Function at 0x47c170
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov ebx, ecx
test eax, eax
je 0x47c3ed
test ebp, ebp
je 0x47c3ed
cmp ebp, 0xfffffffe
je 0x47c3ed
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [0x4b7a70]
lea edx, [esp + 0x28]
push edx
mov edx, dword [ecx + 0xb0]
mov ecx, dword [esp + 0x30]
push 0
or edx, 0x20006
push edx
push 0
push 0x4a7935
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, eax
test edi, edi
jne 0x47c431
lea eax, [ebp - 1]
cmp eax, 6
ja case.0x47c1e0.5
jmp dword [eax*4 + 0x47c488]
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47c1f0
sub eax, edx
mov edx, dword [esp + 0x2c]
inc eax
push eax
mov eax, dword [esp + 0x28]
push ebx
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
jmp 0x47c426
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47c220
sub eax, edx
inc eax
push eax
push ebx
push 2
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
jmp 0x47c426
mov edi, ebx
lea ecx, [edi + 1]
lea esp, [esp]
mov al, byte [edi]
inc edi
test al, al
jne 0x47c250
sub edi, ecx
lea eax, [edi + 2]
push eax
call fcn.004931f9
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x47c273
lea edi, [eax + 0xe]
jmp 0x47c426
push edi
push ebx
push ebp
call fcn.00496040
add esp, 0xc
mov word [edi + ebp], 0
test edi, edi
je 0x47c294
cmp byte [edi + ebp - 1], 0xa
jne 0x47c294
dec edi
mov byte [edi + ebp], 0
cmp byte [ebp], 0
mov eax, ebp
je 0x47c2ae
lea esp, [esp]
cmp byte [eax], 0xa
jne 0x47c2a8
mov byte [eax], 0
inc eax
cmp byte [eax], 0
jne 0x47c2a0
test edi, edi
je 0x47c2b7
lea eax, [edi + 2]
jmp 0x47c2b9
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
push eax
push ebp
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebp
mov edi, eax
call fcn.00492c28
add esp, 4
jmp 0x47c426
cmp byte [ebx], 0
je 0x47c2fd
mov esi, ebx
call fcn.004040e0
mov dword [esp + 0x28], eax
push 4
lea eax, [esp + 0x2c]
push eax
push 4
jmp 0x47c22e
push 4
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0
push 4
jmp 0x47c22e
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47c318
sub eax, edx
mov ecx, eax
and ecx, 0x80000001
mov dword [esp + 0x10], eax
jns 0x47c334
dec ecx
or ecx, 0xfffffffe
inc ecx
jne case.0x47c1e0.5
cdq
sub eax, edx
sar eax, 1
push eax
mov dword [esp + 0x18], eax
call fcn.004931f9
mov esi, eax
add esp, 4
test esi, esi
jne 0x47c35a
lea edi, [eax + 0xe]
jmp 0x47c426
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x10], edi
jle 0x47c3b6
cmp ebp, dword [esp + 0x14]
jge 0x47c3b6
xor edx, edx
lea ecx, [edx + 0x10]
nop
mov al, byte [edi + ebx]
cmp al, 0x30
jl 0x47c383
cmp al, 0x39
jg 0x47c383
movsx eax, al
sub eax, 0x30
jmp 0x47c3a1
cmp al, 0x41
jl 0x47c393
cmp al, 0x46
jg 0x47c393
movsx eax, al
sub eax, 0x37
jmp 0x47c3a1
cmp al, 0x61
jl 0x47c3d9
cmp al, 0x66
jg 0x47c3d9
movsx eax, al
sub eax, 0x57
imul eax, ecx
add edx, eax
inc edi
sub ecx, 0xf
jns 0x47c370
mov byte [esi + ebp], dl
inc ebp
cmp edi, dword [esp + 0x10]
jl 0x47c364
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
push ebp
push esi
push 3
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call fcn.00492c28
add esp, 4
jmp 0x47c426
push esi
call fcn.00492c28
mov ecx, dword [esp + 0x28]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x57
mov eax, edi
mov ecx, dword [0x4b7a70]
mov dword [ecx + 0x30], eax
test edi, edi
jne 0x47c43e
mov edx, dword [0x4bbc50]
push 1
push edi
push 0xffffffffffffffff
push 0x4a7950
push edx
call fcn.004828b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov edi, 0x57
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0xffffffff
jne 0x47c3f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x47c3f4
test byte [ecx + 0xe0], 1
jne 0x47c467
mov eax, dword [0x4bbc50]
push 1
push 0
push 0xffffffffffffffff
push 0x4a7dfc
push eax
call fcn.004828b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov ebx, dword [esp + 0x20]
push 0x4a7935
push 0
push 0x4a7dfc
call fcn.0043b050
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10