Function at 0x4f3280
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0x5a6a74
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4f3574
movsx eax, byte [0x5a7368]
cmp eax, 0x51
jne 0x4f3412
mov ecx, dword [0x5a6a74]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov dword [0x5a7df4], 0x1ff
push 0x5a7df4
push 0x5a73a0
push 0x5a52a4
push 0
push 0x598d38
mov edx, dword [0x5a6a74]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4f33b6
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x5a7df4], 0x1ff
push 0x5a7df4
push 0x5a73a0
push 0x5a52a4
push 0
push 0x598d1c
mov eax, dword [0x5a6a74]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4f339a
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
je 0x4f3398
push str.StreetPerfect_Production_Hotkey_Proxy_Client_Found_r_n
call fcn.004e41b0
add esp, 4
push 0x598ce0
push 0x5a73a0
call fcn.00402770
add esp, 8
test eax, eax
je 0x4f3386
push 0x598cdc
push 0x5a73a0
call fcn.00402770
add esp, 8
mov byte [eax], 0
push 0x5a73a0
push str._s_r_n
call fcn.004e4280
add esp, 8
jmp 0x4f33b4
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x4f33b4
push str.StreetPerfect_Production_Hotkey_Proxy_Client_Not_Found_r_n
call fcn.004e41b0
add esp, 4
jmp 0x4f340d
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
je 0x4f340d
push 0x598c60
call fcn.004e41b0
add esp, 4
push 0x598c5c
push 0x5a73a0
call fcn.00402770
add esp, 8
test eax, eax
je 0x4f33fb
push 0x598c58
push 0x5a73a0
call fcn.00402770
add esp, 8
mov byte [eax], 0
push 0x5a73a0
push 0x598c50
call fcn.004e4280
add esp, 8
jmp 0x4f3562
movsx ecx, byte [0x5a7368]
cmp ecx, 0x52
jne 0x4f347b
push 0x598c34
mov edx, dword [0x5a6a74]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x4f345c
mov dword [ebp - 4], 1
mov eax, dword [0x5a6a74]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
cmp dword [ebp + 8], 0
je 0x4f345a
push str.StreetPerfect_Production_Hotkey_Proxy_Client_Removed_r_n
call fcn.004e41b0
add esp, 4
jmp 0x4f3476
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x4f3476
push 0x598bc0
call fcn.004e41b0
add esp, 4
jmp 0x4f3562
movsx ecx, byte [0x5a7368]
cmp ecx, 0x49
jne 0x4f3562
push 0x5a5780
call fcn.0040cf90
add esp, 4
push eax
push 0x5a5780
push 1
push 0
push 0x598ba4
mov edx, dword [0x5a6a74]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4f3522
mov dword [ebp - 4], 1
mov eax, dword [0x5a6a74]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
cmp dword [ebp + 8], 0
je 0x4f3520
push str.StreetPerfect_Production_Hotkey_Proxy_Client_Installed_r_n
call fcn.004e41b0
add esp, 4
push 0x598b64
push 0x5a5780
call fcn.00402770
add esp, 8
test eax, eax
je 0x4f350e
push 0x598afc
push 0x5a5780
call fcn.00402770
add esp, 8
mov byte [eax], 0
push 0x5a5780
push 0x598b5c
call fcn.004e4280
add esp, 8
jmp 0x4f3562
cmp dword [ebp + 8], 0
je 0x4f355b
cmp dword [ebp - 4], 5
jne 0x4f353d
push str.Registry_Error:_Access_Denied_r_n
call fcn.004e41b0
add esp, 4
jmp 0x4f354e
mov ecx, dword [ebp - 4]
push ecx
push str.Registry_Error___d_r_n
call fcn.004e42b0
add esp, 8
push str.StreetPerfect_Production_Hotkey_Proxy_Client_Failed_To_Install_r_n
call fcn.004e41b0
add esp, 4
mov dword [ebp - 4], 0
mov edx, dword [0x5a6a74]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
jmp 0x4f3577
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret