Function at 0x47dcb1
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0x47d321
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x74], ecx
mov byte [ebp - 1], dl
mov dword [ebp - 8], eax
mov ecx, 0xa
lea eax, [ebp - 0x48]
mov edx, dword [0x40107c]
call fcn.00404378
xor eax, eax
push ebp
push 0x47e057
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x47e070
call fcn.00479788
lea eax, [ebp - 0xa0]
call fcn.0044d418
mov eax, dword [ebp - 0xa0]
call fcn.0040a28c
mov byte [ebp - 0x75], 1
mov eax, dword [ebp - 8]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x76], 0
xor eax, eax
mov dword [ebp - 0x7c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dl, 1
mov eax, dword [0x4751b0]
call fcn.00402e18
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x47dfe7
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x4751b0]
call fcn.00402e18
mov dword [ebp - 0x7c], eax
mov dl, 1
mov eax, dword [0x4751b0]
call fcn.00402e18
mov dword [ebp - 0x1c], eax
mov dl, 1
mov eax, dword [0x4751b0]
call fcn.00402e18
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, dword [0x4751b0]
call fcn.00402e18
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x4751b0]
call fcn.00402e18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x74], 0
je 0x47d422
mov dl, 1
mov eax, dword [0x4751b0]
call fcn.00402e18
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x80], eax
mov ecx, eax
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 1], 0
je 0x47d79a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x47d79a
mov eax, dword [ebp - 0x84]
cmp word [eax + 0x10], 0x80
jne 0x47d77f
xor edx, edx
push ebp
push 0x47d72f
push dword fs:[edx]
mov dword fs:[edx], esp
push ebp
mov eax, dword [ebp - 0x84]
call fcn.0047d2c4
pop ecx
cmp dword [ebp - 0x3c], 0
je 0x47d4a0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7c]
call fcn.00478084
inc eax
jne 0x47d6f0
mov bl, 1
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 1
je 0x47d4b3
xor ebx, ebx
jmp 0x47d4b9
test al, 2
je 0x47d4b9
mov bl, 2
mov esi, 1
test al, 8
je 0x47d4c9
mov esi, 7
jmp 0x47d4da
test al, 0x10
je 0x47d4d4
mov esi, 3
jmp 0x47d4da
test al, 0x40
je 0x47d4da
xor esi, esi
test al, 4
jne 0x47d5ec
lea eax, [ebp - 0xa4]
mov ecx, dword [ebp - 0x48]
mov edx, 0x47e0a0
call fcn.00403d84
mov eax, dword [ebp - 0xa4]
call fcn.00479788
cmp dword [ebp - 0x44], 0
je 0x47d524
lea eax, [ebp - 0xa8]
mov ecx, dword [ebp - 0x44]
mov edx, 0x47e0c0
call fcn.00403d84
mov eax, dword [ebp - 0xa8]
call fcn.00479788
mov eax, dword [ebp - 0x84]
mov edi, dword [eax + 8]
test edi, 0x20
je 0x47d54e
test edi, 0x100
setne al
mov edx, dword [ebp - 0x48]
call fcn.00474c0c
test al, al
je 0x47d5dd
mov eax, dword [ebp - 0x40]
push eax
push ebx
push esi
push 0x47c6dc
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
call fcn.00476d8c
test al, al
jne 0x47d5aa
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0
lea edx, [ebp - 0xb0]
xor ecx, ecx
mov eax, 0x47e0e4
call fcn.004799a8
mov byte [ebp - 0x75], 0
jmp 0x47d6dd
cmp bl, 1
jne 0x47d6dd
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0
lea edx, [ebp - 0xb0]
xor ecx, ecx
mov eax, 0x47e108
call fcn.004799a8
jmp 0x47d6dd
mov eax, 0x47e128
call fcn.00479788
jmp 0x47d6dd
lea eax, [ebp - 0xb4]
mov ecx, dword [ebp - 0x48]
mov edx, 0x47e150
call fcn.00403d84
mov eax, dword [ebp - 0xb4]
call fcn.00479788
cmp dword [ebp - 0x44], 0
je 0x47d62e
lea eax, [ebp - 0xb8]
mov ecx, dword [ebp - 0x44]
mov edx, 0x47e178
call fcn.00403d84
mov eax, dword [ebp - 0xb8]
call fcn.00479788
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 0x20
je 0x47d64a
mov eax, dword [ebp - 0x48]
call fcn.0044c8bc
test al, al
je 0x47d6d3
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 0x80
jne 0x47d658
xor ebx, ebx
mov eax, dword [ebp - 0x40]
push eax
push ebx
push esi
push 0x47c6dc
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
call fcn.00477018
test al, al
jne 0x47d6a7
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0
lea edx, [ebp - 0xb0]
xor ecx, ecx
mov eax, 0x47e1a0
call fcn.004799a8
mov byte [ebp - 0x75], 0
jmp 0x47d6dd
cmp bl, 1
jne 0x47d6dd
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0
lea edx, [ebp - 0xb0]
xor ecx, ecx
mov eax, 0x47e108
call fcn.004799a8
jmp 0x47d6dd
mov eax, 0x47e1c4
call fcn.00479788
cmp dword [ebp - 0x3c], 0
je 0x47d725
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7c]
call fcn.00477f90
jmp 0x47d725
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc8], eax
mov byte [ebp - 0xc4], 0xb
