Function at 0x463dc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x463dc8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4640df
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp + 8]
call fcn.00404d3c
lea eax, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
call fcn.00404d3c
lea eax, [ebp - 0x10]
mov edx, dword [ebp + 0x10]
call fcn.00404d3c
lea eax, [ebp - 0x14]
mov edx, dword [ebp + 0x14]
call fcn.00404d3c
mov edx, 0x4640fc
mov eax, dword [ebp - 8]
call fcn.00408cdc
test eax, eax
jne 0x463f5b
call sym.ExApiDll.dll_WinIs64BitOS
mov word [ebp - 0x22], ax
cmp word [ebp - 0x22], 1
jne 0x463e46
mov ecx, 0xf013f
mov dl, 1
mov eax, dword [0x42db24]
call fcn.0042dc68
mov ebx, eax
jmp 0x463e54
mov dl, 1
mov eax, dword [0x42db24]
call fcn.0042dc24
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0042dd00
xor ecx, ecx
mov edx, 0x464108
mov eax, ebx
call fcn.0042dd68
test al, al
je 0x463f14
mov dl, 1
mov eax, dword [0x416494]
call fcn.00403d1c
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042e30c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x463f07
inc eax
mov dword [ebp - 0x28], eax
xor esi, esi
lea ecx, [ebp - 0x2c]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.0042e6b4
test al, al
je 0x463f01
lea ecx, [ebp - 0x30]
mov edx, esi
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x30]
lea ecx, [ebp - 0x18]
mov eax, ebx
call fcn.0042e4a4
push dword [ebp - 0x1c]
push 0x464128
push dword [ebp - 0x18]
push 0x464138
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00404ec4
lea eax, [ebp - 0x1c]
mov edx, 0x464138
call fcn.00404e0c
inc esi
dec dword [ebp - 0x28]
jne 0x463ea2
lea eax, [ebp - 0x1c]
mov edx, 0x464138
call fcn.00404e0c
mov eax, ebx
call fcn.0042dcd0
xor ecx, ecx
mov edx, 0x464144
mov eax, ebx
call fcn.0042dd68
test al, al
je 0x463f54
mov eax, dword [ebp - 0x1c]
call fcn.00404e04
push eax
lea eax, [ebp - 0x1c]
call fcn.0040505c
push eax
push 7
push 0
push 0x464178
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 0x20], eax
mov eax, ebx
call fcn.0042dcd0
mov edx, 0x46419c
mov eax, dword [ebp - 8]
call fcn.00408cdc
test eax, eax
jne 0x4640b4
cmp word [ebp - 0x22], 1
jne 0x463f8c
mov ecx, 0xf013f
mov dl, 1
mov eax, dword [0x42db24]
call fcn.0042dc68
mov ebx, eax
jmp 0x463f9a
mov dl, 1
mov eax, dword [0x42db24]
call fcn.0042dc24
mov ebx, eax
mov edx, 0x4641a8
mov eax, dword [ebp - 0xc]
call fcn.00408cdc
test eax, eax
jne 0x463fb7
mov edx, BaseThreadInitThunk
mov eax, ebx
call fcn.0042dd00
mov edx, 0x4641c4
mov eax, dword [ebp - 0xc]
call fcn.00408cdc
test eax, eax
jne 0x463fd4
mov edx, reloc.kernel32.dll_BaseThreadInitThunk
mov eax, ebx
call fcn.0042dd00
mov edx, 0x4641e0
mov eax, dword [ebp - 0xc]
call fcn.00408cdc
test eax, eax
jne 0x463ff1
mov edx, 0x80000002
mov eax, ebx
call fcn.0042dd00
mov edx, 0x4641fc
mov eax, dword [ebp - 0xc]
call fcn.00408cdc
test eax, eax
jne 0x46400e
mov edx, 0x80000003
mov eax, ebx
call fcn.0042dd00
mov edx, 0x464210
mov eax, dword [ebp - 0xc]
call fcn.00408cdc
test eax, eax
jne 0x46402b
mov edx, 0x80000004
mov eax, ebx
call fcn.0042dd00
mov edx, 0x464230
mov eax, dword [ebp - 0xc]
call fcn.00408cdc
test eax, eax
jne 0x464048
mov edx, 0x80000005
mov eax, ebx
call fcn.0042dd00
mov edx, 0x46424c
mov eax, dword [ebp - 0xc]
call fcn.00408cdc
test eax, eax
jne 0x464065
mov edx, 0x80000006
mov eax, ebx
call fcn.0042dd00
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0042dd68
test al, al
je 0x464082
lea eax, [ebp - 0x1c]
mov edx, 0x464138
call fcn.00404e0c
mov eax, dword [ebp - 0x1c]
call fcn.00404e04
push eax
lea eax, [ebp - 0x1c]
call fcn.0040505c
push eax
push 7
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405004
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 0x20], eax
mov eax, ebx
call fcn.0042dcd0
mov ebx, dword [ebp - 0x20]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4640e6
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00404b68
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00404b68
ret