Function at 0x4607a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x509040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x110]
mov esi, ecx
push eax
push 0x20019
push 0
mov dword [ebp - 0x108], esi
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_San_Andreas_All1.5Settingsgeneral
mov dword [ebp - 0x108], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push reloc.WS2_32.dll_bind
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4609de
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x108], 1
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x10c], 0x100
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push str.serial
push dword [ebp - 0x110]
call ebx
test eax, eax
jne 0x4609de
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
push eax
push 0x20019
push 0
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_San_Andreas_All1.5Settingsgeneral
push reloc.WS2_32.dll_bind
call edi
test eax, eax
je 0x4608e9
movaps xmm0, xmmword [0x5002b0]
xor ecx, ecx
movups xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0x120], 0x5a4a4908
mov dword [ebp - 0x11c], 0x49085a41
mov dword [ebp - 0x118], 0x514d4308
mov word [ebp - 0x114], 1
nop word [eax + eax]
mov al, byte [ebp - 0x130]
xor byte [ebp + ecx - 0x12f], al
inc ecx
cmp ecx, 0x1c
jb 0x4608a0
xorps xmm0, xmm0
mov byte [ebp - 0x113], 0
movups xmmword [esi], xmm0
lea ecx, [ebp - 0x12f]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4608d7
lea eax, [ebp - 0x12f]
jmp 0x460b7d
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], 1
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0x100
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push str.serial
push dword [ebp - 0x110]
call ebx
test eax, eax
je 0x4609a9
movaps xmm0, xmmword [0x500400]
xor ecx, ecx
movups xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0x120], 0x56414804
mov dword [ebp - 0x11c], 0x4f044504
mov dword [ebp - 0x118], 0xd5d41
nop word [eax + eax]
mov al, byte [ebp - 0x130]
xor byte [ebp + ecx - 0x12f], al
inc ecx
cmp ecx, 0x1a
jb 0x460960
xorps xmm0, xmm0
mov byte [ebp - 0x115], 0
movups xmmword [esi], xmm0
lea ecx, [ebp - 0x12f]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x460997
lea eax, [ebp - 0x12f]
jmp 0x460b7d
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea ecx, [ebp - 0x104]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4609d2
jmp 0x460b77
lea eax, [ebp - 0x110]
push eax
push 0x20019
push 0
push str.SOFTWAREWOW6432NodeMulti_Theft_Auto:_San_Andreas_All1.6Settingsgeneral
push reloc.WS2_32.dll_bind
call edi
test eax, eax
je 0x460a89
movaps xmm0, xmmword [0x4ffef0]
xor ecx, ecx
movups xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0x120], 0x22323170
mov dword [ebp - 0x11c], 0x31702239
mov dword [ebp - 0x118], 0x29353b70
mov word [ebp - 0x114], 0x79
nop word [eax + eax]
mov al, byte [ebp - 0x130]
xor byte [ebp + ecx - 0x12f], al
inc ecx
cmp ecx, 0x1c
jb 0x460a40
xorps xmm0, xmm0
mov byte [ebp - 0x113], 0
movups xmmword [esi], xmm0
lea ecx, [ebp - 0x12f]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x460a77
lea eax, [ebp - 0x12f]
jmp 0x460b7d
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], 1
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0x100
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push str.serial
push dword [ebp - 0x110]
call ebx
test eax, eax
je 0x460b46
movaps xmm0, xmmword [0x4ffbe0]
xor ecx, ecx
movups xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0x120], 0x30272e62
mov dword [ebp - 0x11c], 0x29622362
mov dword [ebp - 0x118], 0x6b3b27
nop word [eax + eax]
mov al, byte [ebp - 0x130]
xor byte [ebp + ecx - 0x12f], al
inc ecx
cmp ecx, 0x1a
jb 0x460b00
xorps xmm0, xmm0
mov byte [ebp - 0x115], 0
movups xmmword [esi], xmm0
lea ecx, [ebp - 0x12f]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x460b37
lea eax, [ebp - 0x12f]
jmp 0x460b7d
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea ecx, [ebp - 0x104]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x14], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x460b70
lea eax, [ebp - 0x104]
sub ecx, edx
push ecx
push eax
mov ecx, esi
call fcn.0045c380
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004870f9
mov esp, ebp
pop ebp
ret