Function at 0x46f910
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4a7740]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x228], ecx
mov word [ebp - 0x210], 0
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00453b10
add esp, 0xc
mov ecx, dword [str.SYSTEMCurrentControlSetServicesEventLogApplication_]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.00457230
add esp, 8
mov eax, dword [ebp - 0x228]
mov ecx, dword [eax + 4]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.00457206
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x210]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x46f9f0
mov edx, dword [ebp + 8]
push edx
call fcn.00450f30
add esp, 4
lea eax, [eax + eax + 2]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 2
push 0
push str.EventMessageFile
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push str.TypesSupported
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [str.SYSTEMCurrentControlSetServicesEventLogApplication_]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46fb7b
lea edx, [ebp - 0x214]
push edx
push 0
push 0
push 0
push 0x4907b8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46fb6b
mov ecx, dword [ebp - 0x228]
mov edx, dword [ecx + 4]
push edx
call fcn.00450f30
add esp, 4
mov ecx, dword [ebp - 0x214]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0x220]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
push 0x4907c8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46fb5e
mov edx, dword [ebp - 0x220]
mov dword [ebp - 0x224], edx
jmp 0x46fae1
mov eax, dword [ebp - 0x224]
push eax
call fcn.00450f30
add esp, 4
mov ecx, dword [ebp - 0x224]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x224]
movzx ecx, word [eax]
test ecx, ecx
je 0x46fb0f
mov edx, dword [ebp - 0x228]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.004554e9
add esp, 8
test eax, eax
jne 0x46fb0d
jmp 0x46fb0f
jmp 0x46fac2
mov edx, dword [ebp - 0x224]
movzx eax, word [edx]
test eax, eax
jne 0x46fb5e
mov ecx, dword [ebp - 0x228]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.00457230
add esp, 8
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x220]
push edx
mov eax, dword [ebp - 0x218]
push eax
push 0
push 0x4907d8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 4], 0
je 0x46fb7b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00450ba2
mov esp, ebp
pop ebp
ret 8