Function at 0x46803b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x848
mov eax, 0x5e6829
call fcn.00470bca
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor esi, esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp + 0x1c]
push eax
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x844], edi
mov dword [ebp - 0x854], esi
call fcn.00404170
mov dword [ebp - 4], esi
mov dword [ebp - 0x82c], esi
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], esi
call fcn.00453cc9
test al, al
je 0x4680db
mov ecx, 0xfa9f79bf
push ds
in eax, dx
mov eax, 0x76fa9934
lcall 0x296b, 0xbc558352
lds ebx, [edi - 0x25208c55]
add ecx, dword [ebx - 0x82f63]
push dword [ebx]
test byte [ebx - 0x84343], 0xff
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push esi
push dword [ebp - 0x840]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x468123
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00452f5f
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041ed70
mov eax, ebx
jmp 0x468392
lea eax, [ebp - 0x83c]
push eax
push 0x20119
push 0
push str.SoftWare
push dword [ebp - 0x82c]
call esi
test eax, eax
je 0x468150
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4680ff
lea eax, [ebp - 0x838]
push eax
push 0x20119
push 0
push edi
push dword [ebp - 0x83c]
call esi
mov dword [ebp - 0x840], eax
call fcn.004537ef
test al, al
je 0x46818a
lea esi, [ecx]
mov esp, dword [esi]
test al, 0x42
cli
inc edx
test dword [edx - 0x26d5c66e], ebx
popal
cli
popal
fild dword [eax]
call fcn.00453aa1
test al, al
je 0x4681af
sbb dword [ebx], eax
or dword [ebx - 0x46], esp
popal
mov ebx, 0x69fe5211
rcl edx, 0x97
ljmp 0x20aa
call fcn.00453cc9
test al, al
je 0x4681cd
xor eax, 0x25a60a80
xor byte [eax - 8], ch
shl dword [edx + 0x71], 0xa6
pop eax
cmp dword [ebx - 0x29], edi
ffreep st(2)
mov dword [edi + edx*2 - 0x83f427d], 0x7400ffff
sub eax, 0xf7c4b5ff
invalid
cmp dword [ebp - 0x840], 0
je 0x468203
push dword [ebp - 0x83c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x828]
push eax
call fcn.00452f5f
jmp 0x46837d
lea eax, [ebp - 0x834]
push eax
push 0x20119
push 0
push dword [ebp - 0x848]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x46823d
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
jmp 0x4681e2
call fcn.00453cc9
test al, al
je 0x46825a
ljmp 0x34e3:0xbd600d73
call fcn.00453948
test al, al
je 0x46827a
movsb byte es:[edi], byte [esi]
jl 0x4682a0
dec ecx
movsd dword es:[edi], dword [esi]
fist dword [ebx]
mov edx, 0x5b263a89
not bh
int3
call fcn.004537ef
test al, al
je 0x46829e
mov cl, 0xd5
xor al, 0xe2
push ebp
and ch, al
rcr dword es:[edi + 0x17], cl
and dh, byte [ebx + edi*8]
out dx, eax
pushfd
or al, 0xd7
sbb dword [ecx], esi
ret 0xa2dd
push 0x800
xor ebx, ebx
lea eax, [ebp - 0x810]
push ebx
push eax
or byte [eax], al
add byte [ebx], dh
fisttp dword [ebp - 0x80f7b]
call dword [ebx + 0x50]
call fcn.00483520
add esp, 0xc
mov dword [ebp - 0x84c], 0x400
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x850]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0x838]
call ebx
call fcn.00453cc9
test al, al
je 0x468321
notrack call 0xe4cbefd1
push ss
shr eax, 0x47
clc
in al, dx
pop edx
push es
aam 9
insd dword es:[edi], dx
fcom dword [ebp + edi*4 - 0x281d65b5]
fstp st(6)
and dword [ebx + 0x5e90001d], ecx
add bh, bh
mov ch, 0xc4
idiv edi
invalid
push dword [ebp - 0x83c]
call ebx
push dword [ebp - 0x82c]
call ebx
call fcn.00453bfa
test al, al
je 0x468356
fdiv dword [ecx + 0x76]
sahf
wait
retf
lea eax, [ebp - 0x810]
push eax
call fcn.00491bc7
pop ecx
mov ecx, dword [ebp - 0x830]
test eax, eax
je 0x4681f2
lea eax, [ebp - 0x810]
push eax
call fcn.00404170
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041ed70
mov eax, dword [ebp - 0x830]
call fcn.00470b74
ret