Function at 0x482710
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63fda0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, dword [0x6cdb00]
push ebx
push esi
xor ebx, ebx
push edi
cmp eax, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
jne 0x482a21
mov edx, dword [0x6fcafc]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x18]
push eax
push ecx
push ebx
push ebx
push str.ptrk_scdt
push edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4829ee
push ecx
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], esp
mov eax, esp
push edx
push ebx
mov dword [eax], ecx
call fcn.0060b449
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.0046b120
mov ecx, eax
call fcn.0046b130
mov ecx, dword [eax]
mov eax, 0xc22e4507
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
jns 0x4827b9
cmp edx, 0xffffff9c
jge 0x482a21
lea ecx, [ebp - 0x24]
push ecx
call fcn.0060b449
mov edx, dword [ebp - 0x24]
mov ecx, dword [0x6fcafc]
add esp, 4
lea eax, [ebp - 0x18]
add edx, 0x4f1a00
push 4
push eax
push 4
push ebx
push str.ptrk_scdt
push ecx
mov dword [ebp - 0x18], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x482a21
lea ecx, [ebp - 0x38]
call fcn.00524830
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00524830
mov ecx, dword [0x6fcacc]
mov eax, dword [0x6fd75c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x14]
neg ecx
push edx
push 0xf003f
sbb ecx, ecx
push ebx
add ecx, 0x80000002
push eax
push ecx
call edi
mov esi, eax
cmp esi, ebx
je 0x4828fa
cmp esi, 2
je 0x4828f6
mov edx, dword [0x6f7b78]
mov dword [ebp - 0x1c], edx
mov eax, dword [0x6fcacc]
mov byte [ebp - 4], 3
cmp eax, ebx
mov eax, str.CURRENT_USER
jne 0x482864
mov eax, str.MACHINE
mov ecx, dword [0x6fd75c]
lea edx, [ebp - 0x1c]
push ecx
push eax
push 0x6c9ce8
push edx
call fcn.0061fae1
mov eax, dword [ebp - 0x1c]
add esp, 0x10
lea ecx, [ebp - 0x38]
push eax
call fcn.005248e0
cmp eax, ebx
je 0x4828b1
mov eax, dword [0x6fcacc]
mov edx, dword [0x6fd75c]
lea ecx, [ebp - 0x14]
neg eax
push ecx
push 0xf003f
sbb eax, eax
push ebx
add eax, 0x80000002
push edx
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x4828ea
mov ecx, dword [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x38]
call fcn.005249b0
cmp eax, ebx
je 0x4828ea
mov ecx, dword [0x6fcacc]
mov eax, dword [0x6fd75c]
lea edx, [ebp - 0x14]
neg ecx
push edx
push 0xf003f
sbb ecx, ecx
push ebx
add ecx, 0x80000002
push eax
push ecx
call edi
mov esi, eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00622d8a
cmp esi, ebx
jne 0x482913
mov edx, dword [ebp - 0x14]
push str.MData
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push ebx
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
push 0x80000001
call edi
mov esi, eax
cmp esi, ebx
je 0x48298f
cmp esi, 2
je 0x48298b
mov edx, dword [0x6f7b78]
mov dword [ebp - 0x1c], edx
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
lea eax, [ebp - 0x1c]
push str.CURRENT_USER_s
push eax
mov byte [ebp - 4], 4
call fcn.0061fae1
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
push ecx
lea ecx, [ebp - 0x48]
call fcn.005248e0
cmp eax, ebx
je 0x48297f
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push ebx
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
push 0x80000001
call edi
mov esi, eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00622d8a
cmp esi, ebx
jne 0x4829a8
mov eax, dword [ebp - 0x14]
push str.MData
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x28]
push ebx
push 0x139f
push 0x111
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00524870
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], bl
call fcn.00524870
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x28]
push ecx
call fcn.0060b449
mov edx, dword [ebp - 0x28]
mov ecx, dword [0x6fcafc]
add esp, 4
lea eax, [ebp - 0x18]
add edx, 0x3f480
push 4
push eax
push 4
push ebx
push str.ptrk_scdt
push ecx
mov dword [ebp - 0x18], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret