Function at 0x464a90
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508518
mov eax, dword fs:[0]
push eax
sub esp, 0x8c4
mov eax, dword [0x564690]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8bc], eax
mov dword [ebp - 0x8d0], 0
mov dword [ebp - 0x8c8], 0
mov dword [ebp - 0x8c4], 0
mov dword [ebp - 0x8c0], 0
mov dword [ebp - 4], 0
call fcn.00465e20
test al, al
jne 0x464b05
inc dword [0x565ae0]
mov eax, dword [0x5641c0]
mov ecx, 0x5641c0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x8ac], esi
mov eax, dword [0x5641c0]
mov ecx, 0x5641c0
mov byte [ebp - 4], 1
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x8b8], ebx
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x8c8]
mov byte [ebp - 4], 2
call fcn.0040b750
test eax, eax
je 0x464b73
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x8c8]
call fcn.0040b750
test eax, eax
jne 0x464e8f
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.004e6690
mov edi, dword [ebp - 0x8c8]
add esp, 0xc
lea eax, [ebp - 0x8a4]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x8cc]
push eax
push 0
push str.CurrentVersion
push edi
mov dword [ebp - 0x8a4], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x464e72
mov eax, dword [ebp - 0x8cc]
cmp eax, 1
je 0x464be0
cmp eax, 2
jne 0x464e72
mov eax, dword [ebp - 0x8a4]
test eax, eax
je 0x464c04
test al, 1
jne 0x464e72
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x464c0d
jmp 0x464e72
xor eax, eax
mov word [ebp - 0x810], ax
lea edx, [ebp - 0x810]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x464c16
sub edx, esi
sar edx, 1
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x8ac]
call fcn.00409890
mov eax, dword [0x5641c0]
mov ecx, 0x5641c0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x898], eax
mov eax, 0x521a40
mov byte [ebp - 4], 3
test eax, 0xffff0000
jne 0x464c7f
movzx esi, ax
push 0
push esi
call fcn.00402e50
add esp, 8
test eax, eax
je 0x464c91
push esi
push eax
lea ecx, [ebp - 0x898]
call fcn.00407600
jmp 0x464c91
push 1
push 0x521a40
lea ecx, [ebp - 0x898]
call fcn.00409890
mov esi, dword [0x565ae0]
mov eax, esi
imul eax, esi
cdq
mov ecx, 0x17
idiv ecx
mov byte [ebp - 4], 4
cmp edx, 0x16
jne 0x464cf0
xor ecx, ecx
nop
mov eax, dword [ebp + ecx*4 - 0x880]
add eax, dword [ebp + ecx*4 - 0x884]
add ecx, 6
add eax, dword [ebp + ecx*4 - 0x8a0]
add eax, dword [ebp + ecx*4 - 0x8a4]
add eax, dword [ebp + ecx*4 - 0x8a8]
add eax, dword [ebp + ecx*4 - 0x8ac]
imul eax, eax, 0x2b
add esi, eax
cmp ecx, 0x84
jb 0x464cb0
mov dword [0x565ae0], esi
lea eax, [ebp - 0x8a0]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x8a8]
push eax
push 0
push str.CurrentBuild
push edi
mov dword [ebp - 0x8a0], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x464d67
mov eax, dword [ebp - 0x8a8]
cmp eax, 1
je 0x464d3a
cmp eax, 2
je 0x464d3a
mov esi, 0xd
jmp 0x464d67
mov eax, dword [ebp - 0x8a0]
test eax, eax
je 0x464d5c
test al, 1
jne 0x464d55
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
je 0x464d65
mov esi, 0xd
jmp 0x464d67
xor eax, eax
mov word [ebp - 0x810], ax
xor esi, esi
call fcn.00465e50
test al, al
jne 0x464d82
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test esi, esi
jne 0x464e46
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464d93
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x898]
call fcn.00409890
lea eax, [ebp - 0x898]
push eax
lea eax, [ebp - 0x8b4]
push 0x521b6c
push eax
call fcn.00402ac0
push 0x521b68
push eax
lea eax, [ebp - 0x8b0]
push eax
mov byte [ebp - 4], 5
call fcn.004029e0
add esp, 0x18
mov eax, dword [eax]
lea ecx, [ebp - 0x8ac]
push dword [eax - 0xc]
mov byte [ebp - 4], 6
push eax
call fcn.00402ce0
mov edx, dword [ebp - 0x8b0]
add edx, 0xfffffff0
or esi, 0xffffffff
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x464e21
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x8b4]
add edx, 0xfffffff0
mov byte [ebp - 4], 4
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x464e49
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x464e49
or esi, 0xffffffff
mov edx, dword [ebp - 0x898]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x464e6c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x8ac]
test edi, edi
je 0x464e85
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x8c8], edi
mov dword [ebp - 0x8c4], 0
mov eax, dword [0x56681c]
mov dword [ebp - 0x8a0], 0
mov dword [ebp - 0x898], 0
mov dword [ebp - 0x8a8], 0
test eax, eax
jne 0x464fc8
mov edi, dword [0x565ae0]
lea ecx, [edi + 2]
lea eax, [edi + 1]
imul eax, ecx
imul eax, edi
cdq
mov ecx, 0xc
idiv ecx
cmp edx, 0xa
jne 0x464f63
xor edx, edx
nop
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, edi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, edi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edi
sar ecx, 1
xor eax, ecx
inc edx
add edi, eax
cmp edx, 0x100
jl 0x464ee0
mov dword [0x565ae0], edi
