Function at 0x463a34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov esi, 0x46ce60
mov ebx, 0x46ce5c
cmp byte [0x46ce84], 0
je 0x463c1b
mov eax, dword [ebx]
mov dword [esp], eax
jmp 0x463a6f
add dword [ebx], 0x1000
mov eax, dword [ebx]
mov dword [esp], eax
mov eax, 0x46ce58
mov edx, dword [ebx]
call fcn.00402c74
push esp
mov eax, dword [0x46ce58]
push eax
push 0
push 0
push 0x463cfc
push 0x80000004
call sub.advapi32.dll_RegQueryValueExA_1
cmp eax, 0xea
je 0x463a58
mov eax, dword [0x46ce58]
mov eax, dword [eax + 0x18]
add eax, dword [0x46ce58]
mov dword [esi], eax
mov eax, dword [0x46ce58]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jle 0x463ac2
mov eax, dword [esi]
cmp dword [eax + 0xc], 0xee
je 0x463ac2
mov eax, dword [esi]
mov eax, dword [eax]
add eax, dword [esi]
mov dword [esi], eax
dec ecx
jne 0x463aac
mov eax, dword [esi]
cmp dword [eax + 0xc], 0xee
je 0x463ae3
mov ecx, 0x463d08
mov dl, 1
mov eax, dword [0x407890]
call fcn.0040c504
call fcn.0040413c
cmp dword [0x46ce68], 0
jge 0x463b1a
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
mov dword [0x46ce68], eax
mov eax, dword [0x46ce68]
shl eax, 3
call fcn.00402c40
mov dword [0x46ce6c], eax
mov eax, dword [0x46ce68]
shl eax, 3
call fcn.00402c40
mov dword [0x46ce70], eax
mov eax, dword [esi]
mov eax, dword [eax + 8]
add eax, dword [esi]
mov dword [0x46ce64], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jle 0x463b4f
mov eax, dword [0x46ce64]
cmp dword [eax + 4], 6
je 0x463b4f
mov eax, dword [0x46ce64]
mov eax, dword [eax]
add eax, dword [0x46ce64]
mov dword [0x46ce64], eax
dec ecx
jne 0x463b2f
mov eax, dword [0x46ce64]
cmp dword [eax + 4], 6
je 0x463b70
mov ecx, 0x463d44
mov dl, 1
mov eax, dword [0x407890]
call fcn.0040c504
call fcn.0040413c
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, dword [esi]
mov ecx, dword [0x46ce68]
dec ecx
test ecx, ecx
jl 0x463bd7
inc ecx
xor ebx, ebx
mov esi, dword [eax]
add esi, eax
mov eax, dword [0x46ce70]
mov edx, dword [0x46ce6c]
mov edi, dword [edx + ebx*8]
mov dword [eax + ebx*8], edi
mov edi, dword [edx + ebx*8 + 4]
mov dword [eax + ebx*8 + 4], edi
mov eax, dword [0x46ce64]
mov eax, dword [eax + 0x24]
mov edi, esi
add eax, edi
mov edx, dword [eax]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov eax, dword [0x46ce6c]
mov edx, dword [esp + 0x18]
mov dword [eax + ebx*8], edx
mov edx, dword [esp + 0x1c]
mov dword [eax + ebx*8 + 4], edx
mov eax, dword [esi]
add eax, edi
inc ebx
dec ecx
jne 0x463b85
mov eax, dword [0x46ce74]
mov dword [0x46ce7c], eax
mov eax, dword [0x46ce78]
mov dword [0x46ce80], eax
lea eax, [esp + 4]
push eax
mov eax, dword [0x46ce58]
add eax, 0x24
push eax
call sub.kernel32.dll_SystemTimeToFileTime
mov eax, dword [esp + 4]
mov dword [0x46ce74], eax
mov eax, dword [esp + 8]
mov dword [0x46ce78], eax
jmp 0x463cf4
cmp byte [0x46ce85], 0
jne 0x463ccb
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push 0x463d80
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x463c5d
mov ecx, 0x463d9c
mov dl, 1
mov eax, dword [0x407890]
call fcn.0040c504
call fcn.0040413c
mov dword [esp + 0x10], 4
lea eax, [esp + 0x10]
push eax
push 0x46ce88
lea eax, [esp + 0x1c]
push eax
push 0
push 0x463dc4
mov eax, dword [esp + 0x20]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 0x46ce8c
push 0x20019
push 0
push 0x463dd4
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x463cc4
mov ecx, 0x463df0
mov dl, 1
mov eax, dword [0x407890]
call fcn.0040c504
call fcn.0040413c
mov byte [0x46ce85], 1
mov dword [esp + 0x10], 4
lea eax, [esp + 0x10]
push eax
push 0x46ce88
lea eax, [esp + 0x1c]
push eax
push 0
push 0x463dc4
mov eax, dword [0x46ce8c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
add esp, 0x20
pop edi
pop esi
pop ebx
ret