Function at 0x46602a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e35e5
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.0046d940
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2028]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x203c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2040], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2048], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x202c], edi
mov dword [ebp - 0x204c], ebx
call fcn.004041e0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2038], ebx
mov dword [ebp - 0x2034], ebx
mov dword [ebp - 0x2030], ebx
call fcn.0045216e
test al, al
je 0x4660cc
invalid
sahf
loope 0x4660ab
int3
call fcn.004520e4
test al, al
je 0x4660eb
dec ecx
inc ebp
les ecx, [eax - 0x4cff80c8]
mov dword [0x9e8380df], eax
jg 0x466103
rcr dl, 0xeb
mov es, ebp
arpl word [ecx], dx
lea eax, [ebp - 0x2038]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x466131
lea eax, [ebp - 0x2028]
mov ecx, edi
push eax
call fcn.00452e72
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.0041edb0
mov eax, edi
jmp 0x466340
call fcn.004524aa
test al, al
je 0x46614a
sub al, 0x4d
hlt
call fcn.004521f8
test al, al
je 0x46616a
pop ebx
sbb ch, byte [esp + esi*2 - 0x22325d13]
ljmp 0x3326
call fcn.004520e4
test al, al
je 0x466192
outsd dx, dword [esi]
test byte [0x660963ee], 0x69
mov ebx, 0xbbc8f8d7
xor al, 3
sub esp, dword [edx + 0xbde72d0]
dec ebx
xor dword [ebx + 0x35], ebx
xchg esi, eax
pushfd
inc ebx
test al, 8
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2034]
xor ebx, ebx
mov edi, 0xf013f
push ebx
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x203c]
push dword [ebp - 0x2038]
call esi
test eax, eax
je 0x4661e2
push dword [ebp - 0x2038]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2028]
push eax
call fcn.00452e72
push ebx
jmp 0x46632d
push ebx
lea eax, [ebp - 0x2030]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x2040]
push dword [ebp - 0x2034]
call esi
test eax, eax
je 0x466219
push dword [ebp - 0x2034]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2030]
call esi
jmp 0x4661ca
call fcn.004521f8
test al, al
je 0x466243
and bh, byte [ebp - 0x54]
int1
and eax, dword [ebx - 0x7f28205e]
pop esp
xor byte [eax - 0x12], 0x9f
cdq
invalid
push 0x2000
lea eax, [ebp - 0x2010]
push ebx
push eax
call fcn.00480640
add esp, 0xc
mov dword [ebp - 0x2044], 0x1000
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push ebx
push dword [ebp - 0x2048]
push dword [ebp - 0x2030]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2030]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2034]
call esi
push dword [ebp - 0x2038]
call esi
lea eax, [ebp - 0x2010]
push eax
call fcn.0048ece7
pop ecx
test eax, eax
je 0x4661ca
call fcn.00452603
test al, al
je 0x4662d3
mov ch, 0xd7
sbb edx, 0xffffffb2
xchg esp, eax
ror byte [esi + ecx*4], cl
sbb esp, ebx
dec ecx
push cs
xor dh, dl
ljmp 0xc2a1
call fcn.00452579
test al, al
je 0x4662f7
dec edx
int 0x76
mov esi, 0x2059126
pop ebp
push cs
fisttp qword [edi - 0x47426aa]
or dword [ecx + 0x5728426f], edi
sal dword [edi - 0x17785a9d], 0x38
ret 0xfffe
call fcn.00452534
test al, al
je 0x466319
retf
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2010]
push eax
call fcn.004041e0
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.0041edb0
mov eax, dword [ebp - 0x202c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d81d
mov esp, ebp
pop ebp
ret