Function at 0x46d150
Capabilities:
Encode data using base64
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x56a233
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
call fcn.0046cca0
mov eax, dword [0x5d2d10]
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c0], ebp
push ecx
push 0xf003f
push ebp
push str.SoftwareClassesCLSID_OBJID.Pro7
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, 1
jne 0x46d2d5
lea edx, [esp + 0x34]
lea eax, [esp + 0x190]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x34]
push eax
push ecx
push ebp
push ebp
push edx
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46d2d5
lea eax, [esp + 0x190]
lea ecx, [esp + 0x10]
push eax
call fcn.00530d18
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
cmp ecx, ebp
jne 0x46d2b5
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 0x34]
mov dword [ebx + 4], edi
cmp eax, ebp
jne 0x46dbd5
push ebp
push 2
push ebp
lea ecx, [esp + 0x4c]
call fcn.00476f20
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 1
call fcn.00532ba8
lea edx, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], edx
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 7
call fcn.0053664f
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 5
call fcn.00530b8f
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 4
call fcn.00530b8f
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 3
call fcn.00530b8f
mov byte [esp + 0x1c0], 2
jmp 0x46dbb8
xor esi, esi
cmp ecx, ebp
jle 0x46d2d5
mov al, byte [esi + eax]
lea ecx, [esp + 0x10]
dec al
push eax
push esi
call fcn.005310d5
mov eax, dword [esp + 0x10]
inc esi
cmp esi, dword [eax - 8]
jl 0x46d2bb
lea ecx, [esp + 0x10]
call fcn.00528a0b
lea ecx, [esp + 0x10]
call fcn.00528914
mov eax, dword [esp + 0x10]
cmp dword [eax - 8], ebp
je 0x46db04
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], ebp
push ecx
call fcn.00515905
lea edx, [esp + 0x20]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x44]
push eax
lea edx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x48]
push edx
push eax
push str._lx__x__x__lx__x
push ecx
mov dword [esp + 0x58], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x50], ebp
call fcn.00515758
add esp, 0x20
cmp eax, 5
jne 0x46da5a
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x1c]
cmp ecx, ebp
jge 0x46d35e
cmp edi, ebp
jl 0x46d378
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp eax, ebp
jg 0x46d376
mov esi, dword [esp + 0x20]
cmp esi, ebp
jle 0x46d45c
xor ebp, ebp
mov eax, dword [ebx + 0x34]
mov dword [ebx + 4], 1
cmp eax, ebp
jne 0x46d433
push ebp
push 2
push ebp
lea ecx, [esp + 0x4c]
call fcn.00476f20
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 8
call fcn.00532ba8
lea edx, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], edx
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 0xe
call fcn.0053664f
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 0xc
call fcn.00530b8f
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 0xb
call fcn.00530b8f
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 0xa
call fcn.00530b8f
lea ecx, [esp + 0xac]
mov byte [esp + 0x1c0], 9
call fcn.00530b8f
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0
call fcn.005327a5
mov eax, dword [esp + 0x1c8]
cmp eax, ebp
je 0x46d444
mov dword [eax], 1
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x46dd49
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46dd49
mov edx, ebp
sub edx, eax
cmp edx, 0x15180
jle 0x46d475
test ecx, ecx
jle 0x46d471
dec ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], ebp
test edi, edi
jle 0x46d498
mov ecx, ebp
mov eax, 0xc22e4507
sub ecx, esi
imul ecx
add edx, ecx
sar edx, 0x10
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, edi
sub eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
test eax, eax
je 0x46d4b5
cmp edi, 0xffffffff
je 0x46d729
mov eax, dword [esp + 0x30]
test eax, eax
jg 0x46d729
mov eax, dword [ebx + 0x34]
mov dword [ebx + 4], 1
test eax, eax
jne 0x46d729
test edi, edi
jg 0x46d4d4
mov edi, 0x1e
mov dword [esp + 0x1c], edi
test esi, esi
jne 0x46d4ef
lea edi, [edi + edi*2]
lea eax, [edi + edi*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*8]
shl ecx, 7
sub ebp, ecx
mov esi, ebp
mov dword [esp + 0x20], esi
lea edx, [esp + 0x24]
lea ecx, [esp + 0xdc]
push edx
mov dword [esp + 0x28], esi
call fcn.0050bc6c
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x24]
lea eax, [eax + eax*2]
push ecx
lea ecx, [esp + 0xec]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 7
add eax, esi
mov dword [esp + 0x28], eax
call fcn.0050bc6c
mov edx, dword [esp + 0x1c]
push 0
push 2
push edx
lea ecx, [esp + 0x100]
call fcn.00476f20
push 0x400
lea eax, [esp + 0x28]
mov bl, 0xf
push 2
push eax
lea ecx, [esp + 0xe8]
mov byte [esp + 0x1cc], bl
mov dword [esp + 0x164], 0
call fcn.0050beca
push eax
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c4], 0x10
call fcn.00530cc8
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c0], bl
call fcn.00530b8f
push 0x400
lea ecx, [esp + 0x28]
push 2
push ecx
lea ecx, [esp + 0xf4]
call fcn.0050beca
push eax
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c4], 0x11
call fcn.00530cc8
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c0], bl
call fcn.00530b8f
lea ecx, [esp + 0xf4]
call fcn.00532ba8
cmp eax, 1
jne 0x46d68c
mov eax, dword [esp + 0x18]
test eax, eax
je 0x46d5f9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x178]
mov dword [esp + method.CGdiObject.virtual_0], vtable.CGdiObject.0
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x178]
mov byte [esp + 0x1c0], 0x17
call fcn.0053664f
lea ecx, [esp + 0x174]
mov byte [esp + 0x1c0], 0x15
call fcn.00530b8f
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c0], 0x14
call fcn.00530b8f
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c0], 0x13
call fcn.00530b8f
lea ecx, [esp + 0x160]
mov byte [esp + 0x1c0], 0x12
call fcn.00530b8f
lea ecx, [esp + 0xf4]
mov byte [esp + 0x1c0], 0
call fcn.005327a5
jmp 0x46da3c
lea eax, [esp + 0x178]
mov ebp, vtable.CGdiObject.0
mov dword [esp + 0x24], eax
mov dword [esp + 0x178], ebp
lea ecx, [esp + 0x178]
mov byte [esp + 0x1c0], 0x1d
call fcn.0053664f
lea ecx, [esp + 0x174]
mov byte [esp + 0x1c0], 0x1b
call fcn.00530b8f
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c0], 0x1a
call fcn.00530b8f
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c0], 0x19
call fcn.00530b8f
lea ecx, [esp + 0x160]
mov byte [esp + 0x1c0], 0x18
call fcn.00530b8f
lea ecx, [esp + 0xf4]
mov byte [esp + 0x1c0], 0
call fcn.005327a5
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
jmp 0x46d72e
mov ebp, vtable.CGdiObject.0
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x46d76e
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareClassesCLSID_OBJID.Pro7
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
test eax, eax
je 0x46d76e
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
inc eax
push edi
push esi
mov dword [esp + 0x44], eax
push eax
mov eax, dword [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0x24]
push str._lx__x__x__lx__x
push ecx
call fcn.00528823
add esp, 0x1c
lea edx, [esp + 0x10]
lea ecx, [esp + 0x2c]
push edx
call fcn.00530904
mov eax, dword [esp + 0x2c]
xor esi, esi
mov byte [esp + 0x1c0], 0x1e
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x46d7d3
mov al, byte [esi + eax]
lea ecx, [esp + 0x2c]
inc al
push eax
push esi
call fcn.005310d5
mov eax, dword [esp + 0x2c]
inc esi
cmp esi, dword [eax - 8]
jl 0x46d7b9
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [esp + 0x20]
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 4]
test eax, eax
je 0x46d812
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c0], 0
call fcn.00530b8f
jmp 0x46dd49
mov eax, dword [ebx + 0x34]
mov dword [ebx + 4], 0
test eax, eax
jne 0x46da2b
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x46da2b
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xec]
mov dword [esp + 0x18], edx
call fcn.0050bc6c
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
lea edx, [esp + 0x14]
lea eax, [eax + eax*2]
push edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*8]
shl ecx, 7
add ecx, edi
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0xe0]
call fcn.0050bc6c
mov eax, dword [esp + 0x1c]
push 0
push 1
push eax
lea ecx, [esp + 0x100]
call fcn.00476f20
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
push 0x400
lea eax, [esp + 0x18]
mov bl, 0x1f
mov dword [esp + 0x160], ecx
push 2
push eax
lea ecx, [esp + 0xf4]
mov byte [esp + 0x1cc], bl
mov dword [esp + 0x164], edx
call fcn.0050beca
push eax
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c4], 0x20
call fcn.00530cc8
lea ecx, [esp + 0x14]
mov byte [esp + 0x1c0], bl
call fcn.00530b8f
push 0x400
lea ecx, [esp + 0x18]
push 2
push ecx
lea ecx, [esp + 0xe8]
call fcn.0050beca
push eax
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c4], 0x21
