Function at 0x46600f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e359c
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.0046d920
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2028]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x203c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2040], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2048], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x202c], edi
mov dword [ebp - 0x204c], ebx
call fcn.00404060
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2038], ebx
mov dword [ebp - 0x2034], ebx
mov dword [ebp - 0x2030], ebx
call fcn.0045218b
test al, al
je 0x4660b1
pop eax
mov ebx, cs
inc ecx
ja 0x4660bb
insd dword es:[edi], dx
mov byte [ecx + eax*4], dh
mov edi, dword [ecx + 0x40]
dec esi
mov ebx, 0xbd8be2b0
aam 0xdf
invalid
call fcn.00452101
test al, al
je 0x4660d0
push ebp
dec ebp
pushal
push ds
jmp 0xfef177a5
lea eax, [ebp - 0x2038]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x466116
lea eax, [ebp - 0x2028]
mov ecx, edi
push eax
call fcn.00452e8f
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.0041ece0
mov eax, edi
jmp 0x466325
jmp [edx]
call fcn.004524c7
test al, al
je 0x46612f
retf
call fcn.00452215
test al, al
je 0x46614f
mov ebx, dword [eax + 0x43eb1a3d]
adc eax, 0xbea4f255
mov edx, 0x606011a6
push ds
mul cl
mov al, byte [0xe8cc3572]
lodsd eax, dword [esi]
mov edi, 0xc084fffe
call fcn.00452101
test al, al
je 0x466177
shl bl, cl
xchg ecx, eax
sub bh, cl
jl 0x4660ff
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2034]
xor ebx, ebx
mov edi, 0xf013f
push ebx
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x203c]
push dword [ebp - 0x2038]
call esi
test eax, eax
je 0x4661c7
push dword [ebp - 0x2038]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2028]
push eax
call fcn.00452e8f
push ebx
jmp 0x466312
push ebx
lea eax, [ebp - 0x2030]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x2040]
push dword [ebp - 0x2034]
call esi
test eax, eax
je 0x4661fe
push dword [ebp - 0x2034]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2030]
call esi
jmp 0x4661af
call fcn.00452215
test al, al
je 0x466228
cmp byte [ebx + eax*8], dl
jp 0x466288
inc esi
and al, 0x2a
cli
int3
push 0x2000
lea eax, [ebp - 0x2010]
push ebx
push eax
call fcn.00480620
add esp, 0xc
mov dword [ebp - 0x2044], 0x1000
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push ebx
push dword [ebp - 0x2048]
push dword [ebp - 0x2030]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2030]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2034]
call esi
push dword [ebp - 0x2038]
call esi
lea eax, [ebp - 0x2010]
push eax
call fcn.0048ed77
pop ecx
test eax, eax
je 0x4661af
test eax, esi
invalid
call fcn.00452620
test al, al
je 0x4662b8
bndldx bnd0, ss:[ebx + 0x4cb3abaf]
stosb byte es:[edi], al
push cs
xor eax, 0x560b2005
lds eax, [esi - 0x2617b9b2]
ret 0xfffe
call fcn.00452596
test al, al
je 0x4662dc
sub eax, dword [edx]
cmp byte [ebx - 0x3df20274], dl
rol dword [edi + ebx*4 + 0x293a92a4], cl
add ebx, dword [ebx]
retf 0x4784
call fcn.00452551
test al, al
je 0x4662fe
into
dec esp
mov ch, 0xfb
fdecstp
out 0x26, al
ret 0x92ce
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2010]
push eax
call fcn.00404060
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.0041ece0
mov eax, dword [ebp - 0x202c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret