Function at 0x48f385
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push edi
push 0x1c
pop edi
cdq
mov ecx, edi
idiv ecx
and dword [ebp - 4], 0
test eax, eax
je 0x48f6ef
push 0
mov ecx, esi
call fcn.0048ed4f
push 8
pop ebx
cmp dword [eax + 0x18], ebx
jb 0x48f3c1
mov eax, dword [eax + 4]
jmp 0x48f3c4
add eax, 4
push eax
lea ecx, [ebp + 8]
call fcn.00404050
push str.deletekey
lea ecx, [ebp + 8]
call fcn.00409370
test eax, eax
jne 0x48f447
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
mov ecx, edi
cdq
idiv ecx
cmp eax, 3
jne 0x48f447
push 2
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], ebx
jb 0x48f401
mov edi, dword [eax + 4]
jmp 0x48f404
lea edi, [eax + 4]
push 1
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], ebx
jb 0x48f417
mov esi, dword [eax + 4]
jmp 0x48f41a
lea esi, [eax + 4]
push 0
push ecx
mov ecx, esp
push 0x4d67f4
call fcn.00404050
push ecx
mov ecx, esp
push edi
call fcn.00404050
push esi
lea ecx, [ebp - 0x14]
call fcn.0048f1c4
push eax
call fcn.0048ee65
pop ecx
jmp 0x48f6d9
push str.deleteemptykey
lea ecx, [ebp + 8]
call fcn.00409370
test eax, eax
jne 0x48f4bd
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
mov ecx, edi
cdq
idiv ecx
cmp eax, 3
jne 0x48f4bd
push 2
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], ebx
jb 0x48f47b
mov edi, dword [eax + 4]
jmp 0x48f47e
lea edi, [eax + 4]
push 1
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], ebx
jb 0x48f491
mov esi, dword [eax + 4]
jmp 0x48f494
lea esi, [eax + 4]
push 0
push ecx
mov ecx, esp
push 0x4d67f4
call fcn.00404050
push ecx
mov ecx, esp
push edi
call fcn.00404050
push esi
lea ecx, [ebp - 0x14]
call fcn.0048f1c4
push eax
call fcn.0048eeb0
jmp 0x48f441
push str.deleteval
lea ecx, [ebp + 8]
call fcn.00409370
test eax, eax
jne 0x48f54a
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
mov ecx, edi
cdq
idiv ecx
cmp eax, 4
jne 0x48f54a
push 3
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], ebx
jb 0x48f4f1
mov ebx, dword [eax + 4]
jmp 0x48f4f4
lea ebx, [eax + 4]
push 2
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], 8
jb 0x48f508
mov edi, dword [eax + 4]
jmp 0x48f50b
lea edi, [eax + 4]
push 1
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], 8
jb 0x48f51f
mov esi, dword [eax + 4]
jmp 0x48f522
lea esi, [eax + 4]
push 0
push ecx
mov ecx, esp
push ebx
call fcn.00404050
push ecx
mov ecx, esp
push edi
call fcn.00404050
push esi
lea ecx, [ebp - 0x14]
call fcn.0048f1c4
push eax
call fcn.004796c6
jmp 0x48f441
push str.writevalue
lea ecx, [ebp + 8]
call fcn.00409370
test eax, eax
jne 0x48f6e4
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
cdq
idiv edi
cmp eax, 6
jne 0x48f6e4
push 4
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], ebx
jb 0x48f584
mov eax, dword [eax + 4]
jmp 0x48f587
add eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.REG_DWORD
push eax
call edi
mov ecx, esi
test eax, eax
jne 0x48f62d
push 5
call fcn.0048ed4f
cmp dword [eax + 0x18], ebx
jb 0x48f5b0
mov eax, dword [eax + 4]
jmp 0x48f5b3
add eax, 4
push 3
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.0048ed4f
cmp dword [eax + 0x18], ebx
jb 0x48f5c9
mov ebx, dword [eax + 4]
jmp 0x48f5cc
lea ebx, [eax + 4]
push 2
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], 8
jb 0x48f5e0
mov edi, dword [eax + 4]
jmp 0x48f5e3
lea edi, [eax + 4]
push 1
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], 8
jb 0x48f5f7
mov esi, dword [eax + 4]
jmp 0x48f5fa
lea esi, [eax + 4]
push dword [ebp - 4]
call fcn.004997dd
pop ecx
push eax
push 0
push ecx
mov ecx, esp
push ebx
call fcn.00404050
push ecx
mov ecx, esp
push edi
call fcn.00404050
push esi
lea ecx, [ebp - 0x14]
call fcn.0048f1c4
push eax
call fcn.0046e249
pop ecx
jmp 0x48f441
push 4
call fcn.0048ed4f
cmp dword [eax + 0x18], ebx
jb 0x48f63e
mov eax, dword [eax + 4]
jmp 0x48f641
add eax, 4
push str.REG_SZ
push eax
call edi
test eax, eax
jne 0x48f6e4
push 5
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], ebx
jb 0x48f664
mov eax, dword [eax + 4]
jmp 0x48f667
add eax, 4
push 3
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.0048ed4f
cmp dword [eax + 0x18], ebx
jb 0x48f67d
mov ebx, dword [eax + 4]
jmp 0x48f680
lea ebx, [eax + 4]
push 2
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], 8
jb 0x48f694
mov edi, dword [eax + 4]
jmp 0x48f697
lea edi, [eax + 4]
push 1
mov ecx, esi
call fcn.0048ed4f
cmp dword [eax + 0x18], 8
jb 0x48f6ab
mov esi, dword [eax + 4]
jmp 0x48f6ae
lea esi, [eax + 4]
push 0
push dword [ebp - 4]
push 0
push ecx
mov ecx, esp
push ebx
call fcn.00404050
push ecx
mov ecx, esp
push edi
call fcn.00404050
push esi
lea ecx, [ebp - 0x14]
call fcn.0048f1c4
push eax
call fcn.0040bfc0
add esp, 0xc
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], eax
call fcn.0040c410
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404d30
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4