Function at 0x466000
Capabilities:
Delete registry key
Query or enumerate registry key
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3450
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x541100]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebp + 8]
push ecx
xor ebx, ebx
add eax, 0xfffffff0
mov dword [ebp - 0x220], esp
mov esi, esp
push eax
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x240], ebx
call fcn.00423475
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00478230
add esp, 8
cmp eax, ebx
jne 0x466145
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
push edx
push str.RegDiff_PostScan:_CreateNewFile__s__failed__LE_d
push ecx
call fcn.004777e0
add esp, 0x10
call fcn.004647f0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4660f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466118
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46613e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4668b6
mov edi, dword [ebp - 0x228]
push ebx
lea ecx, [ebp - 0x240]
push ecx
push 4
push 0x5050cc
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x50206c
call fcn.004ccd1a
add esp, 4
push eax
push 0x50206c
mov ecx, 0x547244
call fcn.00423404
push ecx
mov edx, esp
mov dword [ebp - 0x220], esp
push ebx
push str.PATHTREE_Initialize__s_
push edx
call fcn.004777e0
add esp, 0xc
call fcn.00499640
add esp, 4
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x250], eax
mov eax, 0x5c
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], ebx
mov word [ebp - 0x244], ax
mov dword [ebp - 0x260], ebx
mov dword [0x547230], edi
mov eax, dword [ecx - 0xc]
cmp eax, ebx
je 0x4662b6
lea edx, [ebp - 0x274]
push edx
mov esi, 0x547238
call fcn.0047e4e0
add esp, 4
push ebx
push 0x547234
push esi
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareCameyoPackagerVirtReg
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4662b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
push str.RegDiff_PostScan:_ExportHive_key_creation_failed__LE_d
push ecx
call fcn.004777e0
add esp, 0xc
call fcn.004647f0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x466263
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466285
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46613e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4668b6
mov ecx, dword [0x54725c]
mov eax, dword [0x547260]
mov esi, ecx
cmp ecx, eax
jbe 0x4662d7
call fcn.004cce91
mov eax, dword [0x547260]
mov ecx, dword [0x54725c]
mov edx, dword [0x547250]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x238], esi
test eax, eax
ja 0x46647c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x22c], 1
cmp dword [eax - 0xc], ebx
je 0x466844
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x224], esp
mov esi, esp
push eax
call fcn.00423475
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0047ad80
mov ecx, esp
mov dword [ebp - 0x224], esp
push 0x50057c
call fcn.00422827
push ecx
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x234], esp
push str.AppVirtDll.dll
call fcn.00422827
push ecx
mov byte [ebp - 4], 7
mov edx, esp
mov dword [ebp - 0x220], esp
push edx
call fcn.004767b0
add esp, 4
lea edi, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.004770a0
mov bl, 8
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x230]
add esp, 8
add eax, 0xfffffff0
mov dword [ebp - 0x224], esp
mov esi, esp
push eax
call fcn.00423475
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 9
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov dword [ebp - 0x234], esp
mov esi, esp
push eax
call fcn.00423475
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.SoftwareCameyoPackagerVirtReg
call fcn.00422827
mov byte [ebp - 4], bl
call fcn.0048c260
add esp, 0xc
test eax, eax
jne 0x466747
push ecx
mov dword [ebp - 0x224], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x224], esp
push str.VirtRegHiveDbg
call fcn.00422827
push esi
call fcn.00476db0
add esp, 8
call fcn.0047a330
add esp, 4
test eax, eax
je 0x46642e
mov eax, dword [ebp + 0xc]
push 0
push str.About_to_save
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp + 0xc]
push 0
push 0
push 0
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x224], esp
mov edi, esp
push eax
mov esi, 2
call fcn.00423475
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [edi], eax
call fcn.004a6ad0
add esp, 0x10
jmp 0x46677b
mov esi, dword [ebp - 0x238]
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x22c], ebx
cmp edx, ebx
