Function at 0x46f690
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4a7740]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x230], ecx
mov word [ebp - 0x210], 0
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00453b10
add esp, 0xc
mov ecx, dword [str.SYSTEMCurrentControlSetServicesEventLogApplication_]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.00457230
add esp, 8
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.00457206
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
mov edx, dword [str.SYSTEMCurrentControlSetServicesEventLogApplication_]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46f8f8
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0
push 0x4907e8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46f8ee
mov edx, dword [ebp - 0x214]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x214]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push 0x4907f8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46f8d4
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], 0
jmp 0x46f80d
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.00450f30
add esp, 4
mov edx, dword [ebp - 0x224]
lea eax, [edx + eax*2 + 2]
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
movzx edx, word [ecx]
test edx, edx
je 0x46f8a2
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x224]
push edx
call fcn.004554e9
add esp, 8
test eax, eax
je 0x46f872
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.00457230
add esp, 8
mov edx, dword [ebp - 0x22c]
push edx
call fcn.00450f30
add esp, 4
mov ecx, dword [ebp - 0x22c]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x22c], edx
jmp 0x46f89d
mov dword [ebp - 0x228], 1
mov eax, dword [ebp - 0x224]
push eax
call fcn.00450f30
add esp, 4
lea ecx, [eax + eax + 2]
mov edx, dword [ebp - 0x214]
sub edx, ecx
mov dword [ebp - 0x214], edx
jmp 0x46f7ee
cmp dword [ebp - 0x228], 0
je 0x46f8d4
mov eax, dword [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x218]
push edx
push 0
push str.Sources
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00450ba2
mov esp, ebp
pop ebp
ret