push str.Version.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x565ae0]
mov edi, eax
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov dword [ebp - 0x89c], 7
idiv dword [ebp - 0x89c]
cmp edx, 2
jne 0x464fa4
test ecx, ecx
mov eax, 1
cmove ecx, eax
mov dword [0x565ae0], ecx
test edi, edi
je 0x464fbb
push str.GetFileVersionInfoSizeW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x56681c], eax
jmp 0x464fc0
mov eax, dword [0x56681c]
test eax, eax
je 0x4650c2
lea ecx, [ebp - 0x8a0]
push ecx
push 0x5213fc
call eax
mov edi, eax
test edi, edi
je 0x4650c2
push edi
call fcn.004e3b54
add esp, 4
mov dword [ebp - 0x8a4], eax
push eax
push edi
push dword [ebp - 0x8a0]
push 0x5213fc
call fcn.0040ea10
push eax
call fcn.0041dfd0
mov edi, dword [ebp - 0x8a4]
test eax, eax
je 0x465097
lea eax, [ebp - 0x898]
push eax
lea eax, [ebp - 0x8a8]
push eax
push 0x518d18
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x465072
cmp dword [ebp - 0x898], 0
je 0x465072
mov eax, dword [ebp - 0x8a8]
cmp dword [eax], 0xfeef04bd
jne 0x465072
movzx edx, word [eax + 0x12]
movzx ecx, word [eax + 0x10]
movzx eax, word [eax + 0x16]
push eax
push ecx
push edx
lea eax, [ebp - 0x8b8]
push 0x521a44
push eax
call fcn.00405b60
mov ebx, dword [ebp - 0x8b8]
add esp, 0x14
mov edx, dword [0x565ae0]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 9
idiv ecx
cmp edx, 4
jne 0x465097
dec dword [0x566790]
push edi
call fcn.004e5c83
mov ecx, dword [0x565ae0]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov edi, 0x13
idiv edi
add esp, 4
cmp edx, 0x10
jne 0x4650c2
inc ecx
mov dword [0x565ae0], ecx
mov ecx, dword [esi - 0x10]
lea edi, [esi - 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x8b0], edi
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x4650ed
cmp ecx, dword [edi]
jne 0x4650ed
mov eax, 1
lock xadd dword [edx], eax
jmp 0x465136
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x89c], edx
test edx, edx
jne 0x465107
call fcn.00409c50
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.004e5c88
mov edi, dword [ebp - 0x89c]
add esp, 0x10
add edi, 0x10
mov dword [ebp - 0x898], edi
mov byte [ebp - 4], 7
call fcn.00465e20
test al, al
jne 0x465174
mov eax, 0x5b
mov ebx, 0x93
test ebx, ebx
je 0x465167
cdq
idiv ebx
mov ecx, ebx
mov eax, ecx
mov ebx, edx
test ecx, ecx
jne 0x465156
add eax, ebx
mov ebx, dword [ebp - 0x8b8]
mov dword [0x565ae0], eax
xor eax, eax
test ebx, ebx
setne al
test eax, eax
jne 0x465189
push 0x80004005
call fcn.00402ec0
mov eax, ebx
jmp 0x465190
mov cx, word [esi]
cmp cx, word [eax]
jne 0x4651b6
test cx, cx
je 0x4651b2
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x4651b6
add esi, 4
add eax, 4
test cx, cx
jne 0x465190
xor eax, eax
jmp 0x4651bb
sbb eax, eax
or eax, 1
test eax, eax
setne al
test al, al
je 0x4652c1
cmp dword [ebx - 0xc], 0
jl 0x4652c1
push 0x521a5c
push ebx
call fcn.004e5d72
add esp, 8
test eax, eax
je 0x4652c1
sub eax, ebx
sar eax, 1
jne 0x4652c1
lea eax, [edi - 0x10]
lea esi, [ebx - 0x10]
mov dword [ebp - 0x8b4], eax
cmp esi, eax
je 0x4652c1
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
mov dword [ebp - 0x89c], ecx
jl 0x4652ac
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x4652ac
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x465244
cmp ecx, dword [esi]
jne 0x465244
mov edi, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x465281
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edi, eax
test edi, edi
jne 0x465258
call fcn.00409c50
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.004e5c88
add esp, 0x10
mov ecx, dword [ebp - 0x89c]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4652a1
mov edx, dword [ebp - 0x8b4]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0x10
mov dword [ebp - 0x898], edi
jmp 0x4652c1
push dword [ebx - 0xc]
lea ecx, [ebp - 0x898]
push ebx
call fcn.00409890
mov edi, dword [ebp - 0x898]
mov ecx, dword [edi - 0x10]
add edi, 0xfffffff0
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x4652e9
cmp ecx, dword [edi]
jne 0x4652e9
mov esi, edi
mov ecx, 1
lock xadd dword [eax], ecx
inc ecx
jmp 0x465326
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov esi, eax
test esi, esi
jne 0x4652fd
call fcn.00409c50
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.004e5c88
add esp, 0x10
mov ecx, dword [ebp - 0x8bc]
lea eax, [esi + 0x10]
mov dword [ecx], eax
or esi, 0xffffffff
mov byte [ebp - 4], 2
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46534e
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [ebx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46536b
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x8b0]
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x465389
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x8c8]
test ecx, ecx
je 0x46539a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x8bc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e50b4
mov esp, ebp
pop ebp
ret