Function at 0x476920
Capabilities:
Delete registry value
Get graphical window text
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62a040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0x577
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x500
push esi
mov edi, eax
call sym.SystemInformer.exe_PhGetDialogItemValue
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x28
mov dword [ebp - 0xc], str.SampleCountAutomatic
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0
push 0
push 0xf0
test eax, eax
push 0x551
push esi
setne bl
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
sete al
cmp al, bl
je 0x47699f
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x28
push eax
mov dword [ebp - 0xc], str.SampleCountAutomatic
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
mov ebx, dword [ebp - 8]
mov eax, 1
test ebx, ebx
mov dword [ebp - 0x10], 0x16
mov dword [ebp - 0xc], str.SampleCount
cmove ebx, eax
lea eax, [ebp - 0x10]
push eax
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
mov edi, edi
cmp ebx, eax
je 0x4769eb
mov byte [0x631236], 1
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x16
push eax
mov dword [ebp - 0xc], str.SampleCount
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0x477
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 8]
push ecx
push 0
push eax
call sym.SystemInformer.exe_PhGetWindowTextEx
push dword [ebp - 8]
call sym.SystemInformer.exe_PhAutoDereferenceObject
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x18
push eax
mov dword [ebp - 0xc], str.SearchEngine
call sym.SystemInformer.exe_PhSetStringRefSetting
push 0x47f
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 8]
push ecx
push 0
push eax
call sym.SystemInformer.exe_PhGetWindowTextEx
push dword [ebp - 8]
call sym.SystemInformer.exe_PhAutoDereferenceObject
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x32
push eax
mov dword [ebp - 0xc], str.ProgramInspectExecutables
call sym.SystemInformer.exe_PhSetStringRefSetting
push 0
push 0
push 0x147
push 0x478
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov dword [0x62e928], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x16
mov dword [ebp - 0xc], str.MaxSizeUnit
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0x4e0
push esi
call sym.SystemInformer.exe_PhGetDialogItemValue
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1a
push eax
mov dword [ebp - 0xc], str.IconProcesses
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x22
push eax
mov dword [ebp - 0xc], str.DbgHelpSearchPath
call sym.SystemInformer.exe_PhGetStringRefSetting
mov ebx, dword [ebp - 0x14]
mov esi, eax
push 0x4c2
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
call sym.SystemInformer.exe_PhGetWindowTextEx
push esi
call sym.SystemInformer.exe_PhAutoDereferenceObject
push dword [ebp - 0x14]
mov esi, eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push 1
push esi
push eax
call sym.SystemInformer.exe_PhEqualStringRef
mov edi, edi
test al, al
jne 0x476b64
push 0x4c2
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
call sym.SystemInformer.exe_PhGetWindowTextEx
push dword ds:[ebp - 0x14]
call sym.SystemInformer.exe_PhAutoDereferenceObject
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x22
push eax
mov dword [ebp - 0xc], str.DbgHelpSearchPath
call sym.SystemInformer.exe_PhSetStringRefSetting
mov byte [0x631236], 1
push 0xf000
push 0
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x28
xor ecx, ecx
mov dword [ebp - 0xc], str.AllowOnlyOneInstance
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 1
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x16
xor ecx, ecx
mov dword [ebp - 0xc], str.HideOnClose
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 2
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x1c
xor ecx, ecx
mov dword [ebp - 0xc], str.HideOnMinimize
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 4
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x16
xor ecx, ecx
mov dword [ebp - 0xc], str.StartHidden
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x2a
push eax
mov dword [ebp - 0xc], str.MiniInfoWindowEnabled
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0xd
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x476c95
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x2a
push eax
mov dword [ebp - 0xc], str.MiniInfoWindowEnabled
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0xe
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x36
xor ecx, ecx
mov dword [ebp - 0xc], str.MainWindowTabRestoreEnabled
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x12
push eax
mov dword [ebp - 0xc], str.KsiEnable
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 6
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x476d35
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x12
push eax
mov dword [ebp - 0xc], str.KsiEnable
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 5
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x1c
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableWarnings
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x1a
push eax
mov dword [ebp - 0xc], str.EnablePlugins
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 8
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x476dd5
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1a
push eax
mov dword [ebp - 0xc], str.EnablePlugins
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 9
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x22
xor ecx, ecx
mov dword [ebp - 0xc], str.DbgHelpUndecorate
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x34
push eax
mov dword [ebp - 0xc], str.TreeListEnableHeaderTotals
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0xa
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x476e75
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x34
push eax
mov dword [ebp - 0xc], str.TreeListEnableHeaderTotals
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableGraphMaxScale
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0xc
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x476ed7
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableGraphMaxScale
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableCycleCpuUsage
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0xb
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x476f3e
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableCycleCpuUsage
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x24
push eax
