Function at 0x46e970
Capabilities:
Encode data using base64
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x525303
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
call fcn.0046e4c0
mov eax, dword [0x569c90]
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x18]
mov edi, 1
push ecx
push edi
push ebp
push str.SoftwareClassesCLSID_OBJID.Pro8
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x1d4], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46eaf1
lea edx, [esp + 0x34]
lea eax, [esp + 0x190]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x34]
push eax
push ecx
push ebp
push ebp
push edx
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46eaf1
lea eax, [esp + 0x190]
lea ecx, [esp + 0x10]
push eax
call fcn.00507ec3
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
cmp ecx, ebp
jne 0x46ead1
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], edi
cmp eax, ebp
jne 0x46f3f1
push ebp
push 2
push ebp
lea ecx, [esp + 0x4c]
call fcn.004dc060
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 1
call fcn.00508845
lea edx, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], edx
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 7
call fcn.00510147
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 5
call fcn.00507d3a
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 4
call fcn.00507d3a
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 3
call fcn.00507d3a
mov byte [esp + 0x1c0], 2
jmp 0x46f3d4
xor esi, esi
cmp ecx, ebp
jle 0x46eaf1
mov al, byte [esi + eax]
lea ecx, [esp + 0x10]
dec al
push eax
push esi
call fcn.00508280
mov eax, dword [esp + 0x10]
inc esi
cmp esi, dword [eax - 8]
jl 0x46ead7
lea ecx, [esp + 0x10]
call fcn.005056c4
lea ecx, [esp + 0x10]
call fcn.005055cd
mov eax, dword [esp + 0x10]
cmp dword [eax - 8], ebp
je 0x46f320
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], ebp
push ecx
call fcn.004f2bfb
lea edx, [esp + 0x20]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x44]
push eax
lea edx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x48]
push edx
push eax
push str._lx__x__x__lx__x
push ecx
mov dword [esp + 0x58], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x50], ebp
call fcn.004f2884
add esp, 0x20
cmp eax, 5
jne 0x46f276
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x1c]
cmp ecx, ebp
jge 0x46eb7a
cmp edi, ebp
jl 0x46eb94
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp eax, ebp
jg 0x46eb92
mov esi, dword [esp + 0x20]
cmp esi, ebp
jle 0x46ec78
xor ebp, ebp
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], 1
cmp eax, ebp
jne 0x46ec4f
push ebp
push 2
push ebp
lea ecx, [esp + 0x4c]
call fcn.004dc060
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 8
call fcn.00508845
lea edx, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], edx
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 0xe
call fcn.00510147
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 0xc
call fcn.00507d3a
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 0xb
call fcn.00507d3a
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 0xa
call fcn.00507d3a
lea ecx, [esp + 0xac]
mov byte [esp + 0x1c0], 9
call fcn.00507d3a
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0
call fcn.005084be
mov eax, dword [esp + 0x1c8]
cmp eax, ebp
je 0x46ec60
mov dword [eax], 1
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x46f565
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46f565
mov edx, ebp
sub edx, eax
cmp edx, 0x15180
jle 0x46ec91
test ecx, ecx
jle 0x46ec8d
dec ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], ebp
test edi, edi
jle 0x46ecb4
mov ecx, ebp
mov eax, 0xc22e4507
sub ecx, esi
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, edi
sub eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
test eax, eax
je 0x46ecd1
cmp edi, 0xffffffff
je 0x46ef45
mov eax, dword [esp + 0x30]
test eax, eax
jg 0x46ef45
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], 1
test eax, eax
jne 0x46ef45
test edi, edi
jg 0x46ecf0
mov edi, 0x1e
mov dword [esp + 0x1c], edi
test esi, esi
jne 0x46ed0b
lea edi, [edi + edi*2]
lea eax, [edi + edi*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*8]
shl ecx, 7
sub ebp, ecx
mov esi, ebp
mov dword [esp + 0x20], esi
lea edx, [esp + 0x24]
lea ecx, [esp + 0xdc]
push edx
mov dword [esp + 0x28], esi
call fcn.004e9d28
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
lea eax, [eax + eax*2]
push ecx
