Function at 0x4680d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x20010
call fcn.00493680
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [0x4c17f0]
push 0x49e30c
mov esi, edx
call fcn.0046dd60
test edi, edi
je 0x46819e
test esi, esi
je 0x46819e
cmp esi, 0xfffffffe
je 0x46819e
mov edx, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x20006
push 0
push 0x4a596c
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x46819e
lea eax, [esi - 1]
cmp eax, 6
ja case.0x468146.5
jmp dword [eax*4 + 0x4683ac]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x468152
mov ecx, dword [ebp + 0xc]
sub eax, edx
mov edx, dword [esp + 8]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne case.0x468146.5
mov ecx, dword [0x4c17f0]
push 1
push eax
push 0xffffffffffffffff
push 0x49b8d0
call fcn.0046dd60
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4681b0
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push ebx
push 2
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0x14]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4681f1
mov ecx, dword [0x4c17f0]
push 1
push eax
push 0xffffffffffffffff
push 0x49b8d0
call fcn.0046dd60
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0xfffd
lea edx, [esp + 0x1c]
push ebx
push edx
call fcn.00488d24
add esp, 0xc
xor eax, eax
mov word [esp + 0x20012], ax
lea eax, [esp + 0x18]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x468230
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x1a], cx
test eax, eax
je 0x46825a
cmp word [esp + eax*2 + 0x16], 0xa
jne 0x46825a
dec eax
xor edx, edx
mov word [esp + eax*2 + 0x18], dx
cmp word [esp + 0x18], 0
lea ecx, [esp + 0x18]
je 0x46827a
cmp word [ecx], 0xa
jne 0x468271
xor edx, edx
mov word [ecx], dx
add ecx, 2
cmp word [ecx], 0
jne 0x468266
test eax, eax
je 0x468290
add eax, 2
add eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 7
jmp 0x4681c7
xor eax, eax
mov eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 7
jmp 0x4681c7
cmp word [ebx], 0
je 0x4682b4
mov esi, ebx
call fcn.004125b0
mov dword [esp + 0xc], eax
jmp 0x4682bc
mov dword [esp + 0xc], 0
push 4
lea edx, [esp + 0x10]
push edx
push 4
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x14]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4682ef
mov ecx, dword [0x4c17f0]
push 1
push eax
push 0xffffffffffffffff
push 0x49b8d0
call fcn.0046dd60
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x468310
sub eax, edx
sar eax, 1
mov ecx, eax
and ecx, 0x80000001
mov dword [esp + 0x10], eax
jns 0x468332
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x4682ef
xor edi, edi
xor esi, esi
test eax, eax
jle 0x46839d
cmp edi, 0x1fffe
jae 0x46839d
xor edx, edx
lea ecx, [edx + 0x10]
lea esp, [esp]
movzx eax, word [ebx + esi*2]
cmp eax, 0x30
jb 0x468363
cmp eax, 0x39
ja 0x468363
add eax, 0xffffffd0
jmp 0x468387
cmp eax, 0x41
jb 0x468372
cmp eax, 0x46
ja 0x468372
add eax, 0xffffffc9
jmp 0x468387
cmp eax, 0x61
jb 0x4681f1
cmp eax, 0x66
ja 0x4681f1
add eax, 0xffffffa9
imul eax, ecx
add edx, eax
inc esi
sub ecx, 0xf
jns 0x468350
mov byte [esp + edi + 0x18], dl
inc edi
cmp esi, dword [esp + 0x10]
jl 0x46833c
push edi
lea edx, [esp + 0x1c]
push edx
push 3
jmp 0x4682c5