
cmp dword [ebp - 0x2234], eax
je 0x47ada2
cmp dword [ebp - 0x2238], eax
jne 0x47ada2
mov byte [ebp - 4], 7
cmp byte [0x68023c], al
jne 0x47ad66
push 0x5e22bc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x47ad57
push 0x5e4f40
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov byte [0x68023c], 1
mov dword [0x680240], ebx
jmp 0x47ad6c
mov ebx, dword [0x680240]
mov byte [0x68023c], 1
jmp 0x47ad6c
mov ebx, dword [0x680240]
lea eax, [ebp - 0x218]
test ebx, ebx
je 0x47ad8d
push 0
push 0
push eax
push dword [ebp - 0x2220]
mov ecx, ebx
call dword [0x5c3794]
call ebx
jmp 0x47ad9a
push eax
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov byte [ebp - 4], 0
test eax, eax
jne 0x47add7
cmp word [edi], 0x7d
je 0x47ade0
mov ebx, dword [ebp - 0x2230]
jmp 0x47a460
mov ecx, eax
call fcn.00478aa0
mov esi, eax
test ebx, ebx
je 0x47ade0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47ade0
mov esi, 0x80020009
jmp 0x47ade6
mov esi, 0x80020009
jmp 0x47ade0
mov ecx, eax
call fcn.00478aa0
mov esi, eax
mov ebx, dword [ebp - 0x2230]
test ebx, ebx
je 0x47adf1
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret 0x10