Function at 0x1004b660
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b7006
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100e01f0]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
mov eax, dword [0x100e01f0]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x44], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, dword [ebx]
test edx, edx
je 0x1004b790
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0
mov eax, dword [edx]
push 2
push edx
call dword [eax + 0x3c]
test eax, eax
jne 0x1004b790
mov eax, dword [0x100e2a00]
test al, 1
jne 0x1004b712
or eax, 1
mov dword [0x100e2a00], eax
mov dword [esp + 0x90], 0
mov ecx, dword [0x100e28bc]
push 0xb1b2
call fcn.1002c720
mov dword [0x100e2a04], eax
mov dword [esp + 0x90], 0xffffffff
jmp 0x1004b717
mov eax, dword [0x100e2a04]
lea ecx, [esp + 0x28]
push ecx
push 0x2001f
push 0
push eax
push dword [esp + 0x3c]
mov dword [esp + 0x3c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [esp + 0x34], eax
cmp eax, 2
jne 0x1004b77f
cmp dword [esp + 0x30], 0
jne 0x1004b757
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1004bc98
push 0
lea eax, [esp + 0x2c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [0x100e2a04]
push dword [esp + 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [esp + 0x34], eax
cmp dword [esp + 0x28], 0
jne 0x1004b797
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1004bc98
lea ecx, [esp + 0x1c]
call fcn.1002d0f0
mov dword [esp + 0x90], 1
xor ebx, ebx
lea ecx, [ecx]
cmp ebx, 0x100
jge 0x1004b944
xor eax, eax
xorps xmm0, xmm0
push 0x80
mov word [esp + 0x70], ax
movq qword [esp + 0x72], xmm0
movq qword [esp + 0x7a], xmm0
mov word [esp + 0x82], ax
mov dword [esp + 0x4c], 0xa
call fcn.1007b221
add esp, 4
mov edi, eax
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x40]
push eax
push 0
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x80]
push eax
push ebx
push dword [esp + 0x44]
mov dword [esp + 0x34], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [esp + 0x24], eax
test eax, eax
jne 0x1004b92c
cmp dword [esp + 0x38], 1
jne 0x1004b92c
mov ecx, edi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004b840
sub ecx, edx
sar ecx, 1
cmp ecx, 0x20
jne 0x1004b92c
mov byte [esp + 0x1b], al
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e220
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e250
push eax
lea ecx, [esp + 0x14]
call fcn.1000e2c0
test al, al
je 0x1004b8ee
lea ecx, [esp + 0x10]
call fcn.1000e280
mov eax, dword [eax]
mov ecx, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004b8b9
test dx, dx
je 0x1004b8b5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004b8b9
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004b893
xor eax, eax
jmp 0x1004b8be
sbb eax, eax
or eax, 1
test eax, eax
je 0x1004b8e9
lea ecx, [esp + 0x10]
call fcn.1000e2a0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e250
push eax
lea ecx, [esp + 0x14]
call fcn.1000e2c0
test al, al
jne 0x1004b886
jmp 0x1004b8ee
mov byte [esp + 0x1b], 1
lea eax, [esp + 0x6c]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
dec ebx
cmp byte [esp + 0x1b], 0
jne 0x1004b92c
mov esi, dword [esp + 0x14]
push esi
call fcn.1007b221
push esi
push edi
push eax
mov dword [esp + 0x50], eax
call fcn.10080ac0
add esp, 0x10
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x20]
call fcn.1002d160
push edi
call fcn.1007b2b3
add esp, 4
inc ebx
cmp dword [esp + 0x24], 0x103
jne 0x1004b7b0
cmp dword [esp + 0x30], 0
je 0x1004b9f2
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e220
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e250
push eax
lea ecx, [esp + 0x14]
call fcn.1000e2c0
test al, al
je 0x1004b9e4
lea esp, [esp]
lea ecx, [esp + 0x10]
call fcn.1000e280
mov ecx, dword [esp + 0x30]
mov eax, dword [eax]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004b9b6
test dx, dx
je 0x1004b9b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004b9b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004b990
xor eax, eax
jmp 0x1004b9bb
sbb eax, eax
or eax, 1
test eax, eax
je 0x1004b9f2
lea ecx, [esp + 0x10]
call fcn.1000e2a0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e250
push eax
lea ecx, [esp + 0x14]
call fcn.1000e2c0
test al, al
jne 0x1004b980
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
call fcn.1002d160
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1004ba99
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e220
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e250
push eax
lea ecx, [esp + 0x18]
call fcn.1000e2c0
test al, al
je 0x1004ba99
lea ecx, [esp + 0x14]
call fcn.1000e280
mov eax, dword [eax]
mov ecx, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004ba5a
test dx, dx
je 0x1004ba56
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004ba5a
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004ba34
xor eax, eax
jmp 0x1004ba5f
sbb eax, eax
or eax, 1
lea ecx, [esp + 0x14]
test eax, eax
je 0x1004ba8a
call fcn.1000e2a0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e250
push eax
lea ecx, [esp + 0x18]
call fcn.1000e2c0
test al, al
jne 0x1004ba27
jmp 0x1004ba99
call fcn.1000e280
push eax
lea ecx, [esp + 0x20]
call fcn.1004bd10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
mov esi, 1
call fcn.1000e220
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e250
push eax
lea ecx, [esp + 0x14]
call fcn.1000e2c0
test al, al
je 0x1004bb97
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0x20]
add eax, 0x100
cmp esi, eax
jae 0x1004bb19
nop
push esi
lea eax, [esp + 0x70]
push 0x100c6a68
push eax
call fcn.1007c560
add esp, 0xc
lea eax, [esp + 0x6c]
push 0
push 0
push 0
push 0
push eax
push dword [esp + 0x3c]
call ebx
cmp eax, 2
je 0x1004bb19
mov eax, dword [esp + 0x20]
inc esi
add eax, 0x100
cmp esi, eax
jb 0x1004bae0
lea ecx, [esp + 0x10]
call fcn.1000e280
mov edi, dword [eax]
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x1004bb27
sub edi, ecx
lea ecx, [esp + 0x10]
sar edi, 1
call fcn.1000e280
lea ecx, [edi*2 + 2]
push ecx
push dword [eax]
lea eax, [esp + 0x74]
push 1
push 0
push eax
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [esp + 0x34]
test edi, edi
cmove edi, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], edi
call fcn.1000e2a0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e250
push eax
lea ecx, [esp + 0x14]
call fcn.1000e2c0
test al, al
jne 0x1004bad2
mov ebx, dword [ebp + 0xc]
jmp 0x1004bb9b
mov edi, dword [esp + 0x34]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e220
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e250
push eax
lea ecx, [esp + 0x18]
call fcn.1000e2c0
test al, al
je 0x1004bc1b
lea ecx, [esp + 0x14]
call fcn.1000e280
mov eax, dword [eax]
cmp eax, dword [esp + 0x30]
je 0x1004bbf6
lea ecx, [esp + 0x14]
call fcn.1000e280
cmp dword [eax], ebx
je 0x1004bbf6
lea ecx, [esp + 0x14]
call fcn.1000e280
push dword [eax]
call fcn.1007b2b3
add esp, 4
lea ecx, [esp + 0x14]
call fcn.1000e2a0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.1000e250
push eax
lea ecx, [esp + 0x18]
call fcn.1000e2c0
test al, al
jne 0x1004bbc5
push dword [esp + 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [esp + 0x2c]
call esi
movq xmm0, qword [0x100c6a80]
mov eax, dword [esp + 0x44]
movq qword [esp + 0x5c], xmm0
movq xmm0, qword [0x100c6a88]
mov eax, dword [eax]
lea edx, [esp + 0x4c]
push edx
movq qword [esp + 0x68], xmm0
movq xmm0, qword [0x100c6a70]
lea edx, [esp + 0x60]
push edx
movq qword [esp + 0x54], xmm0
movq xmm0, qword [0x100c6a78]
push 1
movq qword [esp + 0x60], xmm0
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x1c]
test eax, eax
jne 0x1004bc8b
test edi, edi
jne 0x1004bc8b
mov bl, 1
jmp 0x1004bc8d
xor bl, bl
lea ecx, [esp + 0x1c]
call fcn.1002d130
mov al, bl
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.1007ab33
mov esp, ebp
pop ebp
ret 8