mov dword [ebp - 0xc], str.EnableThemeSupport
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0xf
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x476fa0
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x24
push eax
mov dword [ebp - 0xc], str.EnableThemeSupport
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x10
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x24
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableStartAsAdmin
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x24
push eax
mov dword [ebp - 0xc], str.EnableStreamerMode
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x11
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x47703e
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x24
push eax
mov dword [ebp - 0xc], str.EnableStreamerMode
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x12
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x2e
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableSilentCrashNotify
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 7
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x26
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableMonospaceFont
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x28
push eax
mov dword [ebp - 0xc], str.EnableNetworkResolve
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x13
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x477115
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x28
push eax
mov dword [ebp - 0xc], str.EnableNetworkResolve
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x2e
push eax
mov dword [ebp - 0xc], str.EnableNetworkResolveDoH
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x14
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x477177
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x2e
push eax
mov dword [ebp - 0xc], str.EnableNetworkResolveDoH
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x15
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x2a
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableInstantTooltips
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x36
push eax
mov dword [ebp - 0xc], str.EnableImageCoherencySupport
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x16
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x477215
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x36
push eax
mov dword [ebp - 0xc], str.EnableImageCoherencySupport
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x18
push eax
mov dword [ebp - 0xc], str.EnableStage2
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x17
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x477277
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x18
push eax
mov dword [ebp - 0xc], str.EnableStage2
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableServiceStage2
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
push 0xf000
push 0x18
test eax, eax
push 0x102c
push edi
setne bl
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
cmp eax, 0x2000
sete al
cmp al, bl
je 0x4772de
mov byte [0x631236], 1
movzx eax, al
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x26
push eax
mov dword [ebp - 0xc], str.EnableServiceStage2
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x19
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x1e
xor ecx, ecx
mov dword [ebp - 0xc], str.IconSingleClick
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x1a
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x2a
xor ecx, ecx
mov dword [ebp - 0xc], str.IconTogglesVisibility
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x1b
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x22
xor ecx, ecx
mov dword [ebp - 0xc], str.PropagateCpuUsage
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 0x1c
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
and eax, 0xfffff000
mov dword [ebp - 0x10], 0x2a
xor ecx, ecx
mov dword [ebp - 0xc], str.EnableAdvancedOptions
cmp eax, 0x2000
lea eax, [ebp - 0x10]
sete cl
push ecx
push eax
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
lea eax, ds:[ebp - 0x10]
mov dword [ebp - 0x10], 0x24
push eax
mov dword [ebp - 0xc], str.EnableThemeSupport
call sym.SystemInformer.exe_PhGetIntegerStringRefSetting
test eax, eax
je 0x477425
push 1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1c
push eax
mov dword [ebp - 0xc], str.GraphColorMode
call sym.SystemInformer.exe_PhSetIntegerStringRefSetting
push 0xf000
push 4
push 0x102c
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xf000
push 3
push 0x102c
shr eax, 0xc
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
shr esi, 0xc
cmp esi, 2
sete cl
cmp byte [0x631237], cl
je 0x4775af
push 0
push 0x62bf18
push 0xfffffffffffffff7
push 0x20006
lea eax, [ebp - 8]
push eax
call sym.SystemInformer.exe_PhOpenKey
test eax, eax
js 0x4775af
cmp esi, 2
jne 0x477572
call sym.SystemInformer.exe_PhGetApplicationFileNameWin32
mov ebx, eax
test ebx, ebx
je 0x4775a6
push 0x62c008
push ebx
push 0x62c008
call sym.SystemInformer.exe_PhConcatStringRef3
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edi, eax
cmp dword [ebp - 0x14], esi
jne 0x47751b
mov ecx, dword ds:[edi]
lea eax, [ebp - 0x10]
push 0
push 0
add ecx, 0xc
mov dword [ebp - 0xc], 0
push eax
mov dword [ebp - 0x10], ecx
call sym.SystemInformer.exe_PhCreateString3
push dword [edi]
mov esi, eax
push dword [edi + 4]
push dword [esi + 4]
call fcn.0057e5b0
mov ecx, dword [edi]
add esp, 0xc
add ecx, dword [esi + 4]
mov eax, dword [str.__hide]
push esi
mov dword [ecx], eax
mov eax, dword [0x5cd69c]
mov dword [ecx + 4], eax
mov eax, dword [0x5cd6a0]
mov dword [ecx + 8], eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edi, eax
mov ecx, dword [0x62c010]
mov edx, dword ds:[edi]
add edx, 2
mov word [ebp - 0x18], cx
lea eax, [ecx + 2]
mov word [ebp - 0x16], ax
mov eax, dword [0x62c014]
mov dword [ebp - 0x14], eax
cmp ecx, 0xfffe
ja 0x47755d
push edx
push dword [edi + 4]
lea eax, [ebp - 0x18]
push 1
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4775a6
call fcn.004f9e40
jmp 0x4775a6
mov ecx, dword [0x62c010]
mov word [ebp - 0x18], cx
lea eax, [ecx + 2]
mov word [ebp - 0x16], ax
mov eax, dword [0x62c014]
mov dword [ebp - 0x14], eax
cmp ecx, 0xfffe
ja 0x4775a6
lea eax, ds:[ebp - 0x18]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
push 0x4766a0
push 0
push 0x10
call sym.SystemInformer.exe__PhPluginInvokeWindowCallback_12
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057c26f
mov esp, ebp
pop ebp
ret