jne 0x4664bf
call fcn.004cce91
xor edx, edx
cmp esi, dword [edx + 0x10]
jb 0x466497
call fcn.004cce91
mov esi, dword [esi]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub esi, 0x10
call eax
cmp dword [esi + 0xc], ebx
lea ecx, [esi + 0xc]
jl 0x4664c3
cmp eax, dword [esi]
jne 0x4664c3
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4664fe
mov edx, dword [edx]
jmp 0x46648d
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
cmp edi, ebx
je 0x46672e
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004cc7a1
add esp, 0x10
lea esi, [edi + 0x10]
mov dword [ebp - 0x230], esi
mov byte [ebp - 4], 3
cmp dword [esi - 4], 1
jle 0x466526
mov ecx, dword [esi - 0xc]
push ecx
lea ecx, [ebp - 0x230]
call fcn.004205a0
mov esi, dword [ebp - 0x230]
mov edi, 0x547210
lea ebx, [esi + 2]
mov dword [ebp - 0x220], 0
call fcn.004997f0
mov eax, dword [ebp - 0x220]
mov ecx, dword [0x547218]
push 0
push 0
lea edx, [ebp - 0x22c]
push edx
push ebx
push 0
push 0
push eax
push 0
push ecx
push ebx
push edi
mov dword [ebp - 0x22c], 0
call fcn.00499960
mov edx, dword [0x547220]
add esp, 0x2c
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x4665a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x234], esp
push eax
push str._Lock:_failed_releasing__LE_d
push ecx
call fcn.004777e0
add esp, 0xc
call fcn.00499640
add esp, 4
push 0
call fcn.004aee20
add esp, 4
mov dword [ebp - 0x220], eax
test eax, eax
je 0x46667f
push 0
push eax
mov eax, dword [ebp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x234], esp
mov edi, esp
push eax
call fcn.00423475
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 4
mov edi, esp
mov dword [ebp - 0x224], esp
mov dword [ebp - 0x224], edi
call fcn.004bdbe3
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x466733
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 5
test ebx, ebx
je 0x466639
test ebx, 0xffff0000
jne 0x46663d
movzx ebx, bx
push ebx
call fcn.004c5d7f
test eax, eax
je 0x46664f
push ebx
push eax
mov ecx, edi
call fcn.00422eb3
jmp 0x46664f
xor eax, eax
jmp 0x466646
push ebx
call fcn.004ccd1a
add esp, 4
push eax
push ebx
mov ecx, edi
call fcn.00423404
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x260]
push edx
push 0x547210
mov byte [ebp - 4], 3
call fcn.00465060
mov eax, dword [ebp - 0x220]
add esp, 0x1c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004cccfb
add esp, 8
test eax, eax
jl 0x46673d
cmp eax, dword [esi - 8]
jg 0x46673d
mov edx, dword [ebp - 0x238]
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x23c]
push edx
push eax
lea ecx, [ebp - 0x270]
push ecx
push 0x547250
call fcn.00462b40
mov edi, dword [0x54725c]
cmp edi, dword [0x547260]
jbe 0x4666d8
call fcn.004cce91
mov edx, dword [0x547250]
lea eax, [esi - 0x10]
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x238], edi
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46670a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x547260]
sub ecx, dword [0x54725c]
xor ebx, ebx
sar ecx, 2
test ecx, ecx
ja 0x466470
mov edi, dword [ebp - 0x228]
jmp 0x4662f6
call fcn.00420595
push 0x80004005
call fcn.00420000
push 0x80070057
call fcn.00420000
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp - 0x224], esp
push eax
push edx
push str.RegDiff_PostScan:_MyRegSaveKey__s__failed__LE_d
push ecx
call fcn.004777e0
add esp, 0x10
call fcn.004647f0
add esp, 4
mov dword [ebp - 0x22c], 0
mov eax, dword [0x547234]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
lea ecx, [ebp - 0x228]
push ecx
push 0x10008
push 0
push str.SoftwareCameyoPackagerVirtReg
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46681e
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, 0x104
mov ecx, dword [ebp - 0x228]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x21c]
push eax
push 0
push ecx
mov dword [ebp - 0x220], edi
call esi
cmp eax, 0x103
je 0x466805
test eax, eax
jne 0x466815
push eax
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x21c]
push edx
push eax
call fcn.00478920
add esp, 0xc
test eax, eax
je 0x4667b6
jmp 0x466815
push str.SoftwareCameyoPackagerVirtReg
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x228]
push ecx
call ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x466844
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466867
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46688a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4668b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cc3b2
mov esp, ebp
pop ebp
ret