Function at 0x4a3220
Capabilities:
Delete registry value
Persist via run registry key
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0916
mov eax, dword fs:[0]
push eax
mov eax, 0x8904
call fcn.00458200
mov eax, dword [0x4df798]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8908], ecx
push 0x200
push 0
mov eax, dword [ebp - 0x8908]
add eax, 0x28a4
push eax
call fcn.00451f70
add esp, 0xc
push 0x200
mov ecx, dword [ebp - 0x8908]
add ecx, 0x28a4
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, dword [ebp - 0x8908]
add edx, 0x28a4
push edx
call fcn.00452400
add esp, 4
sub eax, 1
mov dword [ebp - 0x88dc], eax
jmp 0x4a32b9
mov eax, dword [ebp - 0x88dc]
sub eax, 1
mov dword [ebp - 0x88dc], eax
cmp dword [ebp - 0x88dc], 0
jl 0x4a32f5
mov ecx, dword [ebp - 0x88dc]
mov edx, dword [ebp - 0x8908]
movzx eax, word [edx + ecx*2 + 0x28a4]
cmp eax, 0x5c
jne 0x4a32f3
xor ecx, ecx
mov edx, dword [ebp - 0x88dc]
mov eax, dword [ebp - 0x8908]
mov word [eax + edx*2 + 0x28a4], cx
jmp 0x4a32f5
jmp 0x4a32aa
mov ecx, dword [ebp - 0x8908]
add ecx, 0x28a4
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, dword [ebp - 0x8908]
mov eax, dword [edx + 0x48]
push eax
call fcn.004a0fb0
add esp, 4
mov ecx, dword [ebp - 0x8908]
mov dword [ecx + 0x1a40], eax
mov ecx, dword [ebp - 0x8908]
call fcn.004a0f20
mov dword [ebp - 0x890c], eax
cmp dword [ebp - 0x890c], 1
je 0x4a3376
cmp dword [ebp - 0x890c], 2
je 0x4a334b
jmp 0x4a337d
push 0x10
push 0
mov ecx, 0x53550c
call fcn.00481790
push eax
push 0x3d
mov ecx, 0x53550c
call fcn.00481790
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x4a35a0
xor eax, eax
jmp 0x4a35a0
mov ecx, dword [ebp - 0x8908]
add ecx, 0xa4
call fcn.0047caa0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, dword [ebp - 0x8908]
add ecx, 0xa4
call fcn.00405fc0
cmp dword [ebp - 0x1c], 0
jne 0x4a33b3
jmp 0x4a33b3
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x8910], edx
cmp dword [ebp - 0x8910], 1
je 0x4a33d0
cmp dword [ebp - 0x8910], 2
je 0x4a33dc
jmp 0x4a33e6
mov dword [ebp - 0x88d8], 2
jmp 0x4a33e6
mov dword [ebp - 0x88d8], 0x35
cmp dword [ebp - 0x1c], 0
je 0x4a34a9
push 0x10
push 0
mov ecx, 0x53550c
call fcn.00481790
push eax
mov eax, dword [ebp - 0x88d8]
push eax
mov ecx, 0x53550c
call fcn.00481790
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x8908]
cmp dword [ecx + 0x1a40], 0
je 0x4a34a7
push 0x24
push 0
mov ecx, 0x53550c
call fcn.00481790
push eax
push 0x4d
mov ecx, 0x53550c
call fcn.00481790
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x88fc], eax
cmp dword [ebp - 0x88fc], 7
jne 0x4a34a0
mov dword [ebp - 0x8900], 0
lea edx, [ebp - 0x8900]
push edx
mov eax, dword [0x4cb0b4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4a34a0
push 0x4cacd4
mov ecx, dword [ebp - 0x8900]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x8900]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4a35a0
jmp 0x4a34dd
mov eax, dword [ebp - 0x8908]
movzx ecx, byte [eax + 0x1a44]
test ecx, ecx
je 0x4a34c7
push 0
mov ecx, dword [ebp - 0x8908]
call fcn.004a1bf0
mov edx, dword [ebp - 0x8908]
cmp dword [edx + 0x1a40], 5
jne 0x4a34dd
xor eax, eax
jmp 0x4a35a0
mov ecx, dword [ebp - 0x8908]
call fcn.004a1160
test eax, eax
jne 0x4a3510
push 0x10
push 0
mov ecx, 0x53550c
call fcn.00481790
push eax
push 3
mov ecx, 0x53550c
call fcn.00481790
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x14], 0xff
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp - 0x8908]
call fcn.0043a2a8
push 0
call fcn.0043b2e6
add esp, 4
push 0x4cacf8
mov ecx, dword [ebp - 0x8908]
call fcn.0043b7b9
push 0
lea ecx, [ebp - 0x88d4]
call fcn.00499ec0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x8908]
lea edx, [ebp - 0x88d4]
mov dword [ecx + 0x20], edx
lea ecx, [ebp - 0x88d4]
call fcn.0042cf7b
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x8904], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88d4]
call fcn.0048f820
mov eax, dword [ebp - 0x8904]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00451600
mov esp, ebp
pop ebp
ret