Function at 0x4588d0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1df2
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x4f91a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x27c]
call fcn.00409f10
lea eax, [ebp - 0x27c]
mov dword [ebp - 4], 0
push eax
push 2
call fcn.0040d420
add esp, 8
test al, al
je 0x458c33
lea ecx, [ebp - 0x264]
call fcn.00409f10
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x27c]
call fcn.0040a3c0
sub esp, 8
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ecx], str.liebao.dll
mov dword [ecx + 4], 0xa
lea ecx, [ebp - 0x24c]
push ecx
mov ecx, eax
call fcn.0040a8d0
push eax
lea ecx, [ebp - 0x264]
mov byte [ebp - 4], 3
call fcn.00409fd0
lea ecx, [ebp - 0x24c]
call fcn.004065a0
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 1
call fcn.004065a0
lea eax, [ebp - 0x280]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsWindows_Error_ReportingRuntimeExceptionHelperModules
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x458c28
xor ebx, ebx
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x28c]
xor esi, esi
mov byte [ebp - 4], 4
push esi
push esi
push eax
push esi
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x105
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp - 0x280]
call edi
cmp eax, 0x103
je 0x458b16
lea ebx, [ebx]
lea eax, [ebp - 0x21c]
push 0x4d4bf0
push eax
call fcn.004a9299
add esp, 8
test eax, eax
je 0x458aca
xor eax, eax
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x23c], 0
mov word [ebp - 0x24c], ax
cmp word [ebp - 0x21c], ax
je 0x458a7f
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
jmp 0x458a70
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x458a70
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00407070
lea eax, [ebp - 0x24c]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x228]
call fcn.00406340
mov eax, dword [ebp - 0x238]
mov byte [ebp - 4], 4
cmp eax, 8
jb 0x458aca
inc eax
lea ecx, [ebp - 0x24c]
push eax
push dword [ebp - 0x24c]
call fcn.004085f0
push 0
push 0
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x284], 0x105
push eax
push 0
lea eax, [ebp - 0x284]
inc esi
push eax
lea eax, [ebp - 0x21c]
push eax
push esi
push dword [ebp - 0x280]
call edi
cmp eax, 0x103
jne 0x458a20
mov eax, dword [ebp - 0x220]
mov ebx, dword [ebp - 0x228]
mov dword [ebp - 0x288], eax
mov esi, dword [ebp - 0x224]
mov eax, 0x2aaaaaab
mov ecx, esi
sub ecx, ebx
imul ecx
sar edx, 2
mov edi, edx
shr edi, 0x1f
add edi, edx
je 0x458b5c
mov esi, ebx
cmp dword [esi + 0x14], 8
jb 0x458b3f
mov eax, dword [esi]
jmp 0x458b41
mov eax, esi
push eax
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
add esi, 0x18
sub edi, 1
jne 0x458b35
mov esi, dword [ebp - 0x224]
cmp dword [ebp - 0x250], 8
lea ecx, [ebp - 0x290]
push 4
push ecx
push 4
lea eax, [ebp - 0x264]
mov dword [ebp - 0x290], 0
cmovae eax, dword [ebp - 0x264]
push 0
push eax
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x280]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x458c28
push dword [ebp - 0x290]
lea ecx, [ebp - 0x228]
push ecx
push esi
push ebx
call fcn.00409920
mov ecx, dword [ebp - 0x288]
mov eax, 0x2aaaaaab
sub ecx, ebx
add esp, 0x10
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xaaaaaaa
jbe 0x458be4
call fcn.004abee1
lea eax, [eax + eax*2]
shl eax, 3
cmp eax, 0x1000
jb 0x458c1f
test bl, 0x1f
je 0x458bfb
call fcn.004abee1
mov eax, dword [ebx - 4]
cmp eax, ebx
jb 0x458c07
call fcn.004abee1
sub ebx, eax
cmp ebx, 4
jae 0x458c13
call fcn.004abee1
cmp ebx, 0x23
jbe 0x458c1d
call fcn.004abee1
mov ebx, eax
push ebx
call fcn.0046101e
add esp, 4
lea ecx, [ebp - 0x264]
call fcn.004065a0
lea ecx, [ebp - 0x27c]
call fcn.004065a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046100d
mov esp, ebp
pop ebp
ret