Function at 0x47bca0
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x814], ecx
mov ecx, dword [ebx + 0x1f8]
lea edx, [ebp - 0x800]
push edx
mov edx, dword [ebx]
or ecx, 0x20019
push ecx
xor esi, esi
push esi
push eax
xor edi, edi
push edx
mov dword [ebp - 0x818], ebx
mov dword [ebp - 0x808], eax
mov dword [ebp - 0x804], edi
mov dword [ebp - 0x810], esi
mov dword [ebp - 0x81c], 0x104
mov dword [ebp - 0x80c], 0x3e8
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47c062
mov ecx, dword [ebx + 0x1f8]
mov edx, dword [ebp - 0x814]
push eax
lea eax, [ebp - 0x824]
push eax
mov eax, dword [ebx]
push edi
or ecx, 0xf003f
push ecx
push edi
push edi
push edi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x47bf7a
lea ecx, [ebp - 0x80c]
push ecx
lea edx, [ebp - 0x7fc]
push edx
lea eax, [ebp - 0x820]
push eax
mov eax, dword [ebp - 0x800]
push edi
lea ecx, [ebp - 0x81c]
push ecx
lea edx, [ebp - 0x414]
push edx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push eax
call edi
test eax, eax
jne 0x47be0f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x804], 1
jmp 0x47bda0
mov ecx, dword [ebp - 0x80c]
mov eax, dword [ebp - 0x820]
push ecx
lea edx, [ebp - 0x7fc]
push edx
mov edx, dword [ebp - 0x824]
push eax
push 0
lea ecx, [ebp - 0x414]
push ecx
push edx
inc esi
call ebx
lea eax, [ebp - 0x80c]
push eax
lea ecx, [ebp - 0x7fc]
push ecx
lea edx, [ebp - 0x820]
push edx
mov edx, dword [ebp - 0x800]
push 0
lea eax, [ebp - 0x81c]
push eax
lea ecx, [ebp - 0x414]
push ecx
push esi
push edx
mov dword [ebp - 0x81c], 0x104
mov dword [ebp - 0x80c], 0x3e8
call edi
test eax, eax
je 0x47bda0
mov ecx, dword [ebp - 0x800]
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x47bf69
lea edx, [ebp - 0x20c]
sub edx, dword [ebp - 0x808]
lea eax, [ebp - 0x310]
sub eax, dword [ebp - 0x814]
mov dword [ebp - 0x82c], edx
mov dword [ebp - 0x828], eax
jmp 0x47be66
mov edx, dword [ebp - 0x82c]
inc dword [ebp - 0x810]
mov eax, dword [ebp - 0x808]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x47be72
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x47be83
mov bx, word [0x5cd28c]
lea eax, [ebp - 0x108]
mov word [edi], bx
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x47bea0
lea edi, [ebp - 0x20c]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47beb2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x814]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edi
mov cl, byte [eax]
mov edx, dword [ebp - 0x828]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x47bed0
lea edi, [ebp - 0x310]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x47bee7
lea eax, [ebp - 0x108]
mov word [edi], bx
mov ecx, eax
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x47bf00
lea edi, [ebp - 0x310]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47bf12
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x310]
push eax
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x818]
call fcn.0047bca0
mov eax, dword [ebp - 0x810]
mov ecx, dword [ebp - 0x800]
push 0x104
lea edx, [ebp - 0x108]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x47be60
mov edx, dword [ebp - 0x824]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call ebx
jmp 0x47bf80
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x800]
push eax
call ebx
mov esi, dword [ebp - 0x804]
test esi, esi
je 0x47c04d
mov ecx, dword [ebp - 0x808]
mov edi, dword [ebp - 0x818]
mov edx, dword [edi]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x47c04d
mov ecx, dword [edi + 0x1f8]
mov edx, dword [ebp - 0x808]
lea eax, [ebp - 0x800]
push eax
or ecx, 0x20019
push ecx
xor esi, esi
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47c034
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x47bff0
mov eax, dword [ebp - 0x800]
push eax
call ebx
push 0x64
call edi
inc esi
cmp esi, 0x64
je 0x47c034
mov edx, dword [ebp - 0x818]
mov eax, dword [edx + 0x1f8]
lea ecx, [ebp - 0x800]
push ecx
mov ecx, dword [ebp - 0x808]
or eax, 0x20019
push eax
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x47bff0
mov eax, dword [ebp - 0x804]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 8