Function at 0x4485f0
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.user32.dll_GetDlgItem]
push ebp
push esi
push edi
push 0
push 0
push 0xf0
push 0x2931
push dword [0x4def88]
call ebx
mov ebp, dword [sym.imp.user32.dll_SendMessageW]
push eax
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44865d
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push 0x4b2648
push 0x80000002
call edi
test eax, eax
jne 0x4486c1
push 0x4b3ad8
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x14]
jmp 0x4486bf
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push 0x4b2648
push 0x80000002
call edi
test eax, eax
jne 0x4486c1
push eax
push eax
push 0x147
push 0x293d
push dword [0x4def88]
call ebx
push eax
call ebp
mov dword [esp + 0x18], eax
cmp eax, 2
jne 0x4486a1
mov dword [esp + 0x18], 3
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push 0x4b3ad8
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
push 0
push 0xf0
push 0x2932
push dword [0x4def88]
call ebx
push eax
call ebp
test eax, eax
jne 0x44870f
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push 0x4b2648
push 0x80000002
call edi
test eax, eax
jne 0x448766
push 0x4b3af0
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x1c]
jmp 0x448764
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push 0x4b2648
push 0x80000002
call edi
test eax, eax
jne 0x448766
push eax
push eax
push 0x400
push 0x293a
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push 0x4b3af0
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
call esi
push 0
push 0
push 0xf0
push 0x2939
push dword [0x4def88]
call ebx
push eax
call ebp
test eax, eax
jne 0x4487b4
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push 0x4b3b08
push 0x80000001
call edi
test eax, eax
jne 0x44880b
push 0x4b3b80
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x1c]
jmp 0x448809
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push 0x4b3b08
push 0x80000001
call edi
test eax, eax
jne 0x44880b
push eax
push eax
push 0x400
push 0x293b
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push 0x4b3b80
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
call esi
push 0
push 0
push 0xf0
push 0x2939
push dword [0x4def88]
call ebx
push eax
call ebp
test eax, eax
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push 0
push 0x4b3b08
push 0x80000001
jne 0x448855
call edi
test eax, eax
jne 0x448896
push 0x4b3bb8
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x448890
call edi
test eax, eax
jne 0x448896
push eax
push eax
push 0x400
push 0x293c
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push 0x4b3bb8
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b2648
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4488f9
push eax
push eax
push 0xf0
push 0x2937
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push 0x4b3be8
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push 0x4b2648
push 0x80000002
call edi
test eax, eax
jne 0x44895c
push eax
push eax
push 0xf0
push 0x2938
push dword [0x4def88]
call ebx
push eax
call ebp
mov dword [esp + 0x1c], eax
test eax, eax
je 0x44893c
mov dword [esp + 0x1c], 2
push 4
lea eax, [esp + 0x20]
push eax
push 4
push 0
push 0x4b3bfc
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b3c40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4489bf
push eax
push eax
push 0xf0
push 0x2933
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push 0x4b3c20
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b3cc8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x448a22
push eax
push eax
push 0xf0
push 0x2934
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push 0x4b3ca8
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x4b2648
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x448a85
push eax
push eax
push 0xf0
push 0x2935
push dword [0x4def88]
call ebx
push eax
call ebp
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push 0x4b2620
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x1c]
call esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push 0x4b3d0c
push 0x80000002
call edi
test eax, eax
jne 0x448af9
push eax
push eax
push 0xf0
push 0x2936
push dword [0x4def88]
call ebx
push eax
call ebp
test eax, eax
je 0x448ae4
push 4
push 0x4b3e68
push 1
push 0
push 0x4b3d3c
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push 0x4b3d3c
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret