Function at 0x465d49
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x838
mov eax, 0x5e46a4
call fcn.0046dcba
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp + 0x14]
push eax
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x844], edi
call fcn.00404060
mov dword [ebp - 4], edi
mov dword [ebp - 0x82c], edi
mov dword [ebp - 0x834], edi
call fcn.00452551
test al, al
je 0x465dc6
xor edx, dword [edx + 0x708e04d]
dec ecx
add eax, 0xb4be87c9
mov bl, byte [ebp + 0x1b00bce6]
or eax, 0xcaca047f
mov esi, 0xa8ead770
mov ebx, dword [ebp - 0x830]
xor edi, edi
xchg dword [esi - 0x1962754c], edi
mov esp, 0x7f0d1b00
add al, 0xca
retf 0x70be
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push edi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x465e0a
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00452e8f
push edi
push 1
lea ecx, [ebp - 0x828]
call fcn.0041ece0
mov eax, ebx
jmp 0x466009
call fcn.00452620
test al, al
je 0x465e30
popal
cmp al, 0x7f
loop 0x465dab
pop eax
mov ebp, 0x67bd0b8f
and edi, eax
int1
popfd
invalid
lea eax, [ebp - 0x834]
push eax
push 0x20119
push edi
push dword [ebp - 0x83c]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x465e77
or al, 0x60
pop esi
add byte [ebp - 0xdb8b40], al
mov ch, 0xd4
idiv edi
invalid
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x828]
push eax
call fcn.00452e8f
push edi
jmp 0x465ff6
call fcn.00452077
test al, al
je 0x465ea0
pop ss
salc
mov ebx, 0xcda37cde
or eax, 0x81a996ef
dec ebp
mov bh, 0x13
xor dh, byte [edx]
adc al, 0x93
mov edi, 0xbf568ccb
lea ecx, [edi]
jnp 0x465e4b
mov esi, 0x67e86a65
invalid
call fcn.0045250c
test al, al
je 0x465ec7
test ecx, 0xc77bf8f6
jmp 0x8b98d47
sbb al, 0xd6
jbe 0x465eb7
cdq
fst qword [ebx]
sbb eax, 0x67ef835c
push cs
dec ebp
invalid
push 0x800
lea eax, [ebp - 0x810]
push edi
push eax
call fcn.00480620
add esp, 0xc
mov dword [ebp - 0x840], 0x400
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push dword [ebp - 0x838]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call fcn.0045218b
test al, al
je 0x465f22
xchg esp, eax
push 0xffffffffffffffa2
mov eax, dword [0x1ce70a55]
mov eax, esi
mov dword [0xd8325bdc], eax
mov esi, 0xc1dae8da
invalid
call fcn.00452101
test al, al
je 0x465f41
dec ecx
sahf
jg 0x465eb5
dec ebp
add al, 0x17
xor al, dh
xchg edi, eax
mov eax, dword [0x1cacdd42]
invalid
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.0048ed77
pop ecx
mov dword [ebp - 0x838], eax
call fcn.004524c7
test al, al
je 0x465f83
push esi
jmp 0x465f4f
call fcn.00452215
test al, al
je 0x465fa3
sub dword [ebx + 0x3d927d8d], 0x3125a58c
mov word [esp + ebx*2], es
dec edx
lodsb al, byte [esi]
imul edx, dword [ebx - 0x29ed16ba], 0x59e82ea7
sar esi, 0xff
call fcn.00452101
test al, al
je 0x465fcb
xor eax, 0xc482d43e
lock and dword [ebp - 0x6f5c4fa1], ecx
cmpsb byte [esi], byte es:[edi]
pushal
xchg byte [eax - 0x20342990], bl
dec eax
sbb al, 0xac
mov ebp, 0x3d968bd2
add ebx, esi
add al, 0x83
mov ebp, 0xfffff7c8
add byte [ebx - 0x82f73], cl
push dword [ebp + 0xe]
cmp dword [ebp - 0x838], 0
mov ecx, dword [ebp - 0x830]
jne 0x465fe8
lea eax, [ebp - 0x828]
push eax
call fcn.00452e8f
jmp 0x465ff4
lea eax, [ebp - 0x810]
push eax
call fcn.00404060
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041ece0
mov eax, dword [ebp - 0x830]
call fcn.0046dc64
ret