Function at 0x477e80
Capabilities:
Delete registry key
Delete registry value
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67df0b
mov eax, dword fs:[0]
push eax
mov eax, 0x2248
call fcn.0058b400
mov eax, dword [0x78a6d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2224], ecx
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2220], eax
xor eax, eax
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], ebx
mov dword [ebp - 0x2228], eax
push edi
mov dword [ebp - 4], eax
call fcn.00477190
mov esi, eax
test esi, esi
js 0x478893
cmp word [edi], 0x7d
je 0x478880
nop word [eax + eax]
push str.Delete
push edi
mov dword [ebp - 0x2234], 1
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
push 0x703898
sbb esi, esi
inc esi
push edi
mov dword [ebp - 0x2238], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x477f39
test esi, esi
je 0x478042
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.00477190
mov esi, eax
test esi, esi
js 0x478880
cmp dword [ebp + 0x10], 0
je 0x478042
movzx ecx, word [edi]
mov eax, edi
mov dword [ebp - 0x2248], 0
mov dword [ebp - 0x2240], 0
test cx, cx
je 0x477fa1
mov edx, ecx
nop dword [eax]
cmp dx, 0x5c
je 0x477f99
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x477f80
jmp 0x477fa1
test eax, eax
jne 0x478869
mov esi, 0x757be0
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x477ff4
add esi, 4
cmp esi, str.CAppLog::UpdateLogger
jl 0x477fa6
mov eax, dword [ebp - 0x2220]
lea ecx, [ebp - 0x2248]
push edi
mov dword [ebp - 0x2248], eax
mov dword [ebp - 0x2244], 0
call fcn.004768f0
mov dword [ebp - 0x2248], 0
mov dword [ebp - 0x2240], 0
cmp dword [ebp - 0x2238], 0
je 0x478038
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.00477190
mov esi, eax
test esi, esi
js 0x478880
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.00477870
mov esi, eax
test esi, esi
js 0x478880
mov dword [ebp - 0x2244], 0
jmp 0x4784bb
mov dword [ebp - 0x2244], 0
push str.NoRemove
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x47806e
mov ecx, dword [ebp - 0x2224]
push edi
mov dword [ebp - 0x2234], eax
call fcn.00477190
mov esi, eax
test esi, esi
js 0x478880
push 0x703890
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4781c5
mov ecx, dword [ebp - 0x2224]
lea eax, [ebp - 0x2218]
push eax
call fcn.00477190
mov esi, eax
test esi, esi
js 0x478880
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.00477190
mov esi, eax
test esi, esi
js 0x478880
cmp word [edi], 0x3d
jne 0x478869
cmp dword [ebp + 0x10], 0
je 0x47813d
mov eax, dword [ebp - 0x2220]
mov ecx, dword [ebp - 0x2224]
mov byte [ebp - 4], 1
mov dword [ebp - 0x2254], eax
lea eax, [ebp - 0x2218]
push edi
push eax
lea eax, [ebp - 0x2254]
mov dword [ebp - 0x2250], 0
push eax
mov dword [ebp - 0x224c], 0
call fcn.00477340
mov esi, eax
mov dword [ebp - 0x2254], 0
mov dword [ebp - 0x2250], 0
mov dword [ebp - 0x224c], 0
test esi, esi
js 0x478880
mov byte [ebp - 4], 0
mov dword [ebp - 0x2250], 0
jmp 0x4784bb
cmp dword [ebp + 0x14], 0
jne 0x4781aa
cmp dword [ebp - 0x2234], 0
je 0x4781aa
xor ebx, ebx
lea eax, [ebp - 0x2234]
mov dword [ebp - 0x2234], ebx
push eax
push 0x20006
push ebx
push ebx
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x478178
mov ebx, dword [ebp - 0x2234]
mov byte [ebp - 4], 0
test eax, eax
jne 0x478853
lea eax, [ebp - 0x2218]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x47819f
cmp eax, 2
jne 0x478853
test ebx, ebx
je 0x4781aa
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.00477870
mov esi, eax
test esi, esi
js 0x478880
jmp 0x478842
movzx ecx, word [edi]
mov eax, edi
test cx, cx
je 0x4781f2
mov edx, ecx
cmp dx, 0x5c
je 0x4781ea
push eax
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [eax]
mov edx, ecx
test cx, cx
jne 0x4781d1
jmp 0x4781f2
test eax, eax
jne 0x478870
cmp dword [ebp + 0x10], 0
je 0x47850c
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x2228]
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x47827c
cmp dword [esi], 0
je 0x47826f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x478232
mov eax, 1
jmp 0x4782c2
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x478275
mov eax, dword [ebp - 0x2228]
mov ecx, esi
push 0
push dword [eax]
lea eax, [ebp - 0x221c]
push eax
push 0x2001f
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x6926b4]
call esi
jmp 0x478297
cmp dword [esi + 4], 0
jne 0x47827c
mov eax, 1
jmp 0x478297
lea eax, [ebp - 0x221c]
push eax
push 0x2001f
push 0
push edi
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4782bc
test ebx, ebx
je 0x4782a6
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], 0
mov esi, dword [ebp - 0x2228]
mov byte [ebp - 4], 0
test eax, eax
je 0x47847a
mov byte [ebp - 4], 4
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x478348
cmp dword [esi], 0
je 0x47833b
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4782fe
mov eax, 1
jmp 0x47838e
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x478341
mov eax, dword [ebp - 0x2228]
mov ecx, esi
push 0
push dword [eax]
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x6926b4]
call esi
jmp 0x478363
cmp dword [esi + 4], 0
jne 0x478348
mov eax, 1
jmp 0x478363
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x478388
test ebx, ebx
je 0x478372
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], 0
mov esi, dword [ebp - 0x2228]
mov byte [ebp - 4], 0
test eax, eax
je 0x47847a
mov byte [ebp - 4], 5
mov dword [ebp - 0x221c], 0
test esi, esi
je 0x478421
cmp dword [esi], 0
je 0x478414
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4783ca
mov eax, 1
jmp 0x47846e
push str.RegCreateKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x47841a
mov eax, dword [ebp - 0x2228]
mov ecx, esi
push 0
push dword [eax]
lea eax, [ebp - 0x223c]
push eax
lea eax, [ebp - 0x221c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x6926b4]
call esi
jmp 0x478449
cmp dword [esi + 4], 0
jne 0x478421
mov eax, 1
jmp 0x478449
lea eax, [ebp - 0x223c]
push eax
lea eax, [ebp - 0x221c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x47846e
test ebx, ebx
je 0x478458
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], ebx
mov dword [ebp - 0x222c], 0
mov byte [ebp - 4], 0
test eax, eax
jne 0x478877
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.00477190
mov esi, eax
test esi, esi
js 0x478880
cmp word [edi], 0x3d
jne 0x4784bb
mov ecx, dword [ebp - 0x2224]
lea eax, [ebp - 0x2230]
push edi
push 0
push eax
call fcn.00477340
mov esi, eax
test esi, esi
js 0x478880
mov ebx, dword [ebp - 0x2230]
cmp word [edi], 0x7b
jne 0x478842
push edi
call fcn.0059a3bd
add esp, 4
cmp eax, 1
jne 0x478842
push 0
push dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp - 0x2224]
mov ecx, ebx
push edi
call fcn.00477e80
mov esi, eax
test esi, esi
js 0x478880
push edi
mov ecx, ebx
call fcn.00477190
mov esi, eax
test esi, esi
js 0x478880
jmp 0x478842
mov esi, dword [ebp + 0x14]
test esi, esi
jne 0x4785e0
mov byte [ebp - 4], 6
mov ebx, dword [ebp - 0x2228]
mov dword [ebp - 0x221c], esi
test ebx, ebx
je 0x47858d
cmp dword [ebx], esi
je 0x478580
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x478549
lea ebx, [esi + 1]
mov byte [ebp - 4], al
jmp 0x4785e5
