Function at 0x46cc20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2003c
call fcn.00494440
push ebx
push esi
push edi
push 1
push 0
mov esi, ecx
mov ecx, dword [0x4c1e68]
push 0xffffffffffffffff
push 0
mov dword [esp + 0x28], ecx
call fcn.00472b80
test esi, esi
jne 0x46cc5a
mov esi, 0x57
jmp 0x46cf94
mov ecx, dword [0x4be40c]
mov edx, dword [ecx + 0xcc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
or edx, 0x20019
push edx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x46cf94
mov edi, dword [ebp + 0x10]
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push eax
lea ecx, [esp + 0x24]
push ecx
push eax
push edi
push edx
call ebx
mov esi, eax
test esi, esi
je 0x46ccb8
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46cf94
mov eax, dword [esp + 0x1c]
dec eax
cmp eax, 6
ja case.0x46ccc6.5
jmp dword [eax*4 + 0x46cfb8]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push 0
push 0
push edi
push eax
mov dword [esp + 0x2c], 4
call ebx
mov esi, eax
test esi, esi
jne 0x46cd02
mov ecx, dword [esp + 0x20]
push 0x18
push eax
mov eax, dword [esp + 0x20]
push ecx
call fcn.004010e0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46cf94
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push edi
push ecx
mov dword [esp + 0x2c], 0
call ebx
mov esi, eax
test esi, esi
jne 0x46cca8
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46cca8
push 1
shr eax, 1
push esi
add eax, 2
push eax
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
call fcn.00472b80
cmp eax, 1
je 0x46cd73
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [esi + 0x17], 0
jne 0x46cd7c
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x46cd89
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x46cda2
test byte [esi + 0x15], 4
je 0x46cd9d
mov eax, esi
call fcn.0042fcf0
mov edi, dword [esi + 8]
jmp 0x46cdb4
cmp al, 2
jne 0x46cdaf
call fcn.00401000
mov edi, eax
jmp 0x46cdb4
mov edi, 0x4c3fd0
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push edi
push 0
push 0
push ecx
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x46ce0c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46ce0c
shr eax, 1
xor ecx, ecx
mov dword [edi + eax*2], ecx
cmp dword [esp + 0x1c], 7
jne 0x46ce11
mov eax, edi
cmp word [eax], 0
jne 0x46ce07
cmp word [eax + 2], 0
mov ecx, 0xa
mov word [eax], cx
je 0x46ce11
add eax, 2
jmp 0x46cdf2
xor edx, edx
mov word [edi], dx
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46ce16
mov ebx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, ebx
call fcn.00412ec0
cmp byte [ebx + 0x17], 0
jne 0x46ce3d
mov eax, dword [ebx + 0xc]
jmp 0x46ce3f
mov eax, ebx
cmp byte [eax + 0x17], 2
jne 0x46ce69
cmp dword [0x4c4030], 0
je 0x46ce69
mov ecx, 0x4c4024
call fcn.00403d70
test eax, eax
jne 0x46cf94
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
and byte [eax + 0x15], 0x86
jmp 0x46cf94
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push edi
push eax
mov dword [esp + 0x2c], 0x1fffe
call ebx
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x46cf94
mov edx, dword [esp + 0x14]
push 1
push esi
lea eax, [edx + edx]
push eax
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
call fcn.00472b80
cmp eax, 1
jne 0x46cd68
cmp byte [esi + 0x17], 0
jne 0x46cece
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x46cedb
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x46cef4
test byte [esi + 0x15], 4
je 0x46ceef
mov eax, esi
call fcn.0042fcf0
mov eax, dword [esi + 8]
jmp 0x46cf04
cmp al, 2
jne 0x46ceff
call fcn.00401000
jmp 0x46cf04
mov eax, 0x4c3fd0
xor ecx, ecx
mov word [eax], cx
mov ecx, 8
mov esi, str.0123456789ABCDEF
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
xor edx, edx
movsw word es:[edi], word [esi]
xor esi, esi
cmp dword [esp + 0x14], edx
jbe 0x46cf52
movzx ecx, byte [esp + esi + 0x48]
mov edi, ecx
shr ecx, 4
and edi, 0xf
mov di, word [esp + edi*2 + 0x24]
and ecx, 0xf
mov cx, word [esp + ecx*2 + 0x24]
mov word [eax + edx*2 + 2], di
mov word [eax + edx*2], cx
inc esi
add edx, 2
cmp esi, dword [esp + 0x14]
jb 0x46cf25
xor ecx, ecx
mov word [eax + edx*2], cx
mov eax, dword [esp + 0x18]
cmp byte [eax + 0x17], cl
jne 0x46cf64
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x17], 2
jne 0x46cfb0
cmp dword [0x4c4030], ecx
je 0x46cfb0
mov ecx, 0x4c4024
call fcn.00403d70
test eax, eax
je 0x46cd68
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x65e
mov edx, dword [ebp + 8]
test esi, esi
setne al
movzx ecx, al
push esi
push ecx
push edx
call fcn.0042f420
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
and byte [eax + 0x15], 0x86
jmp case.0x46ccc6.5