Function at 0x46fa10
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
mov dword [esp], ecx
push ebx
push ebp
push esi
push edi
test edx, edx
je 0x46fcac
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x46fcac
cmp edi, 0xfffffffe
je 0x46fcac
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
mov eax, dword [0x4ac1d8]
push 0
mov eax, dword [eax + 0xb0]
or eax, 0x20006
push eax
push 0
push 0x49e065
push 0
push dword [esp + 0x40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
test esi, esi
jne 0x46fcb1
dec edi
cmp edi, 6
ja case.0x46fa80.5
jmp dword [edi*4 + 0x46fce0]
mov edx, dword [esp + 0x2c]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46fa90
sub ecx, esi
lea eax, [ecx + 1]
push eax
push edx
push 1
push 0
push dword [esp + 0x38]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x20]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46fcb1
mov edx, dword [esp + 0x2c]
mov ecx, edx
lea esi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46fad0
sub ecx, esi
lea eax, [ecx + 1]
push eax
push edx
push 2
jmp 0x46faa0
mov ebx, dword [esp + 0x2c]
mov esi, ebx
lea ecx, [esi + 1]
jmp 0x46faf0
mov al, byte [esi]
inc esi
test al, al
jne 0x46faf0
sub esi, ecx
lea eax, [esi + 2]
push eax
call fcn.00485a15
mov edi, eax
add esp, 4
test edi, edi
jne 0x46fb1f
push dword [esp + 0x20]
mov esi, 0xe
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46fcb1
push esi
push ebx
push edi
call fcn.00488ae0
add esp, 0xc
mov word [esi + edi], 0
test esi, esi
je 0x46fb40
cmp byte [esi + edi - 1], 0xa
jne 0x46fb40
dec esi
mov byte [esi + edi], 0
cmp byte [edi], 0
mov eax, edi
je 0x46fb55
cmp byte [eax], 0xa
jne 0x46fb4f
mov byte [eax], 0
inc eax
cmp byte [eax], 0
jne 0x46fb47
test esi, esi
je 0x46fb5e
add esi, 2
jmp 0x46fb60
xor esi, esi
push esi
push edi
push 7
push 0
push dword [esp + 0x38]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
mov esi, eax
call fcn.004858b4
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46fcb1
mov ecx, dword [esp + 0x2c]
cmp byte [ecx], 0
je 0x46fbae
call fcn.00414540
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push 4
push eax
push 4
jmp 0x46faa0
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 4
jmp 0x46faa0
mov ebp, dword [esp + 0x2c]
mov edi, ebp
lea ecx, [edi + 1]
lea ecx, [ecx]
mov al, byte [edi]
inc edi
test al, al
jne 0x46fbd0
sub edi, ecx
mov eax, edi
and eax, 0x80000001
jns 0x46fbe7
dec eax
or eax, 0xfffffffe
inc eax
jne case.0x46fa80.5
mov eax, edi
cdq
sub eax, edx
sar eax, 1
push eax
mov dword [esp + 0x28], eax
call fcn.00485a15
add esp, 4
mov dword [esp + 0x2c], eax
test eax, eax
je 0x46fb0b
xor ebx, ebx
xor esi, esi
test edi, edi
jle 0x46fc68
cmp ebx, dword [esp + 0x24]
jge 0x46fc68
xor ecx, ecx
lea edx, [ecx + 0x10]
mov al, byte [esi + ebp]
cmp al, 0x30
jl 0x46fc33
cmp al, 0x39
jg 0x46fc33
movsx eax, al
sub eax, 0x30
jmp 0x46fc51
cmp al, 0x41
jl 0x46fc43
cmp al, 0x46
jg 0x46fc43
movsx eax, al
sub eax, 0x37
jmp 0x46fc51
cmp al, 0x61
jl 0x46fc96
cmp al, 0x66
jg 0x46fc96
movsx eax, al
sub eax, 0x57
imul eax, edx
inc esi
add ecx, eax
sub edx, 0xf
jns 0x46fc20
mov eax, dword [esp + 0x2c]
mov byte [ebx + eax], cl
inc ebx
cmp esi, edi
jl 0x46fc15
push ebx
push eax
push 3
push 0
push dword [esp + 0x38]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x2c]
mov esi, eax
call fcn.004858b4
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46fcb1
push dword [esp + 0x2c]
call fcn.004858b4
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x57
mov ecx, dword [esp + 0x10]
test esi, esi
push esi
setne al
movzx eax, al
push eax
call fcn.0042e020
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x14
push dword [esp + 0x20]
mov esi, 0x57
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46fcb1