Function at 0x10004959
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10010410]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push edi
mov eax, 0x10001600
cmp byte [ebp + 8], bl
jne 0x10004981
mov eax, 0x100015f8
push eax
push 0x100015d4
call fcn.100043d5
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
mov edi, 0xf003f
push edi
push ebx
push 0x100015c8
push SysReAllocString
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100049be
xor eax, eax
inc eax
jmp 0x10004c0e
push esi
push dword [ebp - 0x218]
push 0x100015c0
push 0x100015a0
call fcn.100043d5
add esp, 0xc
push ebx
lea eax, [ebp - 0x210]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
mov esi, 0x10001550
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x210], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10004b61
push esi
push 0x10001538
call fcn.100043d5
pop ecx
pop ecx
cmp byte [ebp + 8], bl
je 0x10004a75
push 0x10001520
call fcn.100043d5
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [esp], 0x10001500
push dword [ebp - 0x210]
call edi
test eax, eax
jne 0x10004b4d
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push dword [ebp - 0x218]
mov dword [ebp - 0x210], ebx
call edi
test eax, eax
jne 0x10004b4d
mov dword [ebp - 0x214], ebx
jmp 0x10004b4d
push 0x100014ec
call fcn.100043d5
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ecx
push 0x34
push 0x100014b8
push 1
push ebx
push 0x100014b4
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x10004b4d
push ebx
lea eax, [ebp - 0x21c]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push 0x10001500
push dword [ebp - 0x210]
mov dword [ebp - 0x21c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10004b41
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0x1001214c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jbe 0x10004b41
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10004af2
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x100014b4
push dword [ebp - 0x21c]
call esi
test eax, eax
jne 0x10004b41
push 0xa
push 0x100014a8
push 1
push ebx
push 0x10001488
push dword [ebp - 0x21c]
call esi
test eax, eax
jne 0x10004b41
mov dword [ebp - 0x214], ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x210], ebx
je 0x10004b61
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10001478
call fcn.100043d5
pop ecx
cmp dword [ebp - 0x214], ebx
jne 0x10004bfc
push 0x10001460
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x10004bf5
cmp byte [ebp + 8], bl
jne 0x10004bc1
push 0x10001448
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10004bba
push ebx
push ebx
push 2
push 0x100014b8
push ebx
push 0x10001394
push ebx
call eax
jmp 0x10004bd9
push 0x10001424
jmp 0x10004be6
push 0x10001414
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10004be1
push ebx
push 0x10001394
call eax
mov dword [ebp - 0x214], eax
jmp 0x10004bec
push 0x100013f8
call fcn.100043d5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10004c07
push 0x100013e4
jmp 0x10004c01
push 0x100013d8
call fcn.100043d5
pop ecx
mov eax, dword [ebp - 0x214]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1000d555
leave
ret 4