Function at 0x46fde3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xe90
mov eax, 0x494b75
call fcn.0048e6b2
mov dword [ebp - 0xe68], ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push 0x208
xor esi, esi
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xe84], 0x104
lea eax, [ebp - 0xe9c]
mov dword [ebp - 0xe80], esi
mov dword [ebp - 0xe7c], esi
mov ebx, esi
mov dword [ebp - 0xe78], esi
push eax
lea eax, [ebp - 0xe6c]
mov dword [ebp - 0xe60], esi
push eax
lea eax, [ebp - 0xe70]
mov dword [ebp - 0xe74], esi
push eax
lea eax, [ebp - 0xe74]
mov dword [ebp - 0xe70], esi
push eax
lea eax, [ebp - 0xe60]
mov dword [ebp - 0xe6c], esi
push eax
lea eax, [ebp - 0xe78]
mov dword [ebp - 0xe64], 0x400
push eax
lea eax, [ebp - 0xe7c]
push eax
lea eax, [ebp - 0xe80]
push eax
push esi
lea eax, [ebp - 0xe84]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0xe60]
mov dword [ebp - 0xe60], eax
je 0x4700de
push 7
pop edx
xor ecx, ecx
mov dword [ebp - 0xe5c], 4
mov dword [ebp - 0xe24], edx
mov dword [ebp - 0xe28], esi
mov word [ebp - 0xe38], cx
mov dword [ebp - 4], esi
mov dword [ebp - 0xe08], edx
mov dword [ebp - 0xe0c], esi
mov word [ebp - 0xe1c], cx
inc ebx
mov dword [ebp - 0xe8c], ebx
mov byte [ebp - 4], bl
test eax, eax
je 0x470037
mov ebx, dword [ebp - 0xe68]
xor eax, eax
mov dword [ebp - 0xe64], 0x400
push eax
push eax
push eax
push eax
mov word [ebp - 0xe04], ax
lea eax, [ebp - 0xe64]
push eax
lea eax, [ebp - 0xe04]
push eax
push esi
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x470024
lea eax, [ebp - 0xe04]
push eax
lea ecx, [ebp - 0xe20]
call fcn.00470d0c
cmp dword [ebp - 0xe08], 8
mov eax, dword [ebp - 0xe1c]
mov dword [ebp - 0xe5c], 4
jae 0x46ff6e
lea eax, [ebp - 0xe1c]
lea ecx, [ebp - 0xe5c]
push ecx
lea ecx, [ebp - 0xe88]
push ecx
push 0
push 0x10
push eax
push 0x40efc8
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x46ffac
lea eax, [ebp - 0xe20]
push eax
lea ecx, [ebx + 0x54]
call fcn.00470b51
mov ecx, eax
mov eax, dword [ebp - 0xe88]
mov dword [ecx], eax
jmp 0x470024
cmp dword [ebp - 0xe08], 8
mov eax, dword [ebp - 0xe1c]
mov dword [ebp - 0xe5c], 0x3e8
jae 0x46ffcb
lea eax, [ebp - 0xe1c]
lea ecx, [ebp - 0xe5c]
push ecx
lea ecx, [ebp - 0x604]
push ecx
push 0
push 0xffff
push eax
push 0x40efc8
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x470024
lea eax, [ebp - 0x604]
push eax
lea ecx, [ebp - 0xe3c]
call fcn.00470d0c
lea eax, [ebp - 0xe20]
push eax
lea ecx, [ebx + 0x48]
call fcn.00470c37
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0xe3c]
push ecx
mov ecx, eax
call fcn.0041aa3d
inc esi
cmp esi, dword [ebp - 0xe60]
jb 0x46ff08
mov ebx, dword [ebp - 0xe8c]
push 0x41244c
lea ecx, [ebp - 0xe58]
call fcn.004180ac
mov edi, dword [ebp - 0xe68]
lea eax, [ebp - 0xe58]
push eax
mov byte [ebp - 4], 2
lea ecx, [edi + 0x54]
call fcn.00470b51
push 0
push ebx
lea ecx, [ebp - 0xe58]
mov eax, dword [eax]
mov dword [ebp - 0xe94], eax
mov byte [ebp - 4], bl
call fcn.0041ab08
push 0x41246c
lea ecx, [ebp - 0xe58]
call fcn.004180ac
lea eax, [ebp - 0xe58]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x54]
call fcn.00470b51
xor esi, esi
lea ecx, [ebp - 0xe58]
push esi
push ebx
mov eax, dword [eax]
mov dword [ebp - 0xe90], eax
call fcn.0041ab08
lea eax, [edi + 0x38]
push eax
lea eax, [ebp - 0xe94]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push esi
push ebx
lea ecx, [ebp - 0xe20]
call fcn.0041ab08
push esi
push ebx
lea ecx, [ebp - 0xe3c]
call fcn.0041ab08
mov eax, ebx
call fcn.0048e652
ret 4