Function at 0x466cc0
Capabilities:
Delete registry key
Query or enumerate registry key
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2590
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x53f100]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x228]
push eax
mov eax, dword [ebp + 8]
push ecx
xor ebx, ebx
add eax, 0xfffffff0
mov dword [ebp - 0x220], esp
mov esi, esp
push eax
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x240], ebx
call fcn.00425422
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00479060
add esp, 8
cmp eax, ebx
jne 0x466e05
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
push edx
push str.RegDiff_PostScan:_CreateNewFile__s__failed__LE_d
push ecx
call fcn.00478610
add esp, 0x10
call fcn.004654b0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466db6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466dd8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466dfe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x467576
mov edi, dword [ebp - 0x228]
push ebx
lea ecx, [ebp - 0x240]
push ecx
push 4
push 0x504024
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x50107c
call fcn.004cbe7a
add esp, 4
push eax
push 0x50107c
mov ecx, 0x545244
call fcn.004253b1
push ecx
mov edx, esp
mov dword [ebp - 0x220], esp
push ebx
push str.PATHTREE_Initialize__s_
push edx
call fcn.00478610
add esp, 0xc
call fcn.00499470
add esp, 4
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x250], eax
mov eax, 0x5c
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], ebx
mov word [ebp - 0x244], ax
mov dword [ebp - 0x260], ebx
mov dword [0x545230], edi
mov eax, dword [ecx - 0xc]
cmp eax, ebx
je 0x466f76
lea edx, [ebp - 0x274]
push edx
mov esi, 0x545238
call fcn.0047f300
add esp, 4
push ebx
push 0x545234
push esi
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareCameyoPackagerVirtReg
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x466f76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x220], esp
push eax
push str.RegDiff_PostScan:_ExportHive_key_creation_failed__LE_d
push ecx
call fcn.00478610
add esp, 0xc
call fcn.004654b0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x466f23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466f45
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x466dfe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x467576
mov ecx, dword [0x54525c]
mov eax, dword [0x545260]
mov esi, ecx
cmp ecx, eax
jbe 0x466f97
call fcn.004cbff1
mov eax, dword [0x545260]
mov ecx, dword [0x54525c]
mov edx, dword [0x545250]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x238], esi
test eax, eax
ja 0x46713c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x22c], 1
cmp dword [eax - 0xc], ebx
je 0x467504
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x224], esp
mov esi, esp
push eax
call fcn.00425422
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0047bbb0
mov ecx, esp
mov dword [ebp - 0x224], esp
push 0x4ff58c
call fcn.004247e9
push ecx
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x234], esp
push str.AppVirtDll.dll
call fcn.004247e9
push ecx
mov byte [ebp - 4], 7
mov edx, esp
mov dword [ebp - 0x220], esp
push edx
call fcn.004775e0
add esp, 4
lea edi, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00477ed0
mov bl, 8
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x230]
add esp, 8
add eax, 0xfffffff0
mov dword [ebp - 0x224], esp
mov esi, esp
push eax
call fcn.00425422
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 9
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov dword [ebp - 0x234], esp
mov esi, esp
push eax
call fcn.00425422
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x220], esp
push str.SoftwareCameyoPackagerVirtReg
call fcn.004247e9
mov byte [ebp - 4], bl
call fcn.0048c3a0
add esp, 0xc
test eax, eax
jne 0x467407
push ecx
mov dword [ebp - 0x224], esp
mov esi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x224], esp
push str.VirtRegHiveDbg
call fcn.004247e9
push esi
call fcn.00477be0
add esp, 8
call fcn.0047b160
add esp, 4
test eax, eax
je 0x4670ee
mov eax, dword [ebp + 0xc]
push 0
push str.About_to_save
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp + 0xc]
push 0
push 0
push 0
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x224], esp
mov edi, esp
push eax
mov esi, 2
call fcn.00425422
add eax, 0x10
add esp, 4
mov ecx, esi
mov dword [edi], eax
call fcn.004a6370
add esp, 0x10
jmp 0x46743b
mov esi, dword [ebp - 0x238]
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x22c], ebx
cmp edx, ebx
