Function at 0x4465d0
Capabilities:
Create directory
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x158
mov eax, dword [0x480630]
xor eax, ebp
mov dword [esp + 0x154], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
cmp edx, eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x14], edx
je 0x4467c3
cmp esi, eax
je 0x4467c3
cmp ecx, eax
je 0x4466ad
mov byte [esp + 0x18], al
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push str.SOFTWARERising_s
push eax
mov dword [esp + 0x20], 1
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x446692
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.installpath
push edx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
pop ebx
mov ecx, dword [esp + 0x154]
xor ecx, ebp
call fcn.004570de
mov esp, ebp
pop ebp
ret
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esp + 0x10], eax
je 0x446867
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x446712
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.SHFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esp + 0x10], eax
je 0x446706
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x446858
push esi
neg edi
sbb edi, edi
push 1
push 0
and edi, 7
add edi, 0x1c
push edi
push 0
call eax
test eax, eax
jl 0x446858
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x446858
mov eax, esi
mov dword [esp + 0xc], 1
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x446750
sub eax, edi
mov edx, ebx
sub edx, eax
dec edx
push edx
push str.Rising
push esi
call fcn.00457cbf
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
mov al, byte [esp + 0x18]
je 0x446788
test al, 0x10
jne 0x4467a0
test al, 0x10
jne 0x446793
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [esp + 0xc], eax
cmp edi, 0xffffffff
je 0x4467ac
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4467d9
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4467c3
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x154]
xor ecx, ebp
call fcn.004570de
mov esp, ebp
pop ebp
ret
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4467e0
sub eax, edx
mov ecx, ebx
sub ecx, eax
dec ecx
push ecx
push 0x4708a4
push esi
call fcn.00457cbf
mov eax, esi
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x446802
mov edx, dword [esp + 0x14]
sub eax, edi
sub ebx, eax
dec ebx
push ebx
push edx
push esi
call fcn.00457cbf
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
mov al, byte [esp + 0x18]
je 0x446838
test al, 0x10
jne 0x44684c
test al, 0x10
jne 0x446843
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp edi, 0xffffffff
je 0x446858
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x446867
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x15c]
pop edi
xor ecx, ebp
pop ebx
call fcn.004570de
mov esp, ebp
pop ebp
ret