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc0], eax
mov byte [ebp - 0xbc], 0xb
lea edx, [ebp - 0xc8]
mov ecx, 1
mov eax, 0x47e1f4
call fcn.004799a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d758
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.0047c5a8
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x47d78d
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x47d45b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x47d9b9
mov byte [ebp - 0x85], 0
mov eax, dword [ebp - 0x84]
cmp word [eax + 0x10], 0x82
jne 0x47d96e
mov byte [ebp - 0x85], 1
xor edx, edx
push ebp
push 0x47d945
push dword fs:[edx]
mov dword fs:[edx], esp
push ebp
mov eax, dword [ebp - 0x84]
call fcn.0047d2c4
pop ecx
cmp byte [ebp - 1], 0
jne 0x47d804
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne 0x47d934
cmp byte [ebp - 1], 0
jne 0x47d810
cmp dword [ebp - 0x44], 0
jne 0x47d814
xor eax, eax
jmp 0x47d816
mov al, 1
mov byte [ebp - 0x86], al
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 8
setne bl
test bl, bl
je 0x47d844
test ah, 4
setne dl
mov eax, dword [ebp - 0x48]
call fcn.0047ccd8
mov byte [ebp - 0x87], al
jmp 0x47d84b
mov byte [ebp - 0x87], 0
test bl, bl
je 0x47d89d
cmp byte [ebp - 0x87], 0
je 0x47d93b
cmp byte [ebp - 0x86], 0
jne 0x47d89d
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.00474c0c
test al, al
je 0x47d89d
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 2
jne 0x47d89d
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x47d93b
mov byte [ebp - 0x85], 0
cmp byte [ebp - 0x86], 0
jne 0x47d8e5
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 0x10
je 0x47d8ca
push ebp
test ah, 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.0047cd94
pop ecx
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 0x40
je 0x47d8e5
test ah, 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.0047cf78
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 4
je 0x47d91e
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0xb
lea edx, [ebp - 0xb0]
xor ecx, ecx
mov eax, 0x47e224
call fcn.004799a8
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
call fcn.00477b24
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 0x10
je 0x47d93b
mov eax, dword [ebp - 0x38]
call fcn.0047d100
jmp 0x47d93b
mov byte [ebp - 0x85], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d96e
cmp byte [ebp - 0x85], 0
je 0x47d99e
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.0047c5a8
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x47d9ac
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x47d7b3
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x47df0f
push ebp
mov eax, dword [ebp - 0x84]
call fcn.0047d2c4
pop ecx
xor edx, edx
push ebp
push 0x47deb4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x84]
mov bx, word [eax + 0x10]
movzx eax, bx
cmp eax, 0x85
jg 0x47da58
je 0x47dc82
cmp eax, 0x81
jg 0x47da3a
je 0x47dacb
dec eax
je 0x47da89
add eax, 0xfffffff1
sub eax, 2
jb case.0x47da66.140
sub eax, 0xe
je case.0x47da66.140
sub eax, 0x60
je case.0x47da66.140
jmp case.default.0x47da66
sub eax, 0x82
je 0x47db6b
dec eax
je case.0x47da66.140
dec eax
je 0x47dc6f
jmp case.default.0x47da66
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x47da66
jmp dword [eax*4 + 0x47da6d]
lea eax, [ebp - 0xd0]
mov ecx, dword [ebp - 0x48]
mov edx, 0x47e244
call fcn.00403d84
mov edx, dword [ebp - 0xd0]
lea ecx, [ebp - 0xcc]
mov al, 0xb6
call fcn.004731d0
mov ecx, dword [ebp - 0xcc]
mov dl, 1
mov eax, dword [0x408a18]
call fcn.0040c3f4
call fcn.00403588
jmp case.0x47da66.140
cmp byte [ebp - 1], 0
jne 0x47dae1
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne case.0x47da66.140
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 4
setne al
push eax
test bl, 8
setne al
push eax
push 0x47c620
push 0x47c62c
lea eax, [ebp - 0x20]
push eax
test bl, 2
setne cl
test bl, 0x20
setne al
mov edx, dword [ebp - 0x48]
call fcn.00475e94
test al, al
je case.0x47da66.140
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 2
je case.0x47da66.140
test al, 0x10
je case.0x47da66.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 1
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xd4]
mov eax, dword [ebp - 0x48]
call fcn.0044c320
mov edx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x14]
call fcn.00477fe4
jmp case.0x47da66.140
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 0x44]
call fcn.00403b50
cmp byte [ebp - 1], 0
jne 0x47db88
cmp dword [ebp - 0x8c], 0
jne 0x47db96
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 0x48]
call fcn.00403b50
cmp byte [ebp - 1], 0
jne 0x47dba8
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne 0x47dbff
cmp byte [ebp - 1], 0
jne 0x47dbbe
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 2
jne case.0x47da66.140
push ebp
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 0x80
setne al
push eax
test bh, 1
setne al
push eax
test bl, 0x20
setne cl
test bh, 8
setne dl
mov eax, dword [ebp - 0x8c]
call fcn.0047c890
pop ecx
test al, al
jne case.0x47da66.140
mov byte [ebp - 0x75], 0
jmp case.0x47da66.140
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 8
je 0x47dc1a
test ah, 4
setne dl
mov eax, dword [ebp - 0x48]
call fcn.0047ccd8
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x48]
call fcn.00403e48
je case.0x47da66.140
push ebp
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 0x80
setne al
push eax
test bh, 1
setne al
push eax
test bl, 0x20
setne cl
test bh, 8
setne dl
mov eax, dword [ebp - 0x8c]
call fcn.0047c890
pop ecx
test al, al
jne case.0x47da66.140
mov byte [ebp - 0x75], 0
jmp case.0x47da66.140
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
call fcn.0044ccdc
jmp case.0x47da66.140
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
je 0x47dca1
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
call fcn.0044cb84
test al, al
je case.0x47da66.140
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
call fcn.0044cd28
jmp case.0x47da66.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.0047c2e0
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0044d968
test eax, eax
je case.0x47da66.140
sub eax, 2
je case.0x47da66.140
mov byte [ebp - 0x75], 0
jmp case.0x47da66.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.0047c2e0
push 0
push 2
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0044d8c4
test eax, eax
jne case.0x47da66.140
push 1
push 0x4be118
push 1
push 0
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x47dd5d
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x47da66.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.0047c2e0
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0044dab8
test eax, eax
je case.0x47da66.140
sub eax, 2
je case.0x47da66.140
sub eax, 0x8f
je case.0x47da66.140
mov byte [ebp - 0x75], 0
jmp case.0x47da66.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.0047c2e0
push 0
push 3
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0044d8c4
test eax, eax
jne case.0x47da66.140
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x9c]
call fcn.0044d80c
test al, al
je 0x47de2c
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je 0x47de2c
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x47da66.140
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x48]
call fcn.0047ccd8
jmp case.0x47da66.140
mov byte [ebp - 0x76], 1
jmp case.0x47da66.140
lea eax, [ebp - 0xdc]
push eax
movzx eax, bx
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0
lea edx, [ebp - 0xb0]
xor ecx, ecx
mov eax, 0x47e25c
call fcn.0040aa18
mov edx, dword [ebp - 0xdc]
lea ecx, [ebp - 0xd8]
mov al, 0xb6
call fcn.004731d0
mov ecx, dword [ebp - 0xd8]
mov dl, 1
mov eax, dword [0x408a18]
call fcn.0040c3f4
call fcn.00403588
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47dedd
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.0047c5a8
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x84], 0
jne 0x47d9d2
cmp byte [ebp - 0x76], 0
je 0x47df25
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 8]
test byte [eax + 0x1d], 0x10
je 0x47df33
call fcn.00477dbc
cmp dword [ebp - 0x74], 0
je 0x47df43
call dword [ebp - 0x74]
push ebp
call fcn.0047d230
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dff1
mov eax, dword [ebp - 0x20]
call fcn.00402e48
mov eax, dword [ebp - 0xc]
call fcn.00402e48
mov eax, dword [ebp - 0x10]
call fcn.00402e48
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x47dfc6
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xe0]
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00478068
mov eax, dword [ebp - 0xe0]
call fcn.0044c8a8
test al, al
je 0x47dfc2
push 0
lea ecx, [ebp - 0xe4]
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.00478068
mov eax, dword [ebp - 0xe4]
call fcn.00403efc
push eax
push 0x1001
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x47df76
mov eax, dword [ebp - 0x18]
call fcn.00402e48
mov eax, dword [ebp - 0x1c]
call fcn.00402e48
mov eax, dword [ebp - 0x7c]
call fcn.00402e48
mov eax, dword [ebp - 0x14]
call fcn.00402e48
ret