Function at 0x4ecfac
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 0x210], ecx
mov ecx, dword [ebp - 0x210]
call fcn.004ed660
push 0x3d
mov ecx, dword [ebp - 0x210]
call fcn.004ed8ae
test eax, eax
jne 0x4ecfdc
jmp 0x4ed279
mov ecx, dword [ebp - 0x210]
call fcn.004ed660
push 0x22
mov ecx, dword [ebp - 0x210]
call fcn.004ed8ae
test eax, eax
je 0x4ed037
mov dword [ebp - 8], 0x4000
lea eax, [ebp - 8]
push eax
push 0x5c3ef8
mov ecx, dword [ebp - 0x210]
call fcn.004ed281
test eax, eax
je 0x4ed026
mov ecx, dword [ebp - 0x210]
call fcn.004ed5ac
test eax, eax
jne 0x4ed02b
jmp 0x4ed277
mov dword [ebp - 4], 1
jmp 0x4ed1de
mov cx, word [str.dword:]
push ecx
mov ecx, dword [ebp - 0x210]
call fcn.004ed8ae
test eax, eax
je 0x4ed0df
mov dword [ebp - 0xc], 0x5bd3b6
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx]
test eax, eax
je 0x4ed099
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx]
mov word [ebp - 0x212], dx
mov ax, word [ebp - 0x212]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x210]
call fcn.004ed8ae
test eax, eax
jne 0x4ed097
jmp 0x4ed275
jmp 0x4ed059
mov ecx, dword [ebp - 0x210]
call fcn.004ed660
push 0x5c3ef8
mov ecx, dword [ebp - 0x210]
call fcn.004ed427
test eax, eax
je 0x4ed0c7
mov ecx, dword [ebp - 0x210]
call fcn.004ed5ac
test eax, eax
jne 0x4ed0cc
jmp 0x4ed273
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
jmp 0x4ed1de
push 0x2d
mov ecx, dword [ebp - 0x210]
call fcn.004ed8ae
test eax, eax
je 0x4ed117
mov ecx, dword [ebp - 0x210]
call fcn.004ed5ac
test eax, eax
jne 0x4ed104
jmp 0x4ed271
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4ed27b
mov dword [ebp - 0xc], 0x5bd3ac
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx]
test edx, edx
je 0x4ed15e
mov eax, dword [ebp - 0xc]
mov cx, word [eax]
mov word [ebp - 0x214], cx
mov dx, word [ebp - 0x214]
push edx
mov eax, dword [ebp - 0xc]
add eax, 2
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x210]
call fcn.004ed8ae
test eax, eax
jne 0x4ed15c
jmp 0x4ed26f
jmp 0x4ed11e
push 0x28
mov ecx, dword [ebp - 0x210]
call fcn.004ed8ae
test eax, eax
je 0x4ed19a
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x210]
call fcn.004ed427
test eax, eax
je 0x4ed193
push 0x29
mov ecx, dword [ebp - 0x210]
call fcn.004ed8ae
test eax, eax
jne 0x4ed198
jmp 0x4ed26d
jmp 0x4ed1a1
mov dword [ebp - 4], 3
push 0x3a
mov ecx, dword [ebp - 0x210]
call fcn.004ed8ae
test eax, eax
je 0x4ed1d9
lea edx, [ebp - 8]
push edx
push 0x5c3ef8
mov ecx, dword [ebp - 0x210]
call fcn.004ed389
test eax, eax
je 0x4ed1d9
mov ecx, dword [ebp - 0x210]
call fcn.004ed5ac
test eax, eax
jne 0x4ed1de
jmp 0x4ed26b
cmp dword [0x5cc6fc], 0x500
jae 0x4ed23f
cmp dword [ebp - 4], 2
je 0x4ed1f6
cmp dword [ebp - 4], 7
jne 0x4ed23f
mov byte [ebp - 0x20c], 0
push 0
push 0
push 0x200
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 8]
push edx
push 0x5c3ef8
mov eax, dword [ebp - 4]
push eax
push 0
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4ed25c
mov eax, dword [ebp - 8]
push eax
push 0x5c3ef8
mov ecx, dword [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4ed27b
mov ecx, dword [ebp - 0x210]
call fcn.004ed69a
jmp 0x4ed27b
jmp 0x4ed25e
jmp 0x4ed25e
jmp 0x4ed25e
jmp 0x4ed25e
jmp 0x4ed25e
jmp 0x4ed25e
jmp 0x4ed25e
jmp 0x4ed25e
mov esp, ebp
pop ebp
ret 8