Function at 0x46a120
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12260
call fcn.004c2ee0
mov eax, dword [0x538a60]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
mov byte [ebp - 0x12251], dl
push esi
mov esi, ebx
mov dword [ebp - 0x1225c], ebx
push edi
lea ecx, [esi + 1]
lea ecx, [ecx]
mov al, byte [esi]
inc esi
test al, al
jne 0x46a150
mov edi, 0
mov dword [ebp - 0x12258], edi
sub esi, ecx
je 0x46a189
mov al, byte [ebx + edi]
cmp al, 0x2f
je 0x46a17e
cmp al, 0x5c
je 0x46a17e
inc edi
mov dword [ebp - 0x12258], edi
cmp edi, esi
jb 0x46a166
jmp 0x46a189
mov byte [ebx + edi], 0
inc edi
mov dword [ebp - 0x12258], edi
cmp edi, esi
je 0x46a6e3
push 0x11
push ebx
push str.HKEY_CLASSES_ROOT
mov esi, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004bce70
add esp, 0xc
mov ecx, closesocket
test eax, eax
cmove esi, ecx
push 0x13
push ebx
push str.HKEY_CURRENT_CONFIG
call fcn.004bce70
add esp, 0xc
mov ecx, VariantInit
test eax, eax
cmove esi, ecx
push 0x11
push ebx
push str.HKEY_CURRENT_USER
call fcn.004bce70
add esp, 0xc
mov ecx, closesocket
test eax, eax
cmove esi, ecx
push 0xa
push ebx
push str.HKEY_USERS
mov dword [ebp - 0x1221c], esi
call fcn.004bce70
add esp, 0xc
test eax, eax
jne 0x46a20b
mov esi, reloc.WS2_32.dll_closesocket
mov dword [ebp - 0x1221c], esi
jmp 0x46a213
cmp esi, reloc.WS2_32.dll_closesocket
jne 0x46a232
cmp byte [ebp + 8], 0
jne 0x46a232
push 0x51b858
push 0x1000
push 0x550d60
call fcn.004bb50e
add esp, 0xc
jmp 0x46a24d
lea eax, [ebx + edi]
push eax
push 0x51f514
push 0x1000
push 0x550d60
call fcn.004bb50e
add esp, 0x10
cmp byte [ebp - 0x12251], 1
lea eax, [ebp - 0x1224c]
push eax
jne 0x46a264
push 0x20119
jmp 0x46a269
push 0x20019
push 0
push 0x550d60
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x561208
push 0x561418
push str._S__s_regkeybypath.log.z
push 0x1000
push 0x547d60
mov dword [ebp - 0x12218], eax
call fcn.00471220
add esp, 0x14
cmp dword [ebp - 0x12218], 0
jne 0x46a692
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.004c13c0
add esp, 0xc
mov dword [ebp - 0x12230], 0x104
lea eax, [ebp - 0x12248]
mov dword [ebp - 0x12228], 0
mov dword [ebp - 0x12220], 0
mov dword [ebp - 0x12218], 0
push eax
lea eax, [ebp - 0x12240]
push eax
lea eax, [ebp - 0x12250]
push eax
lea eax, [ebp - 0x12238]
push eax
lea eax, [ebp - 0x12220]
push eax
lea eax, [ebp - 0x1223c]
push eax
lea eax, [ebp - 0x12234]
push eax
lea eax, [ebp - 0x12228]
push eax
push 0
lea eax, [ebp - 0x12230]
push eax
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x1224c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x46a6e3
mov eax, dword [ebp - 0x12228]
test eax, eax
je 0x46a46a
xor ebx, ebx
test eax, eax
je 0x46a46a
jmp 0x46a370
mov eax, dword [ebp - 0x12234]
add eax, eax
push 0x1000
mov dword [ebp - 0x1222c], eax
lea eax, [ebp - 0x2214]
push 0
push eax
call fcn.004c13c0
add esp, 0xc
lea eax, [ebp - 0x12248]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x1222c]
push eax
lea eax, [ebp - 0x2214]
push eax
push ebx
push dword [ebp - 0x1224c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x46a45d
cmp esi, reloc.WS2_32.dll_closesocket
jne 0x46a49b
cmp byte [ebp + 8], al
jne 0x46a49b
mov eax, dword [ebp - 0x1225c]
add eax, edi
mov ecx, eax
mov dword [ebp - 0x12260], eax
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x46a3f0
