Function at 0x47877c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x478a04
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
push 0xf013f
push 0
push ebx
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x4787c2
or ebx, 0xffffffff
jmp 0x4789e1
mov dl, 1
mov eax, dword [0x412dc8]
call fcn.00403b80
mov dword [ebp - 0x1c], eax
xor edx, edx
push ebp
push 0x4789d5
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x478a14
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x478817
mov ebx, 0xfffffffe
call fcn.004044d0
jmp 0x4789e1
cmp dword [ebp - 4], 7
jne 0x478895
mov eax, dword [ebp - 8]
call fcn.00402e60
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47888e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x478a14
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, dword [ebp - 0xc]
jmp 0x478873
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00404c88
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push ebx
call sub.kernel32.dll_lstrlenA_1
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x478855
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478895
mov eax, dword [ebp - 0xc]
call fcn.00402e7c
ret
mov edx, 0x478a2c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x54]
cmp eax, 0xffffffff
jne 0x4788b3
xor ebx, ebx
call fcn.004044d0
jmp 0x4789e1
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x48]
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x478903
inc esi
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4788f9
sub eax, 4
mov eax, dword [eax]
inc eax
add dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
dec esi
jne 0x4788d9
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
call fcn.00402e60
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4789b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x478965
inc esi
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x2c]
call fcn.00404f20
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push ebx
call sub.kernel32.dll_lstrlenA_1
inc eax
add ebx, eax
inc dword [ebp - 0x14]
dec esi
jne 0x478939
mov byte [ebx], 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 7
push 0
push 0x478a14
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
push eax
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4789a2
mov ebx, 0xfffffffd
call fcn.004044d0
call fcn.004044d0
jmp 0x4789e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4789bf
mov eax, dword [ebp - 0xc]
call fcn.00402e7c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478a0b
lea eax, [ebp - 0x2c]
call fcn.00404a90
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404ab4
ret