Function at 0x46be80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2003c
call fcn.00493810
push ebx
push esi
push edi
mov edi, dword [0x4c1e48]
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
push 0
mov ecx, edi
mov dword [esp + 0x28], edi
call fcn.00471d60
test esi, esi
jne 0x46bebc
mov esi, 0x57
jmp 0x46c1f4
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x46c1f4
mov ecx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push eax
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
call ebx
mov esi, eax
test esi, esi
je 0x46bf0c
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46c1f4
mov eax, dword [esp + 0x1c]
dec eax
cmp eax, 6
ja case.0x46bf1a.5
jmp dword [eax*4 + 0x46c218]
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push edx
push eax
mov dword [esp + 0x28], 4
call ebx
mov esi, eax
test esi, esi
jne 0x46c1f4
mov ecx, dword [esp + 0x20]
push 0x18
push eax
push ecx
mov eax, edi
call fcn.004010e0
jmp 0x46c1f4
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0
push eax
push ecx
mov dword [esp + 0x28], 0
call ebx
mov esi, eax
test esi, esi
jne 0x46c0c3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x46c0c3
push 1
shr eax, 1
push esi
add eax, 2
push eax
push esi
mov ecx, edi
call fcn.00471d60
cmp eax, 1
je 0x46bfc0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [edi + 0x17], 0
jne 0x46bfcb
mov esi, dword [edi + 0xc]
jmp 0x46bfcd
mov esi, edi
test byte [esi + 0x15], 8
je 0x46bfda
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x46bff3
test byte [esi + 0x15], 4
je 0x46bfee
mov eax, esi
call fcn.0042f660
mov edi, dword [esi + 8]
jmp 0x46c005
cmp al, 2
jne 0x46c000
call fcn.00401000
mov edi, eax
jmp 0x46c005
mov edi, 0x4c3fa8
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push ecx
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x46c05d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x46c05d
shr eax, 1
xor ecx, ecx
mov dword [edi + eax*2], ecx
cmp dword [esp + 0x1c], 7
jne 0x46c062
mov eax, edi
cmp word [eax], 0
jne 0x46c058
cmp word [eax + 2], 0
mov ecx, 0xa
mov word [eax], cx
je 0x46c062
add eax, 2
jmp 0x46c043
xor edx, edx
mov word [edi], dx
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46c067
mov ebx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, ebx
call fcn.00412c60
cmp byte [ebx + 0x17], 0
jne 0x46c08e
mov eax, dword [ebx + 0xc]
jmp 0x46c090
mov eax, ebx
cmp byte [eax + 0x17], 2
jne 0x46c0ba
cmp dword [0x4c4b0c], 0
je 0x46c0ba
mov ecx, 0x4c4b00
call fcn.00403cd0
test eax, eax
jne 0x46c1f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
and byte [eax + 0x15], 0x86
jmp 0x46c1f4
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46c1f4
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push eax
push ecx
mov dword [esp + 0x28], 0x1fffe
call ebx
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x46c1f4
mov eax, dword [esp + 0x10]
push 1
push esi
lea ecx, [eax + eax]
push ecx
push esi
mov ecx, edi
call fcn.00471d60
cmp eax, 1
jne 0x46bfb5
cmp byte [edi + 0x17], 0
jne 0x46c130
mov esi, dword [edi + 0xc]
jmp 0x46c132
mov esi, edi
test byte [esi + 0x15], 8
je 0x46c13f
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x46c158
test byte [esi + 0x15], 4
je 0x46c153
mov eax, esi
call fcn.0042f660
mov eax, dword [esi + 8]
jmp 0x46c168
cmp al, 2
jne 0x46c163
call fcn.00401000
jmp 0x46c168
mov eax, 0x4c3fa8
xor edx, edx
mov word [eax], dx
mov ecx, 8
mov esi, str.0123456789ABCDEF
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
cmp dword [esp + 0x10], edx
jbe 0x46c1bd
jmp 0x46c190
movzx ecx, byte [esp + esi + 0x48]
mov edi, ecx
shr ecx, 4
and edi, 0xf
mov di, word [esp + edi*2 + 0x24]
and ecx, 0xf
mov cx, word [esp + ecx*2 + 0x24]
mov word [eax + edx*2 + 2], di
mov word [eax + edx*2], cx
inc esi
add edx, 2
cmp esi, dword [esp + 0x10]
jb 0x46c190
xor ecx, ecx
mov word [eax + edx*2], cx
mov eax, dword [esp + 0x18]
cmp byte [eax + 0x17], cl
jne 0x46c1cf
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x17], 2
jne 0x46c210
cmp dword [0x4c4b0c], ecx
je 0x46c210
mov ecx, 0x4c4b00
call fcn.00403cd0
test eax, eax
je 0x46bfb5
mov esi, 0x65e
mov ecx, dword [ebp + 8]
test esi, esi
setne dl
movzx eax, dl
push esi
push eax
push ecx
call fcn.0042eda0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
and byte [eax + 0x15], 0x86
jmp case.0x46bf1a.5