Function at 0x487540
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0046d4f0
test eax, eax
je 0x4875d4
push 0
push str.CSetupApp::SetupForReboot_n
push 0x6af7d0
call fcn.00599ee3
mov eax, dword [str.ENTRY:]
mov ecx, dword [0x5ccf7c]
mov dword [0x6af6d0], eax
mov eax, 0x6af7d0
add esp, 0xc
mov dword [0x6af6d4], ecx
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x487592
mov edi, 0x6af6d0
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4875a1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d500
push 0x6af6d0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
mov ecx, dword [ebx + 0xb694]
and ecx, 0x80
xor eax, eax
or eax, ecx
je 0x4875ed
mov ecx, ebx
call fcn.004873e0
cmp dword [ebx + 0xb788], 0
jne 0x48761a
test byte [ebx + 0xb68c], 4
je 0x4876fc
mov eax, dword [ebx + 0xb694]
not eax
and eax, 0x100
xor ecx, ecx
or ecx, eax
je 0x4876fc
mov dword [ebp - 0x208], 0x104
mov esi, 0x20019
xor edi, edi
call fcn.0049cb90
test eax, eax
je 0x48763e
mov esi, 0x20119
mov edi, 1
lea edx, [ebp - 0x204]
push edx
push esi
push 0
push str.SOFTWARECNXT_UIU_MUTEX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4876fc
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
push str.REBOOT
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4876fc
mov eax, dword [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebx + 0xb690], 0x200000
mov ecx, dword [ebx + 0xb694]
mov dword [ebx + 0xb694], ecx
test edi, edi
je 0x4876ec
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4876fc
push str.RegDeleteKeyExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4876e3
push 0
push 0x100
push str.SOFTWARECNXT_UIU_MUTEX
push reloc.OLEAUT32.dll_SysReAllocString
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4876fc
push str.SOFTWARECNXT_UIU_MUTEX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, dword [ebx + 0xb690]
mov ecx, dword [ebx + 0xb694]
mov eax, esi
and eax, 0x200000
xor edx, edx
or eax, edx
je 0x48782c
mov edx, ecx
and edx, 0x100
xor eax, eax
or eax, edx
je 0x487780
push 0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x200]
call fcn.0047aa50
lea esi, [ebx + 0xaa18]
push esi
lea ecx, [ebp - 0x200]
call fcn.0047acd0
push 1
push 1
push 0x5cef48
push str.Reboot
push esi
lea ecx, [ebp - 0x200]
call fcn.0047b260
mov edx, dword [ebx + 0xb694]
and dword [ebx + 0xb690], 0xffdfffff
mov dword [ebx + 0xb694], edx
jmp 0x48782c
mov edx, dword [ebx + 0xb68c]
test edx, 0x40000000
je 0x4877a5
and esi, 0xffdfffff
mov dword [ebx + 0xb690], esi
mov dword [ebx + 0xb694], ecx
jmp 0x48782c
mov esi, ecx
and esi, 0x1000
xor eax, eax
or eax, esi
jne 0x487809
test dl, 4
jne 0x487809
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x200]
call fcn.0047aa50
call fcn.0049cb90
test eax, eax
je 0x4877d9
mov dword [ebp - 8], 0x100
push str.SOFTWARECNXT_UIU_MUTEX
lea ecx, [ebp - 0x200]
call fcn.0047acd0
push 1
push 1
push 0x5cef48
push str.REBOOT
push str.SOFTWARECNXT_UIU_MUTEX
lea ecx, [ebp - 0x200]
call fcn.0047b260
jmp 0x48782c
mov eax, edx
not eax
test eax, eax
js 0x487822
and ecx, 0x2000
xor eax, eax
or eax, ecx
jne 0x487822
test dl, 4
je 0x48782c
mov dword [ebx + 0xb790], 1
call fcn.0046d4f0
test eax, eax
je 0x4878b3
push 0
push str.CSetupApp::SetupForReboot_n
push 0x6af5d0
call fcn.00599ee3
mov ecx, dword [str.EXIT:]
mov edx, dword [0x5ccefc]
mov eax, 0x6af5d0
mov dword [0x6af4d0], ecx
add esp, 0xc
mov dword [0x6af4d4], edx
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x487868
mov edi, 0x6af4d0
sub eax, ecx
mov esi, ecx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x487880
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x6af4d0
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d510
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599ed4
mov esp, ebp
pop ebp
ret