Function at 0x468398
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x840
mov eax, 0x5e685c
call fcn.00470bca
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x84c], edi
call fcn.00404170
mov dword [ebp - 4], edi
mov dword [ebp - 0x838], edi
mov dword [ebp - 0x834], edi
mov dword [ebp - 0x830], edi
call fcn.00453bfa
test al, al
je 0x468424
sub dword [edx - 0x4a30be61], ebp
jb 0x468464
dec eax
mov cl, 0xe9
mov dword [0xd9f232c2], eax
sbb eax, 0xc0bce625
add ah, byte [ecx + 0x1c185ba9]
mov esp, 0xf7d49d8b
invalid
lea eax, [ebp - 0x838]
mov esi, 0x20119
push eax
push esi
push edi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
adc eax, sym.imp.ADVAPI32.dll_RegOpenKeyExW
test eax, eax
je 0x468469
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00452f5f
push edi
push 1
lea ecx, [ebp - 0x828]
call fcn.0041ed70
mov eax, ebx
jmp 0x4686ae
call fcn.00453cc9
test al, al
je 0x468494
dec esi
xchg edx, eax
lodsb al, byte [esi]
mov dword [ecx], ebp
arpl word [eax + edi*2 - 0xa524f7b], dx
imul ebx, dword [edi - 0x49], 0x35
loope 0x46843d
xchg edi, eax
jae 0x468490
xor eax, 0xf7e7f32e
xor byte [ebx], 0xff
mov esi, 0x20119
sbb dword [ecx], eax
add al, byte [eax]
lea eax, [ebp - 0x834]
push eax
push esi
push edi
push dword [ebp - 0x840]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4684d7
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push eax
call fcn.00452f5f
push edi
jmp 0x46869b
lea eax, [ebp - 0x830]
push eax
push esi
push edi
push dword [ebp - 0x844]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x46850e
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
jmp 0x4684bf
call fcn.00453720
test al, al
je 0x468537
mov al, byte [0x861fee2a]
adc byte [ebp + 0x35911718], al
xchg edx, edi
mov al, byte [0x495356ec]
test al, 0x2e
sbb dl, dh
xchg ebx, eax
xchg ebp, eax
mov dword [0x64f86119], eax
pop esi
and ebx, 0xfeb679e8
inc dword [eax + eax*8 - 0x7fb7e18c]
fimul word [edi]
call fcn.00453bb5
test al, al
je 0x46855e
dec eax
sbb dh, 0xf
and dword [0x7b34f606], 0xbfa63b02
jae 0x46858c
cmp ebx, eax
sbb al, 0x1f
inc ecx
xor byte [bp + di - 0x42], bl
and bh, byte [0x68ff3345]
add byte [eax], cl
add byte [eax], al
push 0x800
lea eax, [ebp - 0x810]
push edi
push eax
call fcn.00483520
add esp, 0xc
mov dword [ebp - 0x848], 0x400
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push dword [ebp - 0x83c]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00453834
test al, al
je 0x4685c5
inc edx
fxch st(5)
fimul word [ebp + 0x3761d38]
sti
invalid
call fcn.004537aa
test al, al
je 0x4685e4
idiv byte [ecx + 0x179a5053]
dec edx
in al, 0xf5
and byte [eax], cl
jecxz 0x46861a
ljmp 0xa8fb:0x74d3f06d
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x810]
push eax
call fcn.00491bc7
pop ecx
mov dword [ebp - 0x83c], eax
call fcn.00453b70
test al, al
je 0x468628
invalid
dec eax
stosb byte es:[edi], al
retf
call fcn.004538be
test al, al
je 0x468648
ja 0x46867f
arpl dx, sp
and dh, byte [esi + esi*8]
popal
leave
push ss
cwde
dec edi
sal bl, 1
xor dword [eax + 0x4edeb34c], esi
pop esi
invalid
call fcn.004537aa
test al, al
je 0x468670
jecxz 0x468600
invalid
cmp dword [ebp - 0x83c], 0
mov ecx, dword [ebp - 0x82c]
jne 0x46868d
lea eax, [ebp - 0x828]
push eax
call fcn.00452f5f
jmp 0x468699
lea eax, [ebp - 0x810]
push eax
call fcn.00404170
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041ed70
mov eax, dword [ebp - 0x82c]
call fcn.00470b74
ret