Function at 0x46635c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call fcn.00452603
test al, al
je 0x46638f
adc eax, 0x367abba8
sbb esp, ebp
lcall 0xdda3, 0xbf96ab01
sbb eax, 0xe1ade924
call fcn.00452579
test al, al
je 0x4663b3
or esi, esi
loope 0x4663cc
or bl, bh
xchg dword [ecx], ecx
invalid
call fcn.00452534
test al, al
je 0x4663d5
imul ecx, dword ds:[ecx + 0x4b], 0xfffffff5
sbb eax, 0x357f41b3
retf
inc esi
in eax, 0x66
and edx, ecx
lock and byte [ecx], ch
pop ebx
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push dword [ebp + 0xc]
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4665bf
call fcn.00452465
test al, al
je 0x466411
shr ebx, cl
lea edi, [esi + 0x5a71c012]
nop
jb 0x46640e
cmp cl, byte [edx - 0x572aa8b9]
aad 0xa8
call fcn.00452129
call fcn.00452129
test al, al
je 0x466435
fcmovnb st(0), st(7)
fsub dword [edx + 0x76]
mov edi, 0x5b405157
jae 0x46643d
movsb byte es:[edi], byte [esi]
sbb eax, 0xb09e57be
in al, dx
jae 0x46649b
movsd dword es:[edi], dword [esi]
inc ebp
or eax, 0xe8b0de6d
out dx, eax
mov esp, 0xc084fffe
call fcn.00452129
test al, al
je 0x466459
sbb edx, dword [esi + 0x6cc7f1d0]
invalid
xchg esi, eax
sal cl, 1
invalid
lea eax, [ebp - 8]
mov ebx, 0xf013f
push eax
push ebx
xor edi, edi
push edi
push str.SoftWare
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x466486
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4665bf
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4664b5
add byte [ebp - 0x74ea8b40], al
xor eax, sym.imp.ADVAPI32.dll_RegCloseKey
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call esi
push dword [ebp - 4]
call esi
jmp 0x4665bf
call fcn.0045216e
test al, al
je 0x4664d1
push cs
jmp 0x4664df
call fcn.004520e4
test al, al
je 0x4664f0
sub dword [esi], eax
retf
iretd
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0xf013f
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x46651b
push dword [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x4664a6
push dword [ebp + 0x18]
call fcn.0048ece7
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x18]
push 1
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0xc]
call edi
call fcn.004524aa
test al, al
je 0x466567
xor cl, ah
test dword [edi + 0x1b], esp
jae 0x4665d9
test al, 0x86
push 0x7cc70642
call 0xbcd34deb
invalid
call fcn.004521f8
test al, al
je 0x466587
adc eax, 0x1f36d76b
in eax, dx
wait
add eax, 0x3f7ad5f8
mov dword [0x2367d518], eax
cmpsd dword [esi], dword es:[edi]
into
sbb dl, byte [ebp + esi*2 - 0x44a7171c]
invalid
call fcn.004520e4
test al, al
je 0x4665b5
call 0xe44d56dc
iretd
push dword [ebp - 8]
call edi
push dword [ebp - 4]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cld