Function at 0x1044af5
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x23c], ebx
cmp dword [0x10742bc], ebx
je 0x1044bc5
call fcn.010418a7
call fcn.01041af8
xor esi, esi
inc esi
mov dword [0x10742c8], esi
cmp dword [0x107289c], ebx
je 0x1044bab
mov ecx, dword [0x10739c8]
cmp ecx, ebx
je 0x1044bab
call fcn.010458b7
test eax, eax
je 0x1044bab
mov ecx, dword [0x10739c8]
push ebx
call fcn.010458b7
mov ecx, eax
call fcn.010485a5
mov ecx, dword [0x10739c8]
test eax, eax
je 0x1044b7a
push ebx
call fcn.010458b7
mov ecx, eax
call fcn.010485a5
jmp 0x1044b86
call fcn.010458b7
mov ecx, eax
call fcn.010484f9
mov ecx, dword [0x10739c8]
push eax
call fcn.010458b7
mov ecx, eax
call fcn.010483d2
mov ecx, dword [0x10739c8]
call fcn.010458b7
mov ecx, eax
call fcn.0104a09e
cmp dword [ebp + 8], ebx
je 0x1044c18
mov ecx, dword [0x10739c8]
cmp ecx, ebx
je 0x1044c12
call fcn.010458b7
test eax, eax
je 0x1044c12
jmp 0x1044bfa
cmp dword [ebp + 8], ebx
je 0x1044c18
cmp dword [0x107289c], ebx
je 0x1044c18
mov ecx, dword [0x10739c8]
cmp ecx, ebx
je 0x1044c18
call fcn.010458b7
test eax, eax
je 0x1044c18
mov ecx, dword [0x10739c8]
xor esi, esi
inc esi
call fcn.010458b7
mov ecx, eax
call fcn.0104a09e
mov ecx, dword [0x10739c8]
call fcn.010458b7
mov ecx, eax
call fcn.0104851f
test eax, eax
je 0x1044c12
xor esi, esi
push esi
call fcn.010456b0
push edi
push ebx
lea eax, [ebp - 0x23c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x1001b38
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1044c96
mov dword [ebp - 0x240], 1
cmp dword [0x107399c], ebx
jne 0x1044c74
push 4
pop edi
cmp dword [ebp + 8], ebx
je 0x1044c88
push edi
lea eax, [ebp - 0x240]
push eax
push edi
push ebx
push 0x10020d0
push dword [ebp - 0x23c]
call esi
jmp 0x1044c88
push 0x10020d0
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 4
pop edi
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1044c99
push 4
pop edi
lea ecx, [ebp - 0x24c]
call fcn.0106e3dd
lea eax, [ebp - 0x24c]
push eax
call fcn.0104192f
test eax, eax
jl 0x1044d49
lea eax, [ebp - 0x23c]
push eax
push 3
push ebx
push dword [ebp - 0x24c]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1044d49
mov dword [ebp - 0x240], 1
cmp dword [0x107399c], ebx
jne 0x1044d07
cmp dword [ebp + 8], ebx
je 0x1044d1d
push edi
lea eax, [ebp - 0x240]
push eax
push edi
push ebx
push 0x10020d0
push dword [ebp - 0x23c]
call esi
jmp 0x1044d18
push 0x10020d0
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp + 8], ebx
jne 0x1044d22
cmp dword [ebp + 0xc], ebx
je 0x1044d37
push edi
push 0x10742a8
push edi
push ebx
push 0x1004708
push dword [ebp - 0x23c]
call esi
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x23c], ebx
cmp dword [ebp + 8], ebx
jne 0x1044d57
cmp dword [ebp + 0xc], ebx
je 0x1044ea9
push ebx
lea eax, [ebp - 0x23c]
push eax
push ebx
push 3
push ebx
push ebx
push ebx
push 0x1001b38
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1044e33
push edi
push 0x1074298
push edi
push ebx
push 0x10046c0
push dword [ebp - 0x23c]
call esi
push 1
push 0x107429c
push 3
push ebx
push 0x10047dc
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742a0
push edi
push ebx
push 0x10046e4
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742a8
push edi
push ebx
push 0x1004708
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742ac
push edi
push ebx
push 0x100474c
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742b0
push edi
push ebx
push 0x100476c
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742b4
push edi
push ebx
push 0x1004794
push dword [ebp - 0x23c]
call esi
push edi
push 0x10742b8
push edi
push ebx
push 0x10047b4
push dword [ebp - 0x23c]
call esi
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x10742c0]
push 0x1004968
call fcn.01056d2e
cmp dword [ebp + 8], ebx
je 0x1044ea9
push 0xa
pop ecx
mov esi, 0x100173c
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp dword [0x10742c8], ebx
je 0x1044ea4
lea eax, [ebp - 0x240]
push eax
push 0x1004ec0
push ebx
push 0x1005784
push ebx
mov dword [ebp - 0x240], ebx
call dword [sym.imp.SHELL32.dll_SHCoCreateInstance]
test eax, eax
jl 0x1044e92
mov eax, dword [ebp - 0x240]
mov ecx, dword [eax]
lea edx, [ebp - 0x30]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x240]
invalid