call fcn.00530cc8
lea ecx, [esp + 0x14]
mov byte [esp + 0x1c0], bl
call fcn.00530b8f
lea ecx, [esp + 0xf4]
call fcn.00532ba8
cmp eax, 1
jne 0x46d9a1
lea edx, [esp + 0x178]
mov dword [esp + 0x178], ebp
mov dword [esp + 0x14], edx
lea ecx, [esp + 0x178]
mov byte [esp + 0x1c0], 0x27
call fcn.0053664f
lea ecx, [esp + 0x174]
mov byte [esp + 0x1c0], 0x25
call fcn.00530b8f
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c0], 0x24
call fcn.00530b8f
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c0], 0x23
call fcn.00530b8f
mov byte [esp + 0x1c0], 0x22
jmp 0x46da0b
lea eax, [esp + 0x178]
mov dword [esp + 0x178], ebp
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x178]
mov byte [esp + 0x1c0], 0x2d
call fcn.0053664f
lea ecx, [esp + 0x174]
mov byte [esp + 0x1c0], 0x2b
call fcn.00530b8f
lea ecx, [esp + 0x168]
mov byte [esp + 0x1c0], 0x2a
call fcn.00530b8f
lea ecx, [esp + 0x164]
mov byte [esp + 0x1c0], 0x29
call fcn.00530b8f
mov byte [esp + 0x1c0], 0x28
lea ecx, [esp + 0x160]
call fcn.00530b8f
lea ecx, [esp + 0xf4]
mov byte [esp + 0x1c0], 0x1e
call fcn.005327a5
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c0], 0
call fcn.00530b8f
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c0], 0xffffffff
call fcn.00530b8f
mov eax, 1
jmp 0x46dd5f
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 0x34]
mov dword [ebx + 4], edi
cmp eax, ebp
jne 0x46dbd5
push ebp
push 2
push ebp
lea ecx, [esp + 0x4c]
call fcn.00476f20
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0x2e
call fcn.00532ba8
lea edx, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], edx
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 0x34
call fcn.0053664f
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 0x32
call fcn.00530b8f
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 0x31
call fcn.00530b8f
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 0x30
call fcn.00530b8f
mov byte [esp + 0x1c0], 0x2f
jmp 0x46dbb8
mov eax, dword [esp + 0x18]
mov dword [ebx + 4], edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call fcn.0046f750
cmp eax, ebp
mov eax, dword [ebx + 0x34]
je 0x46dbeb
cmp eax, ebp
jne 0x46dbd5
push ebp
push 2
push ebp
lea ecx, [esp + 0x4c]
call fcn.00476f20
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0x35
call fcn.00532ba8
lea ecx, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 0x3b
call fcn.0053664f
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 0x39
call fcn.00530b8f
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 0x38
call fcn.00530b8f
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 0x37
call fcn.00530b8f
mov byte [esp + 0x1c0], 0x36
lea ecx, [esp + 0xac]
call fcn.00530b8f
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0
call fcn.005327a5
mov eax, dword [esp + 0x1c8]
cmp eax, ebp
je 0x46dd49
mov dword [eax], edi
jmp 0x46dd49
cmp eax, ebp
jne 0x46dd49
push ebp
push ebp
push ebp
lea ecx, [esp + 0x4c]
call fcn.00476f20
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0x3c
call fcn.00532ba8
cmp eax, edi
jne 0x46dcbe
lea edx, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], edx
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 0x42
call fcn.0053664f
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 0x40
call fcn.00530b8f
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 0x3f
call fcn.00530b8f
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 0x3e
call fcn.00530b8f
lea ecx, [esp + 0xac]
mov byte [esp + 0x1c0], 0x3d
call fcn.00530b8f
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0
call fcn.005327a5
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c0], 0xffffffff
call fcn.00530b8f
mov eax, edi
jmp 0x46dd5f
lea eax, [esp + 0xc4]
mov dword [esp + 0xc4], vtable.CGdiObject.0
mov dword [esp + 0x14], eax
lea ecx, [esp + 0xc4]
mov byte [esp + 0x1c0], 0x48
call fcn.0053664f
lea ecx, [esp + 0xc0]
mov byte [esp + 0x1c0], 0x46
call fcn.00530b8f
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1c0], 0x45
call fcn.00530b8f
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1c0], 0x44
call fcn.00530b8f
lea ecx, [esp + 0xac]
mov byte [esp + 0x1c0], 0x43
call fcn.00530b8f
lea ecx, [esp + 0x40]
mov byte [esp + 0x1c0], 0
call fcn.005327a5
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c0], 0xffffffff
call fcn.00530b8f
xor eax, eax
mov ecx, dword [esp + 0x1b8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1b4
ret 4