mov esi, dword [ebp - 0x1222c]
sub ecx, edx
add esi, 0xd
add esi, ecx
mov ecx, esi
call fcn.00455630
push dword [ebp - 0x12260]
mov dword [ebp - 0x12224], eax
lea eax, [ebp - 0x2214]
push eax
push str.HKEY_USERS_S_s
push esi
push esi
mov esi, dword [ebp - 0x12224]
push esi
call fcn.004bb430
mov dl, byte [ebp - 0x12251]
mov ecx, esi
push 1
call fcn.0046a120
add esp, 0x1c
test esi, esi
je 0x46a457
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x1221c]
inc ebx
cmp ebx, dword [ebp - 0x12228]
jb 0x46a370
cmp dword [ebp - 0x12220], 0
je 0x46a64f
mov eax, dword [ebp - 0x12250]
lea ebx, [eax + eax]
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x46a4e4
jmp 0x46a6f9
lea eax, [ebp - 0x2214]
push eax
push 0x550d60
push str._s__s_n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
push 0x1000
push 0x545d60
call fcn.004bbd3d
push eax
mov edx, 0x545d60
mov ecx, 0x547d60
call fcn.00457af0
add esp, 0x24
jmp 0x46a45d
mov eax, esi
test ebx, ebx
je 0x46a4f9
lea ebx, [ebx]
mov byte [eax], 0
lea eax, [eax + 1]
dec ebx
jne 0x46a4f0
mov eax, dword [ebp - 0x12250]
xor ebx, ebx
add eax, eax
mov dword [ebp - 0x12218], 0x4000
mov dword [ebp - 0x1221c], eax
cmp dword [ebp - 0x12220], ebx
jbe 0x46a63f
nop
push 0x4000
lea eax, [ebp - 0x12214]
push 0
push eax
call fcn.004c13c0
mov edi, dword [ebp - 0x12250]
add esp, 0xc
lea eax, [edi + edi]
push eax
push 0
push esi
call fcn.004c13c0
mov eax, dword [ebp - 0x12250]
add esp, 0xc
add eax, eax
mov dword [ebp - 0x12218], 0x4000
mov dword [ebp - 0x1221c], eax
lea eax, [ebp - 0x1221c]
push eax
push esi
lea eax, [ebp - 0x12224]
push eax
push 0
lea eax, [ebp - 0x12218]
push eax
lea eax, [ebp - 0x12214]
push eax
push ebx
push dword [ebp - 0x1224c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x46a62c
mov eax, dword [ebp - 0x12224]
cmp eax, 4
je 0x46a5e3
cmp eax, 5
je 0x46a5e3
cmp eax, 2
je 0x46a5cf
cmp eax, 6
je 0x46a5cf
cmp eax, 7
je 0x46a5cf
cmp eax, 1
je 0x46a5cf
push esi
lea eax, [ebp - 0x12214]
push eax
push 0x550d60
push str._s__s__02x_n
jmp 0x46a5f6
push esi
lea eax, [ebp - 0x12214]
push eax
push 0x550d60
push str._s__s__s_n
jmp 0x46a5f6
push dword [esi]
lea eax, [ebp - 0x12214]
push eax
push 0x550d60
push str._s__s__d_n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x1c
push 0x1000
push 0x545d60
call fcn.004bbd3d
push eax
mov edx, 0x545d60
mov ecx, 0x547d60
call fcn.00457af0
add esp, 0xc
inc ebx
cmp ebx, dword [ebp - 0x12220]
jb 0x46a520
mov edi, dword [ebp - 0x12258]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x1224c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x51b858
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
mov eax, dword [ebp - 0x1225c]
add esp, 0x10
mov byte [eax + edi - 1], 0x5c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push 0x550d60
push str._s_not_found_n
push 0xffffffffffffffff
push 0x800
push 0x545d60
call fcn.004bb4ef
add esp, 0x14
push 0x1000
push 0x545d60
call fcn.004bbd3d
push eax
mov edx, 0x545d60
mov ecx, 0x547d60
call fcn.00457af0
add esp, 0xc
push dword [ebp - 0x1224c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebx + edi - 1], 0x5c
mov ecx, dword [ebp - 8]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bae74
mov esp, ebp
pop ebp
ret
push str.Failed_to_allocate_memory_on_process_heap_n
call fcn.004bc829
add esp, 4
push 1
call fcn.004bcc8d
int3