lea ecx, [esp + 0xec]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 7
add eax, esi
mov dword [esp + 0x28], eax
call fcn.004e9d28
mov edx, dword [esp + 0x1c]
push 0
push 2
push edx
lea ecx, [esp + 0x100]
call fcn.004dc060
push 0x400
lea eax, [esp + 0x28]
mov bl, 0xf
push 2
push eax
lea ecx, [esp + 0xe8]
mov byte [esp + 0x1cc], bl
mov dword [esp + 0x164], 0
call fcn.004ea103
push eax
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c4], 0x10
call fcn.00507e73
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c0], bl
call fcn.00507d3a
push 0x400
lea ecx, [esp + 0x28]
push 2
push ecx
lea ecx, [esp + 0xf4]
call fcn.004ea103
push eax
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c4], 0x11
call fcn.00507e73
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c0], bl
call fcn.00507d3a
lea ecx, [esp + 0xf4]
call fcn.00508845
cmp eax, 1
jne 0x46eea8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x46ee15
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x178]
mov dword [esp + method.CGdiObject.virtual_0], vtable.CGdiObject.0
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x178]
mov byte [esp + 0x1c0], 0x17
call fcn.00510147
lea ecx, [esp + 0x174]
mov byte [esp + 0x1c0], 0x15
call fcn.00507d3a
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c0], 0x14
call fcn.00507d3a
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c0], 0x13
call fcn.00507d3a
lea ecx, [esp + 0x160]
mov byte [esp + 0x1c0], 0x12
call fcn.00507d3a
lea ecx, [esp + 0xf4]
mov byte [esp + 0x1c0], 0
call fcn.005084be
jmp 0x46f258
lea eax, [esp + 0x178]
mov ebp, vtable.CGdiObject.0
mov dword [esp + 0x24], eax
mov dword [esp + 0x178], ebp
lea ecx, [esp + 0x178]
mov byte [esp + 0x1c0], 0x1d
call fcn.00510147
lea ecx, [esp + 0x174]
mov byte [esp + 0x1c0], 0x1b
call fcn.00507d3a
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c0], 0x1a
call fcn.00507d3a
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c0], 0x19
call fcn.00507d3a
lea ecx, [esp + 0x160]
mov byte [esp + 0x1c0], 0x18
call fcn.00507d3a
lea ecx, [esp + 0xf4]
mov byte [esp + 0x1c0], 0
call fcn.005084be
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
jmp 0x46ef4a
mov ebp, vtable.CGdiObject.0
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x46ef8a
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareClassesCLSID_OBJID.Pro8
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
test eax, eax
je 0x46ef8a
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
inc eax
push edi
push esi
mov dword [esp + 0x44], eax
push eax
mov eax, dword [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0x24]
push str._lx__x__x__lx__x
push ecx
call fcn.005054dc
add esp, 0x1c
lea edx, [esp + 0x10]
lea ecx, [esp + 0x2c]
push edx
call fcn.00507aaf
mov eax, dword [esp + 0x2c]
xor esi, esi
mov byte [esp + 0x1c0], 0x1e
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x46efef
mov al, byte [esi + eax]
lea ecx, [esp + 0x2c]
inc al
push eax
push esi
call fcn.00508280
mov eax, dword [esp + 0x2c]
inc esi
cmp esi, dword [eax - 8]
jl 0x46efd5
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [esp + 0x20]
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 4]
test eax, eax
je 0x46f02e
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c0], 0
call fcn.00507d3a
jmp 0x46f565
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], 0
test eax, eax
jne 0x46f247
mov eax, dword [ebx + 0x3c]
test eax, eax
jne 0x46f247
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xec]
mov dword [esp + 0x18], edx
call fcn.004e9d28
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
lea edx, [esp + 0x14]
lea eax, [eax + eax*2]
push edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*8]
shl ecx, 7
add ecx, edi
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0xe0]
call fcn.004e9d28
mov eax, dword [esp + 0x1c]
push 0
push 1
push eax
lea ecx, [esp + 0x100]
call fcn.004dc060
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
push 0x400
lea eax, [esp + 0x18]
mov bl, 0x1f
mov dword [esp + 0x160], ecx
push 2
push eax
lea ecx, [esp + 0xf4]
mov byte [esp + 0x1cc], bl
mov dword [esp + 0x164], edx
call fcn.004ea103
push eax
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c4], 0x20
call fcn.00507e73
lea ecx, [esp + 0x14]
mov byte [esp + 0x1c0], bl
call fcn.00507d3a
push 0x400
lea ecx, [esp + 0x18]
push 2
push ecx
lea ecx, [esp + 0xe8]
call fcn.004ea103
push eax
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c4], 0x21
call fcn.00507e73
lea ecx, [esp + 0x14]
mov byte [esp + 0x1c0], bl
call fcn.00507d3a
lea ecx, [esp + 0xf4]
call fcn.00508845
cmp eax, 1
jne 0x46f1bd
lea edx, [esp + 0x178]
mov dword [esp + 0x178], ebp
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x178]
mov byte [esp + 0x1c0], 0x27
call fcn.00510147
lea ecx, [esp + 0x174]
mov byte [esp + 0x1c0], 0x25
call fcn.00507d3a
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c0], 0x24
call fcn.00507d3a
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c0], 0x23
call fcn.00507d3a
mov byte [esp + 0x1c0], 0x22
jmp 0x46f227
lea eax, [esp + 0x178]
mov dword [esp + 0x178], ebp
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x178]
mov byte [esp + 0x1c0], 0x2d
call fcn.00510147
lea ecx, [esp + 0x174]
mov byte [esp + 0x1c0], 0x2b
call fcn.00507d3a
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c0], 0x2a
call fcn.00507d3a
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c0], 0x29
call fcn.00507d3a
mov byte [esp + 0x1c0], 0x28
lea ecx, [esp + 0x160]
call fcn.00507d3a
lea ecx, [esp + 0xf4]
mov byte [esp + 0x1c0], 0x1e
call fcn.005084be
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c0], 0
call fcn.00507d3a
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c0], 0xffffffff
call fcn.00507d3a
mov eax, 1
jmp 0x46f57b
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], edi
cmp eax, ebp
jne 0x46f3f1
push ebp
push 2
push ebp
lea ecx, [esp + 0x4c]
call fcn.004dc060
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0x2e
call fcn.00508845
lea edx, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], edx
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 0x34
call fcn.00510147
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 0x32
call fcn.00507d3a
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 0x31
call fcn.00507d3a
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 0x30
call fcn.00507d3a
mov byte [esp + 0x1c0], 0x2f
jmp 0x46f3d4
mov eax, dword [esp + 0x18]
mov dword [ebx + 4], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call fcn.00470ba0
cmp eax, ebp
mov eax, dword [ebx + 0x38]
je 0x46f407
cmp eax, ebp
jne 0x46f3f1
push ebp
push 2
push ebp
lea ecx, [esp + 0x4c]
call fcn.004dc060
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0x35
call fcn.00508845
lea ecx, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 0x3b
call fcn.00510147
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 0x39
call fcn.00507d3a
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 0x38
call fcn.00507d3a
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 0x37
call fcn.00507d3a
mov byte [esp + 0x1c0], 0x36
lea ecx, [esp + 0xac]
call fcn.00507d3a
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0
call fcn.005084be
mov eax, dword [esp + 0x1c8]
cmp eax, ebp
je 0x46f565
mov dword [eax], edi
jmp 0x46f565
cmp eax, ebp
jne 0x46f565
push ebp
push ebp
push ebp
lea ecx, [esp + 0x4c]
call fcn.004dc060
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0x3c
call fcn.00508845
cmp eax, edi
jne 0x46f4da
lea edx, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], edx
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 0x42
call fcn.00510147
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 0x40
call fcn.00507d3a
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 0x3f
call fcn.00507d3a
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 0x3e
call fcn.00507d3a
lea ecx, [esp + 0xac]
mov byte [esp + 0x1c0], 0x3d
call fcn.00507d3a
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0
call fcn.005084be
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c0], 0xffffffff
call fcn.00507d3a
mov eax, edi
jmp 0x46f57b
lea eax, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], eax
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 0x48
call fcn.00510147
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 0x46
call fcn.00507d3a
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 0x45
call fcn.00507d3a
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 0x44
call fcn.00507d3a
lea ecx, [esp + 0xac]
mov byte [esp + 0x1c0], 0x43
call fcn.00507d3a
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0
call fcn.005084be
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c0], 0xffffffff
call fcn.00507d3a
xor eax, eax
mov ecx, dword [esp + 0x1b8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1b4
ret 4