jne 0x46717f
call fcn.004cbff1
xor edx, edx
cmp esi, dword [edx + 0x10]
jb 0x467157
call fcn.004cbff1
mov esi, dword [esi]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub esi, 0x10
call eax
cmp dword [esi + 0xc], ebx
lea ecx, [esi + 0xc]
jl 0x467183
cmp eax, dword [esi]
jne 0x467183
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4671be
mov edx, dword [edx]
jmp 0x46714d
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
cmp edi, ebx
je 0x4673ee
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.004cb905
add esp, 0x10
lea esi, [edi + 0x10]
mov dword [ebp - 0x230], esi
mov byte [ebp - 4], 3
cmp dword [esi - 4], 1
jle 0x4671e6
mov ecx, dword [esi - 0xc]
push ecx
lea ecx, [ebp - 0x230]
call fcn.0042254b
mov esi, dword [ebp - 0x230]
mov edi, 0x545210
lea ebx, [esi + 2]
mov dword [ebp - 0x220], 0
call fcn.004995e0
mov eax, dword [ebp - 0x220]
mov ecx, dword [0x545218]
push 0
push 0
lea edx, [ebp - 0x22c]
push edx
push ebx
push 0
push 0
push eax
push 0
push ecx
push ebx
push edi
mov dword [ebp - 0x22c], 0
call fcn.00499750
mov edx, dword [0x545220]
add esp, 0x2c
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x467268
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov ecx, esp
mov dword [ebp - 0x234], esp
push eax
push str._Lock:_failed_releasing__LE_d
push ecx
call fcn.00478610
add esp, 0xc
call fcn.00499470
add esp, 4
push 0
call fcn.004adf90
add esp, 4
mov dword [ebp - 0x220], eax
test eax, eax
je 0x46733f
push 0
push eax
mov eax, dword [ebp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x234], esp
mov edi, esp
push eax
call fcn.00425422
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 4
mov edi, esp
mov dword [ebp - 0x224], esp
mov dword [ebp - 0x224], edi
call fcn.004bcd4c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4673f3
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 5
test ebx, ebx
je 0x4672f9
test ebx, 0xffff0000
jne 0x4672fd
movzx ebx, bx
push ebx
call fcn.004c4eeb
test eax, eax
je 0x46730f
push ebx
push eax
mov ecx, edi
call fcn.00424e60
jmp 0x46730f
xor eax, eax
jmp 0x467306
push ebx
call fcn.004cbe7a
add esp, 4
push eax
push ebx
mov ecx, edi
call fcn.004253b1
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x260]
push edx
push 0x545210
mov byte [ebp - 4], 3
call fcn.00465d20
mov eax, dword [ebp - 0x220]
add esp, 0x1c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.004cbe5b
add esp, 8
test eax, eax
jl 0x4673fd
cmp eax, dword [esi - 8]
jg 0x4673fd
mov edx, dword [ebp - 0x238]
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x23c]
push edx
push eax
lea ecx, [ebp - 0x270]
push ecx
push 0x545250
call fcn.00463710
mov edi, dword [0x54525c]
cmp edi, dword [0x545260]
jbe 0x467398
call fcn.004cbff1
mov edx, dword [0x545250]
lea eax, [esi - 0x10]
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x238], edi
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4673ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x545260]
sub ecx, dword [0x54525c]
xor ebx, ebx
sar ecx, 2
test ecx, ecx
ja 0x467130
mov edi, dword [ebp - 0x228]
jmp 0x466fb6
call fcn.004265d7
push 0x80004005
call fcn.00422000
push 0x80070057
call fcn.00422000
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0xc]
push ecx
mov ecx, esp
mov dword [ebp - 0x224], esp
push eax
push edx
push str.RegDiff_PostScan:_MyRegSaveKey__s__failed__LE_d
push ecx
call fcn.00478610
add esp, 0x10
call fcn.004654b0
add esp, 4
mov dword [ebp - 0x22c], 0
mov eax, dword [0x545234]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
lea ecx, [ebp - 0x228]
push ecx
push 0x10008
push 0
push str.SoftwareCameyoPackagerVirtReg
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4674de
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, 0x104
mov ecx, dword [ebp - 0x228]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x21c]
push eax
push 0
push ecx
mov dword [ebp - 0x220], edi
call esi
cmp eax, 0x103
je 0x4674c5
test eax, eax
jne 0x4674d5
push eax
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x21c]
push edx
push eax
call fcn.00479750
add esp, 0xc
test eax, eax
je 0x467476
jmp 0x4674d5
push str.SoftwareCameyoPackagerVirtReg
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x228]
push ecx
call ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x467504
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x467527
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46754a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x467570
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004cb516
mov esp, ebp
pop ebp
ret