Function at 0x4ffe40
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
lea eax, [ebp - 4]
push eax
call fcn.005bd6c0
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
push str.AppGroupsVersion
push edx
mov dword [ebp - 0xc], 0
call fcn.005bd460
add esp, 0x10
cmp dword [ebp - 0xc], 5
jb 0x4ffe82
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push esi
push edi
push 5
push str.AppGroupsVersion
push ecx
call fcn.005bd4b0
mov edx, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0xc
push str.AppGroups
push edx
call esi
mov eax, dword [ebp - 4]
push str.AppGroupsOptions
push eax
call esi
mov edx, dword [ebp - 4]
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.AppGroups
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, 0x44
mov esi, str.svchost.exe
lea edi, [ebp - 0x304]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0x4e
mov esi, str.CoolGame.exe
lea edi, [ebp - 0x660]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0x1f
mov esi, str.thunderbird.exe
lea edi, [ebp - 0x1f0]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0x48
mov esi, str.winword.exe
lea edi, [ebp - 0x524]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x3f
mov esi, str.YahooMessenger.exe
lea edi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x80
lea eax, [ebp - 0x10c]
push eax
mov ecx, 0x19
mov esi, str.opera.exe
lea edi, [ebp - 0x170]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x716738]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0xdc
push ecx
call esi
mov ecx, dword [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x112
lea edx, [ebp - 0x304]
push edx
push 7
push 0
lea eax, [ebp - 0x10c]
push eax
push ecx
call edi
mov eax, dword [0x716738]
push 0x80
lea edx, [ebp - 0x10c]
push edx
push 0xe0
push eax
call esi
mov eax, dword [ebp - 8]
push 0x13a
lea ecx, [ebp - 0x660]
push ecx
push 7
push 0
lea edx, [ebp - 0x10c]
push edx
push eax
call edi
mov edx, dword [0x716738]
push 0x80
lea ecx, [ebp - 0x10c]
push ecx
push 0xdf
push edx
call esi
mov edx, dword [ebp - 8]
push 0x7e
lea eax, [ebp - 0x1f0]
push eax
push 7
push 0
lea ecx, [ebp - 0x10c]
push ecx
push edx
call edi
mov ecx, dword [0x716738]
push 0x80
lea eax, [ebp - 0x10c]
push eax
push 0xde
push ecx
call esi
mov ecx, dword [ebp - 8]
push 0xfe
lea edx, [ebp - 0x404]
push edx
push 7
push 0
lea eax, [ebp - 0x10c]
push eax
push ecx
call edi
mov eax, dword [0x716738]
push 0x80
lea edx, [ebp - 0x10c]
push edx
push 0xdd
push eax
call esi
mov eax, dword [ebp - 8]
push 0x120
lea ecx, [ebp - 0x524]
push ecx
push 7
push 0
lea edx, [ebp - 0x10c]
push edx
push eax
call edi
mov edx, dword [0x716738]
push 0x80
lea ecx, [ebp - 0x10c]
push ecx
push 0x2eae
push edx
call esi
mov edx, dword [ebp - 8]
push 0x64
lea eax, [ebp - 0x170]
push eax
push 7
push 0
lea ecx, [ebp - 0x10c]
push ecx
push edx
call edi
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [ebp - 8]
push ecx
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret