Function at 0x4798b0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x604f88
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x6c]
mov edi, edx
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x64], ebx
call fcn.00478e90
test eax, eax
jne 0x47998d
call fcn.00478f30
test eax, eax
jne 0x47998d
lea eax, [esp + 0x18]
push eax
push 0x2001f
push ebx
push esi
push SysReAllocStringLen
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x479937
mov edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jmp 0x479954
push esi
push SysReAllocStringLen
xor edx, edx
lea esi, [esp + 0x1c]
call fcn.00406220
test eax, eax
jne 0x479a7d
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
mov esi, ebp
call fcn.00478e10
cmp edi, ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
je 0x479976
push edi
call ebp
xor edi, edi
xor eax, eax
cmp esi, ebx
sete al
cmp edi, ebx
mov esi, eax
je 0x479986
push edi
call ebp
mov eax, esi
jmp 0x479b04
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
lea ecx, [esp + 0x20]
mov byte [esp + 0x64], 1
call fcn.00478fb0
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x44]
mov byte [esp + 0x6c], 2
call fcn.00404ae0
mov byte [esp + 0x64], 1
cmp dword [esp + 0x38], 8
jb 0x4799d6
mov ecx, dword [esp + 0x24]
push ecx
call fcn.005d2367
add esp, 4
push 1
push 0x62454c
lea ecx, [esp + 0x44]
call fcn.0040a070
mov eax, esi
lea edx, [eax + 2]
jmp 0x4799f0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4799f0
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x44]
call fcn.0040a070
mov eax, dword [esp + 0x40]
mov esi, 8
cmp dword [esp + 0x54], esi
jae 0x479a1d
lea eax, [esp + 0x40]
lea edx, [esp + 0x18]
push edx
push 0x2001f
push ebx
push eax
push reloc.WS2_32.dll_closesocket
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x479a46
mov esi, dword [esp + 0x18]
mov dword [esp + 0x14], esi
jmp 0x479a94
cmp dword [esp + 0x54], esi
mov eax, dword [esp + 0x40]
jae 0x479a54
lea eax, [esp + 0x40]
push eax
push reloc.WS2_32.dll_closesocket
xor edx, edx
lea esi, [esp + 0x1c]
call fcn.00406220
test eax, eax
je 0x479a90
cmp dword [esp + 0x54], 8
jb 0x479a7d
mov eax, dword [esp + 0x40]
push eax
call fcn.005d2367
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x479a8c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x479b04
mov esi, dword [esp + 0x14]
cmp ebp, ebx
jne 0x479aa2
push 0x80004005
call fcn.00403650
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
lea ecx, [eax + eax]
push ecx
push ebp
push 1
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
je 0x479acd
push esi
call ebp
xor esi, esi
xor edx, edx
cmp edi, ebx
sete dl
cmp dword [esp + 0x54], 8
mov edi, edx
jb 0x479aea
mov eax, dword [esp + 0x40]
push eax
call fcn.005d2367
add esp, 4
cmp esi, ebx
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], bx
je 0x479b02
push esi
call ebp
mov eax, edi
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.005d28b3
add esp, 0x54
ret