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x478586
push 0
push dword [ebx]
lea eax, [ebp - 0x221c]
mov ecx, esi
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x2220]
call dword [0x6926b4]
call esi
jmp 0x4785a8
cmp dword [ebx + 4], 0
jne 0x47858d
mov ebx, 1
jmp 0x4785aa
lea eax, [ebp - 0x221c]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x4785d7
mov eax, dword [ebp - 0x2230]
test eax, eax
je 0x4785c1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov eax, dword [ebp - 0x221c]
mov dword [ebp - 0x2230], eax
mov dword [ebp - 0x222c], 0
mov esi, dword [ebp + 0x14]
mov byte [ebp - 4], 0
jmp 0x4785e5
mov ebx, 2
test ebx, ebx
mov eax, 1
push 0xffffffffffffffff
cmove eax, esi
push edi
mov dword [ebp - 0x221c], eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.005a83bc
push eax
call fcn.004738e0
mov ecx, dword [ebp - 0x2224]
add esp, 0x14
push edi
call fcn.00477190
mov esi, eax
test esi, esi
js 0x478880
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.00477870
mov esi, eax
test esi, esi
js 0x478880
cmp word [edi], 0x7b
jne 0x478696
push edi
call fcn.0059a3bd
add esp, 4
cmp eax, 1
jne 0x478696
push dword [ebp - 0x221c]
mov eax, dword [ebp - 0x2230]
mov ecx, dword [ebp - 0x2224]
push 0
push eax
push edi
call fcn.00477e80
mov esi, eax
test esi, esi
jns 0x478680
cmp dword [ebp - 0x221c], 0
je 0x478880
mov ecx, dword [ebp - 0x2224]
push edi
call fcn.00477190
mov esi, eax
test esi, esi
js 0x478880
cmp ebx, 2
je 0x478842
test ebx, ebx
je 0x4786b4
cmp dword [ebp + 0x14], 0
jne 0x478842
mov ecx, ebx
jmp 0x478879
cmp dword [ebp + 0x14], 0
mov ebx, dword [ebp - 0x2230]
je 0x478730
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x478730
cmp dword [ebp - 0x221c], eax
jbe 0x478730
lea eax, [ebp - 0x218]
push eax
call fcn.00477830
test eax, eax
je 0x478842
cmp dword [ebp - 0x2234], 0
je 0x478842
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2230]
call fcn.004768f0
jmp 0x478842
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x221c]
mov dword [ebp - 0x221c], 0
push eax
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x47876c
mov dword [ebp - 0x2238], 0
jmp 0x47877e
xor eax, eax
cmp eax, dword [ebp - 0x221c]
sbb eax, eax
neg eax
mov dword [ebp - 0x2238], eax
xor eax, eax
test ebx, ebx
je 0x478795
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2230], 0
mov dword [ebp - 0x222c], 0
test eax, eax
jne 0x478877
cmp dword [ebp - 0x2234], eax
je 0x478842
cmp dword [ebp - 0x2238], eax
jne 0x478842
mov byte [ebp - 4], 7
cmp byte [0x7962f0], al
jne 0x478806
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4787f7
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov byte [0x7962f0], 1
mov dword [0x7962f4], ebx
jmp 0x47880c
mov ebx, dword [0x7962f4]
mov byte [0x7962f0], 1
jmp 0x47880c
mov ebx, dword [0x7962f4]
lea eax, [ebp - 0x218]
test ebx, ebx
je 0x47882d
push 0
push 0
push eax
push dword [ebp - 0x2220]
mov ecx, ebx
call dword [0x6926b4]
call ebx
jmp 0x47883a
push eax
push dword [ebp - 0x2220]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov byte [ebp - 4], 0
test eax, eax
jne 0x478877
cmp word [edi], 0x7d
je 0x478880
mov ebx, dword [ebp - 0x2230]
jmp 0x477f00
mov ecx, eax
call fcn.00476550
mov esi, eax
test ebx, ebx
je 0x478880
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x478880
mov esi, 0x80020009
jmp 0x478886
mov esi, 0x80020009
jmp 0x478880
mov ecx, eax
call fcn.00476550
mov esi, eax
mov ebx, dword [ebp - 0x2230]
test ebx, ebx
je 0x478891
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0058a893
mov esp, ebp
pop ebp
ret 0x10