Function at 0x489c0a
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x24
mov eax, 0x4f494f
call fcn.004d2fb0
mov eax, dword [ebp + 8]
xor edx, edx
inc edx
mov dword [ebp - 0x20], edx
cmp eax, edx
jne 0x48a005
cmp dword [ebp + 0x10], 3
jb 0x48a4e3
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
je 0x48a4e3
mov esi, dword [edi]
push str.HKCU
push esi
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
je 0x489c5b
call fcn.0048b325
mov dword [ebp + 8], eax
jmp 0x489c62
mov dword [ebp + 8], SysStringLen
cmp dword [ebp + 8], ebx
je 0x48a4e3
push 4
mov dword [ebp - 4], ebx
pop esi
mov dword [ebp - 0x1c], 0x20019
cmp dword [ebp + 0x10], esi
jb 0x489c97
push str.64key
push dword [edi + 0xc]
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
jne 0x489c97
mov dword [ebp - 0x1c], 0x20119
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
push ebx
push dword [edi + 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48a4e3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push ebx
push dword [eax + 8]
mov dword [ebp + 8], esi
push dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0x10], esi
call edi
cmp eax, ebx
jne 0x489e20
cmp dword [ebp + 8], esi
jne 0x489d15
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x489ea6
push ebx
push dword [ebp - 0x18]
call fcn.00431050
jmp 0x489ea8
cmp dword [ebp + 8], 1
jne 0x489d70
push 0x54cfe0
push 0x10
cmp dword [ebp - 0x18], ebx
je 0x489d53
call fcn.004cba2a
pop ecx
mov esi, eax
pop ecx
mov dword [ebp + 0xc], esi
mov byte [ebp - 4], 2
cmp esi, ebx
je 0x489d4b
mov dword [esi], ebx
lea ebx, [ebp - 0x18]
mov eax, esi
call fcn.0040c040
xor ebx, ebx
jmp 0x489d4d
xor esi, esi
push esi
jmp 0x489ea9
call fcn.004cba2a
pop ecx
mov esi, eax
pop ecx
mov dword [ebp + 0xc], esi
mov byte [ebp - 4], 3
cmp esi, ebx
je 0x489d4b
mov dword [esi], ebx
mov ebx, 0x514d70
jmp 0x489d40
cmp dword [ebp + 8], 3
jne 0x489ff7
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
cmp eax, ebx
je 0x489d9f
mov dword [eax], vtable.varstream.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov esi, eax
jmp 0x489da1
xor esi, esi
mov edi, esi
mov dword [ebp + 0xc], edi
mov byte [ebp - 4], 4
cmp esi, ebx
je 0x489e0c
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jbe 0x489dbc
mov ecx, esi
call fcn.0047a801
mov ecx, dword [esi + 8]
cmp ecx, ebx
jbe 0x489e0c
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x489e0c
push dword [ebp + 0x10]
lea edx, [ebp - 0x18]
push edx
push ecx
push eax
call fcn.004cb558
mov eax, dword [ebp + 0x10]
push 0x54cfe0
push 0x10
mov dword [esi + 0xc], eax
call fcn.004cba2a
add esp, 0x18
cmp eax, ebx
je 0x489e01
xor edi, edi
mov dword [ebp + 0xc], edi
mov dword [eax + 8], esi
mov dword [eax], 6
jmp 0x489e03
xor eax, eax
mov ecx, dword [ebp + 0x14]
push eax
call fcn.0040ed50
mov byte [ebp - 4], bl
cmp edi, ebx
je 0x489ff7
mov eax, dword [edi]
mov ecx, edi
jmp 0x489f69
cmp eax, 0xea
jne 0x489ff7
mov ecx, dword [ebp + 8]
cmp ecx, 1
je 0x489f73
cmp ecx, 2
je 0x489f73
cmp ecx, 7
je 0x489f73
push 0xb
pop eax
cmp ecx, eax
jne 0x489eb9
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp + 0xc]
push ebx
push dword [eax + 8]
mov dword [ebp - 0x30], ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 8
call edi
cmp eax, ebx
jne 0x489ff7
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 5
cmp eax, ebx
je 0x489ea6
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.00431080
jmp 0x489ea8
xor eax, eax
push eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 0x14]
call fcn.0040ed50
jmp 0x489ff7
cmp ecx, 3
jne 0x489ff7
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
cmp eax, ebx
je 0x489ee7
mov dword [eax], vtable.varstream.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov esi, eax
jmp 0x489ee9
xor esi, esi
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 6
cmp esi, ebx
je 0x489f58
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jbe 0x489f02
mov ecx, esi
call fcn.0047a801
cmp dword [esi + 8], ebx
jbe 0x489f58
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x489f58
lea ecx, [ebp + 0x10]
push ecx
push eax
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push ebx
push dword [eax + 8]
push dword [ebp - 0x14]
call edi
cmp eax, ebx
jne 0x489f58
mov eax, dword [ebp + 0x10]
push 0x54cfe0
push 0x10
mov dword [esi + 0xc], eax
call fcn.004cba2a
pop ecx
pop ecx
cmp eax, ebx
je 0x489f4d
mov dword [ebp - 0x1c], ebx
mov dword [eax + 8], esi
mov dword [eax], 6
jmp 0x489f4f
xor eax, eax
mov ecx, dword [ebp + 0x14]
push eax
call fcn.0040ed50
mov byte [ebp - 4], bl
cmp dword [ebp - 0x1c], ebx
je 0x489ff7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
push 1
call dword [eax + 8]
jmp 0x489ff7
mov eax, dword [ebp + 0x10]
inc eax
push 0x54cfe0
push eax
call fcn.004cc21d
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x489ff7
mov eax, dword [ebp + 0x10]
inc eax
push eax
push ebx
push esi
call fcn.004d7710
add esp, 0xc
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push ebx
push dword [eax + 8]
push dword [ebp - 0x14]
call edi
cmp eax, ebx
jne 0x489ff0
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
cmp eax, ebx
je 0x489fc8
mov dword [eax], ebx
jmp 0x489fca
xor eax, eax
mov edi, dword [ebp + 0x14]
push eax
mov ecx, edi
call fcn.0040ed50
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x489ff7
mov edi, esi
call fcn.00479959
jmp 0x489ff7
push esi
call fcn.004cc1ec
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48a4e3
cmp eax, 2
jne 0x48a0f7
cmp dword [ebp + 0x10], 4
jb 0x48a0ec
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x48a0ec
mov esi, dword [edi]
push str.HKCU
push esi
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
je 0x48a03f
call fcn.0048b325
mov ebx, eax
jmp 0x48a044
mov ebx, SysReAllocString
test ebx, ebx
je 0x48a0ec
mov dword [ebp - 4], 8
cmp dword [ebp + 0x10], 5
mov esi, 0x20006
jb 0x48a076
push str.64key
push dword [edi + 0x10]
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
jne 0x48a076
mov esi, 0x20106
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push eax
push esi
push 0
push dword [edi + 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48a0ec
mov esi, dword [edi + 0xc]
call fcn.004312d0
push 0x54cfe0
push 0x10
mov dword [ebp + 8], eax
call fcn.004cba2a
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
xor eax, eax
mov byte [ebp - 4], 9
cmp dword [ebp + 0xc], eax
je 0x48a0d6
push 4
lea ecx, [ebp + 8]
push ecx
push 4
push eax
push dword [edi + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cdq
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.00431050
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 0x14]
push eax
call fcn.0040ed50
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48a4e3
cmp eax, 3
jne 0x48a1ee
cmp dword [ebp + 0x10], 4
jb 0x48a1e3
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x48a1e3
mov esi, dword [ebx]
push str.HKCU
push esi
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
je 0x48a131
call fcn.0048b325
mov edi, eax
jmp 0x48a136
mov edi, SysReAllocString
test edi, edi
je 0x48a1e3
mov dword [ebp - 4], 0xb
cmp dword [ebp + 0x10], 5
mov esi, 0x20006
jb 0x48a168
push str.64key
push dword [ebx + 0x10]
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
jne 0x48a168
mov esi, 0x20106
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push eax
push esi
push 0
push dword [ebx + 4]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48a1e3
mov eax, dword [ebx + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48a187
sub eax, edx
push 0x54cfe0
push 0x10
lea esi, [eax + 1]
call fcn.004cba2a
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
xor eax, eax
mov byte [ebp - 4], 0xc
cmp dword [ebp + 0xc], eax
je 0x48a1cd
push esi
push dword [ebx + 0xc]
push 1
push eax
push dword [ebx + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cdq
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.00431050
