Function at 0x100046e6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4c
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push esi
mov esi, 0x100098d0
push edi
push esi
mov edi, 0x100093d0
push 0x100098c0
lea eax, [ebp - 0x948]
push edi
push eax
call ebx
lea eax, [ebp - 0x948]
push eax
call fcn.1000537d
add esp, 0x14
jl 0x10004736
xchg ecx, ecx
xchg ch, ch
jge 0x10004736
fbstp tbyte [eax - 0x7ce92414]
push ebx
dec eax
daa
add dword [edx], 0x68df84
cdq
add byte [eax], dl
push 0x10009900
push esi
lea eax, [ebp - 0x128]
push edi
push eax
call ebx
add esp, 0x10
push eax
push edi
push esi
inc si
cmp edi, eax
pop esi
pop edi
pop eax
push 0x10009924
lea eax, [ebp - 0x128]
push 0x10009908
push eax
mov esi, 0x100099c0
lea eax, [ebp - 0x538]
push esi
push eax
call ebx
add esp, 0x14
push eax
push edi
test edi, 0x6e34
dec ax
dec ah
or eax, ecx
xor al, dh
or eax, 0x24ad
cmp ax, cx
test eax, eax
dec ah
and di, di
pop edi
pop eax
push 0x10009924
lea eax, [ebp - 0x128]
push 0x10009918
push eax
lea eax, [ebp - 0x434]
push esi
push eax
call ebx
add esp, 0x14
push ax
push ecx
push esi
dec al
pop esi
pop ecx
pop ax
lea eax, [ebp - 0x128]
push 0x10009908
push eax
lea eax, [ebp - 0x740]
push 0x100093d0
push eax
call ebx
add esp, 0x10
push bx
push edx
push edi
or dh, dh
xor bx, cx
pop edi
pop edx
pop bx
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x128]
push 0x10009918
push eax
mov ebx, 0x100093d0
lea eax, [ebp - 0x844]
push ebx
push eax
call esi
add esp, 0x10
push eax
push edi
test edi, 0x6e34
dec ax
dec ah
or eax, ecx
xor al, dh
or eax, 0x24ad
cmp ax, cx
test eax, eax
dec ah
and di, di
pop edi
pop eax
push 0x10009938
push 0x100098d0
lea eax, [ebp - 0x63c]
push ebx
push eax
call esi
add esp, 0x10
call fcn.1000683f
mov dword [ebp - 0x20], eax
push eax
push edx
xor al, 0x3d
sub ah, 0x2b
add eax, 0x7c28
or dh, dl
xor ax, dx
cmp ax, 0x4001
pop edx
pop eax
lea eax, [ebp - 0x330]
push eax
call fcn.10002799
pop ecx
test eax, eax
je 0x10004985
je 0x10004897
push edi
mov di, 0x9ce2
pop edi
jne 0x10004897
insd dword es:[edi], dx
dec esp
jl 0x10004901
xor eax, 0xdee0ed6d
aad 0xcf
xor byte [eax - 0x22b5b], al
inc dword [eax]
and byte [ebp - 0x22c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x22c]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x22c]
push 0x10009988
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
push eax
push edi
push esi
inc si
cmp edi, eax
pop esi
pop edi
pop eax
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
lea eax, [ebp - 0x128]
push esi
mov ebx, SysReAllocString
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000494c
dec edx
jp 0x1000490e
push ecx
mov ecx, 0x54689436
pop ecx
jnp 0x1000490e
or dword [ebp - 0x22b7b], 0xffffffff
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x538]
push eax
push dword [ebp - 0x20]
call fcn.100045f1
add esp, 0x20
jmp 0x10004985
jl 0x10004967
push edi
mov edi, 0x513b465
pop edi
jge 0x10004967
sbb dl, bl
pop ss
push es
mov dl, 0xf4
dec esi
or edi, ebp
stosb byte es:[edi], al
sub dl, dl
aad 0x79
jb 0x1000496c
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x18]
push esi
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1000498c
xor eax, eax
jmp 0x10004bf1
jbe 0x1000499c
mov dx, dx
mov esi, esi
ja 0x1000499c
sub ch, byte [ebx]
cmp byte [edx - 0xb], dl
sub dword [edi - 1], esp
jne 0x1000499b
push dword [di - 4]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
push edx
push esi
test si, 0x2af8
xor edx, ecx
add ax, bx
or ax, 0x11a9
pop esi
pop edx
pop eax
push 1
xor ecx, ecx
pop esi
cmp dword [ebp - 0x20], esi
setne cl
inc ecx
push edi
push ax
push dx
and ax, 0x4e68
test ch, dh
mov al, 0x4d
dec dx
and dx, cx
pop dx
pop ax
pop edi
and dword [ebp - 0x1c], 0
cmp dword [ebp - 8], ecx
ja 0x10004a61
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
mov esi, 0x20019
push eax
push esi
lea eax, [ebp - 0x538]
push 0
push eax
push ebx
call edi
test eax, eax
je 0x10004a0e
mov dword [ebp - 0x1c], 1
jmp 0x10004a17
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
cmp dl, al
and dl, 0x4e
or dl, 0x38
and dl, al
and edx, eax
xor dh, 0x3c
add dh, bh
or edx, 0x604
add dh, dl
pop edx
cmp dword [ebp - 8], 2
jne 0x10004a64
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x434]
push 0
push eax
push ebx
call edi
test eax, eax
je 0x10004a56
mov dword [ebp - 0x1c], 1
jmp 0x10004a64
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10004a64
mov dword [ebp - 0x1c], esi
push 4
lea eax, [ebp - 0x10]
pop edi
mov esi, 0x10009944
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x63c]
push esi
push eax
push ebx
mov dword [ebp - 0x10], edi
call fcn.10004d4f
add esp, 0x18
test eax, eax
je 0x10004ab8
push 0x24
pop eax
cmp dword [ebp - 0xc], eax
je 0x10004ab8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push edi
push eax
push edi
lea eax, [ebp - 0x63c]
push esi
push eax
push ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
call fcn.10004bf6
add esp, 0x18
xor esi, esi
cmp dword [ebp - 0x1c], esi
jne 0x10004b85
and byte [ebp - 0xa4c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0xa4b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
mov edi, 0x104
push eax
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x538]
push esi
push eax
push ebx
mov dword [ebp - 0x1c], edi
call fcn.10004d4f
add esp, 0x18
test eax, eax
je 0x10004b23
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0xa4c]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x10004b23
push 1
pop esi
cmp dword [ebp - 8], 2
jne 0x10004b81
test esi, esi
je 0x10004b85
push edi
lea eax, [ebp - 0xa4c]
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
push eax
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x434]
push 0
push eax
push ebx
call fcn.10004d4f
add esp, 0x24
test eax, eax
je 0x10004b85
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0xa4c]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x10004b85
push 1
pop esi
test esi, esi
jne 0x10004bee
je 0x10004b99
jne 0x10004b99
inc ebx
jbe 0x10004bde
aaa
sub dword [eax + 0x2a], ebx
inc esi
lea eax, [ebp - 0x128]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push ebx
add bx, ax
mov bx, 0x6602
and bh, dl
pop ebx
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x538]
enter 0xfffffffffffffffa, 0xffffffffffffffff
push eax
push dword [ebp - 0x20]
call fcn.100045f1
add esp, 0x20
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret