Function at 0x47cb3e
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0x47c085
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x74], ecx
mov byte [ebp - 1], dl
mov dword [ebp - 8], eax
mov ecx, 0xa
lea eax, [ebp - 0x48]
mov edx, dword [0x40107c]
call fcn.00404378
xor eax, eax
push ebp
push 0x47cd44
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x47cd60
call fcn.00478ff0
lea eax, [ebp - 0xa0]
call fcn.0044e86c
mov eax, dword [ebp - 0xa0]
call fcn.0040a2d8
mov byte [ebp - 0x75], 1
mov eax, dword [ebp - 8]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x76], 0
xor eax, eax
mov dword [ebp - 0x7c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dl, 1
mov eax, dword [0x474f94]
call fcn.00402e18
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x47ccd4
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x474f94]
call fcn.00402e18
mov dword [ebp - 0x7c], eax
mov dl, 1
mov eax, dword [0x474f94]
call fcn.00402e18
mov dword [ebp - 0x1c], eax
mov dl, 1
mov eax, dword [0x474f94]
call fcn.00402e18
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, dword [0x474f94]
call fcn.00402e18
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x474f94]
call fcn.00402e18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x74], 0
je 0x47c186
mov dl, 1
mov eax, dword [0x474f94]
call fcn.00402e18
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x80], eax
mov ecx, eax
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 1], 0
je 0x47c49b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x47c49b
mov eax, dword [ebp - 0x84]
cmp word [eax + 0x10], 0x80
jne 0x47c480
xor edx, edx
push ebp
push 0x47c430
push dword fs:[edx]
mov dword fs:[edx], esp
push ebp
mov eax, dword [ebp - 0x84]
call fcn.0047c028
pop ecx
cmp dword [ebp - 0x3c], 0
je 0x47c204
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7c]
call fcn.00477ce0
inc eax
jne 0x47c3f1
mov bl, 1
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 1
je 0x47c217
xor ebx, ebx
jmp 0x47c21d
test al, 2
je 0x47c21d
mov bl, 2
mov esi, 1
test al, 8
je 0x47c22d
mov esi, 7
jmp 0x47c23e
test al, 0x10
je 0x47c238
mov esi, 3
jmp 0x47c23e
test al, 0x40
je 0x47c23e
xor esi, esi
test al, 4
jne 0x47c31d
lea eax, [ebp - 0xa4]
mov ecx, dword [ebp - 0x48]
mov edx, 0x47cd90
call fcn.00403d84
mov eax, dword [ebp - 0xa4]
call fcn.00478ff0
cmp dword [ebp - 0x44], 0
je 0x47c288
lea eax, [ebp - 0xa8]
mov ecx, dword [ebp - 0x44]
mov edx, 0x47cdb0
call fcn.00403d84
mov eax, dword [ebp - 0xa8]
call fcn.00478ff0
mov eax, dword [ebp - 0x84]
mov edi, dword [eax + 8]
test edi, 0x20
je 0x47c2ae
test edi, 0x100
setne al
mov edx, dword [ebp - 0x48]
call fcn.004749f0
test al, al
je 0x47c30e
mov eax, dword [ebp - 0x40]
push eax
push ebx
push esi
push 0x47b5f0
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
call fcn.00476bfc
test al, al
jne 0x47c3de
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0
lea edx, [ebp - 0xb0]
xor ecx, ecx
mov eax, 0x47cdd4
call fcn.004791f0
mov byte [ebp - 0x75], 0
jmp 0x47c3de
mov eax, 0x47cdf8
call fcn.00478ff0
jmp 0x47c3de
lea eax, [ebp - 0xb4]
mov ecx, dword [ebp - 0x48]
mov edx, 0x47ce20
call fcn.00403d84
mov eax, dword [ebp - 0xb4]
call fcn.00478ff0
cmp dword [ebp - 0x44], 0
je 0x47c35f
lea eax, [ebp - 0xb8]
mov ecx, dword [ebp - 0x44]
mov edx, 0x47ce48
call fcn.00403d84
mov eax, dword [ebp - 0xb8]
call fcn.00478ff0
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 0x20
je 0x47c377
mov eax, dword [ebp - 0x48]
call fcn.0044d9a0
test al, al
je 0x47c3d4
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 0x80
jne 0x47c385
xor ebx, ebx
mov eax, dword [ebp - 0x40]
push eax
push ebx
push esi
push 0x47b5f0
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
call fcn.00476e88
test al, al
jne 0x47c3de
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0
lea edx, [ebp - 0xb0]
xor ecx, ecx
mov eax, 0x47ce70
call fcn.004791f0
mov byte [ebp - 0x75], 0
jmp 0x47c3de
mov eax, 0x47ce94
call fcn.00478ff0
cmp dword [ebp - 0x3c], 0
je 0x47c426
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7c]
call fcn.00477bec
jmp 0x47c426
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc8], eax
mov byte [ebp - 0xc4], 0xb
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc0], eax
mov byte [ebp - 0xbc], 0xb
lea edx, [ebp - 0xc8]
mov ecx, 1
mov eax, 0x47cec4
call fcn.004791f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c459
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.0047b4bc
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x47c48e
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x47c1bf
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x47c6a6
mov byte [ebp - 0x85], 0
mov eax, dword [ebp - 0x84]
cmp word [eax + 0x10], 0x82
jne 0x47c65b
mov byte [ebp - 0x85], 1
xor edx, edx
push ebp
push 0x47c632
push dword fs:[edx]
mov dword fs:[edx], esp
push ebp
mov eax, dword [ebp - 0x84]
call fcn.0047c028
pop ecx
cmp byte [ebp - 1], 0
jne 0x47c505
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne 0x47c621
cmp byte [ebp - 1], 0
jne 0x47c511
cmp dword [ebp - 0x44], 0
jne 0x47c515
xor eax, eax
jmp 0x47c517
mov al, 1
mov byte [ebp - 0x86], al
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 8
setne bl
test bl, bl
je 0x47c545
test ah, 4
setne dl
mov eax, dword [ebp - 0x48]
call fcn.0047bb6c
mov byte [ebp - 0x87], al
jmp 0x47c54c
mov byte [ebp - 0x87], 0
test bl, bl
je 0x47c59e
cmp byte [ebp - 0x87], 0
je 0x47c628
cmp byte [ebp - 0x86], 0
jne 0x47c59e
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.004749f0
test al, al
je 0x47c59e
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 2
jne 0x47c59e
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x47c628
mov byte [ebp - 0x85], 0
cmp byte [ebp - 0x86], 0
jne 0x47c5e6
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 0x10
je 0x47c5cb
push ebp
test ah, 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.0047bc28
pop ecx
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 0x40
je 0x47c5e6
test ah, 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.0047be0c
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 4
je 0x47c628
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0xb
lea edx, [ebp - 0xb0]
xor ecx, ecx
mov eax, 0x47cef4
call fcn.004791f0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
call fcn.00477940
jmp 0x47c628
mov byte [ebp - 0x85], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c65b
cmp byte [ebp - 0x85], 0
je 0x47c68b
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.0047b4bc
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x47c699
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x47c4b4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x47cbfc
push ebp
mov eax, dword [ebp - 0x84]
call fcn.0047c028
pop ecx
xor edx, edx
push ebp
push 0x47cba1
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x84]
mov bx, word [eax + 0x10]
movzx eax, bx
cmp eax, 0x85
jg 0x47c745
je 0x47c96f
cmp eax, 0x81
jg 0x47c727
je 0x47c7b8
dec eax
je 0x47c776
add eax, 0xfffffff1
sub eax, 2
jb case.0x47c753.140
sub eax, 0xe
je case.0x47c753.140
sub eax, 0x60
je case.0x47c753.140
jmp case.default.0x47c753
sub eax, 0x82
je 0x47c858
dec eax
je case.0x47c753.140
dec eax
je 0x47c95c
jmp case.default.0x47c753
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x47c753
jmp dword [eax*4 + 0x47c75a]
lea eax, [ebp - 0xd0]
mov ecx, dword [ebp - 0x48]
mov edx, 0x47cf14
call fcn.00403d84
mov edx, dword [ebp - 0xd0]
lea ecx, [ebp - 0xcc]
mov al, 0xb6
call fcn.004737e0
mov ecx, dword [ebp - 0xcc]
mov dl, 1
mov eax, dword [0x408920]
call fcn.0040c440
call fcn.00403588
jmp case.0x47c753.140
cmp byte [ebp - 1], 0
jne 0x47c7ce
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne case.0x47c753.140
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 4
setne al
push eax
test bl, 8
setne al
push eax
push 0x47b534
push 0x47b540
lea eax, [ebp - 0x20]
push eax
test bl, 2
setne cl
test bl, 0x20
setne al
mov edx, dword [ebp - 0x48]
call fcn.00475c84
test al, al
je case.0x47c753.140
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 2
je case.0x47c753.140
test al, 0x10
je case.0x47c753.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 1
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xd4]
mov eax, dword [ebp - 0x48]
call fcn.0044c468
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x14]
call fcn.00477c40
jmp case.0x47c753.140
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 0x44]
call fcn.00403b50
cmp byte [ebp - 1], 0
jne 0x47c875
cmp dword [ebp - 0x8c], 0
jne 0x47c883
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 0x48]
call fcn.00403b50
cmp byte [ebp - 1], 0
jne 0x47c895
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne 0x47c8ec
cmp byte [ebp - 1], 0
jne 0x47c8ab
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 2
jne case.0x47c753.140
push ebp
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 0x80
setne al
push eax
test bh, 1
setne al
push eax
test bl, 0x20
setne cl
test bh, 8
setne dl
mov eax, dword [ebp - 0x8c]
call fcn.0047b754
pop ecx
test al, al
jne case.0x47c753.140
mov byte [ebp - 0x75], 0
jmp case.0x47c753.140
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 8
je 0x47c907
test ah, 4
setne dl
mov eax, dword [ebp - 0x48]
call fcn.0047bb6c
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x48]
call fcn.00403e48
je case.0x47c753.140
push ebp
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 0x80
setne al
push eax
test bh, 1
setne al
push eax
test bl, 0x20
setne cl
test bh, 8
setne dl
mov eax, dword [ebp - 0x8c]
call fcn.0047b754
pop ecx
test al, al
jne case.0x47c753.140
mov byte [ebp - 0x75], 0
jmp case.0x47c753.140
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
call fcn.0044e134
jmp case.0x47c753.140
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
je 0x47c98e
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
call fcn.0044dfdc
test al, al
je case.0x47c753.140
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
call fcn.0044e180
jmp case.0x47c753.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.0047b214
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0044eda8
test eax, eax
je case.0x47c753.140
sub eax, 2
je case.0x47c753.140
mov byte [ebp - 0x75], 0
jmp case.0x47c753.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.0047b214
push 0
push 2
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0044ed04
test eax, eax
jne case.0x47c753.140
push 1
push 0x4b9094
push 1
push 0
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x47ca4a
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x47c753.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.0047b214
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0044eee0
test eax, eax
je case.0x47c753.140
sub eax, 2
je case.0x47c753.140
sub eax, 0x8f
je case.0x47c753.140
mov byte [ebp - 0x75], 0
jmp case.0x47c753.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.0047b214
push 0
push 3
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0044ed04
test eax, eax
jne case.0x47c753.140
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x9c]
call fcn.0044ec4c
test al, al
je 0x47cb19
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je 0x47cb19
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x47c753.140
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x48]
call fcn.0047bb6c
jmp case.0x47c753.140
mov byte [ebp - 0x76], 1
jmp case.0x47c753.140
lea eax, [ebp - 0xdc]
push eax
movzx eax, bx
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0
lea edx, [ebp - 0xb0]
xor ecx, ecx
mov eax, 0x47cf2c
call fcn.0040aa64
mov edx, dword [ebp - 0xdc]
lea ecx, [ebp - 0xd8]
mov al, 0xb6
call fcn.004737e0
mov ecx, dword [ebp - 0xd8]
mov dl, 1
mov eax, dword [0x408920]
call fcn.0040c440
call fcn.00403588
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47cbca
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.0047b4bc
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x84], 0
jne 0x47c6bf
cmp byte [ebp - 0x76], 0
je 0x47cc12
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 8]
test byte [eax + 0x1d], 0x10
je 0x47cc20
call fcn.00477b24
cmp dword [ebp - 0x74], 0
je 0x47cc30
call dword [ebp - 0x74]
push ebp
call fcn.0047bf94
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ccde
mov eax, dword [ebp - 0x20]
call fcn.00402e48
mov eax, dword [ebp - 0xc]
call fcn.00402e48
mov eax, dword [ebp - 0x10]
call fcn.00402e48
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x47ccb3
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xe0]
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00477cc4
mov eax, dword [ebp - 0xe0]
call fcn.0044d98c
test al, al
je 0x47ccaf
push 0
lea ecx, [ebp - 0xe4]
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00477cc4
mov eax, dword [ebp - 0xe4]
call fcn.00403efc
push eax
push 0x1001
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x47cc63
mov eax, dword [ebp - 0x18]
call fcn.00402e48
mov eax, dword [ebp - 0x1c]
call fcn.00402e48
mov eax, dword [ebp - 0x7c]
call fcn.00402e48
mov eax, dword [ebp - 0x14]
call fcn.00402e48
ret