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp + 0x14]
push eax
call fcn.0040ed50
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48a4e3
cmp eax, 4
jne 0x48a2cd
cmp dword [ebp + 0x10], 3
jb 0x48a2c2
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x48a2c2
mov esi, dword [edi]
push str.HKCU
push esi
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
je 0x48a228
call fcn.0048b325
mov ebx, eax
jmp 0x48a22d
mov ebx, SysReAllocString
test ebx, ebx
je 0x48a2c2
mov dword [ebp - 4], 0xe
cmp dword [ebp + 0x10], 4
mov esi, 0xf003f
jb 0x48a25f
push str.64key
push dword [edi + 0xc]
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
jne 0x48a25f
mov esi, 0xf013f
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push eax
push esi
push 0
push dword [edi + 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48a2c2
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x48a2aa
push dword [edi + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cdq
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.00431050
jmp 0x48a2ac
xor eax, eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp + 0x14]
push eax
call fcn.0040ed50
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48a4e3
cmp eax, 5
jne 0x48a3ac
cmp dword [ebp + 0x10], 3
jb 0x48a3a1
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x48a3a1
mov esi, dword [edi]
push str.HKCU
push esi
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
je 0x48a307
call fcn.0048b325
mov ebx, eax
jmp 0x48a30c
mov ebx, SysReAllocString
test ebx, ebx
je 0x48a3a1
mov dword [ebp - 4], 0x11
cmp dword [ebp + 0x10], 4
mov esi, 0x20006
jb 0x48a33e
push str.64key
push dword [edi + 0xc]
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
jne 0x48a33e
mov esi, 0x20106
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push eax
push esi
push 0
push dword [edi + 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48a3a1
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x48a389
push dword [edi + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cdq
push edx
push eax
mov eax, dword [ebp + 0xc]
call fcn.00431050
jmp 0x48a38b
xor eax, eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp + 0x14]
push eax
call fcn.0040ed50
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48a4e3
cmp eax, 6
jne 0x48a4d1
xor ebx, ebx
cmp dword [ebp + 0x10], 2
jb 0x48a491
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x48a491
mov esi, dword [edi]
push str.HKCU
push esi
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
je 0x48a3e9
call fcn.0048b325
mov dword [ebp + 0xc], eax
jmp 0x48a3f0
mov dword [ebp + 0xc], SysStringLen
cmp dword [ebp + 0xc], ebx
je 0x48a491
mov dword [ebp - 4], 0x14
cmp dword [ebp + 0x10], 3
mov esi, 0xf003f
jb 0x48a423
push str.64key
push dword [edi + 8]
call fcn.004cd988
pop ecx
pop ecx
test eax, eax
jne 0x48a423
mov esi, 0xf013f
push 0x54cfe0
push 0x10
mov dword [ebp - 0x1c], ebx
call fcn.004cba2a
pop ecx
pop ecx
mov dword [ebp + 0x10], eax
mov byte [ebp - 4], 0x15
cmp eax, ebx
je 0x48a462
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [edi + 4]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cdq
push edx
push eax
mov eax, dword [ebp + 0x10]
call fcn.00431050
jmp 0x48a464
xor eax, eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp + 0x14]
push eax
call fcn.0040ed50
cmp dword [ebp - 0x1c], ebx
je 0x48a47f
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
jmp 0x48a491
mov esi, dword [ebp + 0x14]
cmp dword [esi + 4], ebx
jne 0x48a4e3
push 0x54cfe0
push 0x10
call fcn.004cba2a
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp + 0x14], ecx
mov dword [ebp - 4], 0x17
cmp ecx, ebx
je 0x48a4c1
push 3
pop eax
call fcn.0040c000
jmp 0x48a4c3
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.0040ed50
jmp 0x48a4e3
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.00466419
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
call fcn.004d3057
ret 0x10