Function at 0x464295
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x204]
push edi
xor edi, edi
mov dword [ebp - 0x21c], edx
push 0x1fe
push edi
push eax
mov ebx, ecx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x20c], edi
mov dword [ebp - 0x208], edi
mov dword [ebp - 0x214], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x210], 7
test ebx, ebx
je 0x46461f
test esi, esi
je 0x46461f
cmp dword [ebp + 0xc], edi
je 0x46461f
push 0x3a
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x4643b1
sub eax, ebx
shr eax, 1
cmp eax, 0xfe
jbe 0x464338
mov eax, 0x80070057
push eax
push 0x1580145
jmp 0x46462a
lea esi, [eax + eax]
push esi
lea eax, [ebp - 0x204]
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp esi, 0x1fe
jae 0x46468d
push 0xffffffffffffffff
push 0x406bb0
xor eax, eax
push 0xffffffffffffffff
mov word [ebp + esi - 0x204], ax
lea eax, [ebp - 0x204]
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec eax
sub eax, 1
je 0x4643ac
push 0xffffffffffffffff
push 0x406bc8
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec eax
sub eax, 1
jne 0x4643e8
mov dword [ebp - 0x210], 0xa
add ebx, 2
add ebx, esi
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4643b6
sub ecx, edx
sar ecx, 1
lea edi, [ecx + 0x3d]
cmp edi, 0x10000
jb 0x464424
mov esi, 0x80070216
push esi
push 0x1760145
call dword [sym.imp.certcli.dll_Ordinal_357]
xor edi, edi
jmp 0x464632
push 0xffffffffffffffff
push 0x406be0
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec eax
sub eax, 1
jne 0x464414
mov dword [ebp - 0x210], 0x13
jmp 0x4643ac
mov eax, 0x80070057
push eax
push 0x16c0145
jmp 0x46462a
lea eax, [edi + edi]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x20c], eax
test eax, eax
jne 0x464447
mov esi, 0x8007000e
push esi
push 0x17d0145
jmp 0x4643db
push 0x4129e8
mov edx, edi
mov ecx, eax
call fcn.0043eb7d
mov esi, eax
test esi, esi
je 0x464466
push esi
push 0x1810145
jmp 0x4643db
mov ecx, dword [ebp - 0x20c]
mov edx, edi
push 0x4050fc
call fcn.0043eadb
mov esi, eax
test esi, esi
je 0x464489
push esi
push 0x1840145
jmp 0x4643db
mov edx, edi
mov edi, dword [ebp - 0x20c]
push ebx
mov ecx, edi
call fcn.0043eadb
mov esi, eax
test esi, esi
je 0x4644aa
push esi
push 0x1870145
jmp 0x4643db
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x208]
push eax
xor eax, eax
push eax
push 0x20006
push eax
push eax
push eax
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jns 0x4644e7
mov ecx, eax
call fcn.004c738c
mov esi, eax
push esi
push 0x1970145
jmp 0x4643db
cmp dword [ebp - 0x214], 2
jne 0x464509
cmp dword [0x518ddc], 0
jne 0x464509
mov esi, 0x1392
push esi
push 0x19d0145
jmp 0x4643db
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp - 0x218]
push 3
push edi
push 0x412a60
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jns 0x464540
mov ecx, eax
call fcn.004c738c
mov esi, eax
push esi
push 0x1ac0145
jmp 0x46462c
mov esi, dword [ebp - 0x21c]
test esi, esi
je 0x4645b5
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46454f
sub ecx, edx
push ecx
push esi
push 1
push edi
push 0x412a78
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jns 0x464586
mov ecx, eax
call fcn.004c738c
mov esi, eax
push esi
push 0x1bd0145
jmp 0x46462c
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push edi
push 0x412a7c
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jns 0x4645b5
mov ecx, eax
call fcn.004c738c
mov esi, eax
push esi
push 0x1cc0145
jmp 0x46462c
cmp dword [ebp + 0x14], edi
je 0x4645e9
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push edi
push 0x412a9c
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jns 0x4645e9
mov ecx, eax
call fcn.004c738c
mov esi, eax
push esi
push 0x1e00145
jmp 0x46462c
push 4
lea eax, [ebp - 0x210]
push eax
push 4
push edi
push 0x412ab0
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jns 0x46461b
mov ecx, eax
call fcn.004c738c
mov esi, eax
push esi
push 0x1f00145
jmp 0x46462c
mov esi, edi
jmp 0x464632
mov eax, 0x80070057
push eax
push 0x14e0145
mov esi, eax
call dword [sym.imp.certcli.dll_Ordinal_357]
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
jns 0x464665
cmp dword [ebp - 0x214], 1
jne 0x464665
cmp dword [ebp - 0x208], 0
je 0x46467a
push edi
push edi
push ebx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov esi, eax
cmp dword [ebp - 0x208], 0
je 0x46467a
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret 0x10
call fcn.0050393c
int3