Function at 0x46897a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e68c2
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.00470830
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2028]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x203c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2040], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2048], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x202c], edi
mov dword [ebp - 0x204c], ebx
call fcn.00404170
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2038], ebx
mov dword [ebp - 0x2034], ebx
mov dword [ebp - 0x2030], ebx
call fcn.00453834
test al, al
je 0x468a1c
int1
cld
adc edx, ebx
sub dh, bl
xchg ebx, eax
in al, 0xaa
sub al, 0xeb
aad 0x31
mov ebp, 0x8be76646
mov ebp, 0xffffdfd4
call fcn.004537aa
test al, al
je 0x468a3b
cmp esi, 0xcfc1d0db
pop esp
xor al, 0xd1
lcall 0x73fd, 0xcba1241c
pop eax
rol esi, 1
pop eax
int 0xd6
lea eax, [ebp - 0x2038]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x468a81
sal byte [esp - 0x73], 0x85
fcomp st(7)
invalid
lea eax, [ebp - 0x2028]
mov ecx, edi
push eax
call fcn.00452f5f
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.0041ed70
mov eax, edi
jmp 0x468c90
call fcn.00453b70
test al, al
je 0x468a9a
jo 0x468a47
je 0x468af2
cvtps2pi mm3, qword [edi - 0x35e3a3b6]
xchg ebp, eax
and dh, al
invalid
call fcn.004538be
test al, al
je 0x468aba
pop edx
invalid
call fcn.004537aa
test al, al
je 0x468ae2
adc esp, dword [ecx - 0x53498b06]
jbe 0x468a5a
sub dword [esi], esi
xchg ebp, eax
out 0x19, al
inc edi
xlatb
jg 0x468ae0
jne 0x468b0d
and ah, 0xdc
jp 0x468ae9
movsd dword es:[edi], dword [esi]
push esi
fst qword [eax - 0x75]
xor eax, sym.imp.ADVAPI32.dll_RegCreateKeyExW
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2034]
xor ebx, ebx
mov edi, 0xf013f
push ebx
push eax
test esp, ecx
invalid
add dword [edi], ecx
add byte [ebx + 0x50], dl
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x203c]
push dword [ebp - 0x2038]
call esi
test eax, eax
je 0x468b32
and al, 0xff
mov ch, 0xc8
invalid
push dword [ebp - 0x2038]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2028]
push eax
call fcn.00452f5f
push ebx
jmp 0x468c7d
push ebx
lea eax, [ebp - 0x2030]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x2040]
push dword [ebp - 0x2034]
call esi
test eax, eax
je 0x468b69
push dword [ebp - 0x2034]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2030]
call esi
jmp 0x468b1a
call fcn.004538be
test al, al
je 0x468b93
mov bh, 0x95
scasd eax, dword es:[edi]
inc edx
stc
salc
xor bh, al
mov byte [0xc9d355c6], al
sub dh, byte [edx + 0x549d8fe]
add eax, 0x5d955167
xor cl, ch
das
jmp 0x337bac2f
push 0x2000
lea eax, [ebp - 0x2010]
push ebx
push eax
call fcn.00483520
add esp, 0xc
mov dword [ebp - 0x2044], 0x1000
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push ebx
push dword [ebp - 0x2048]
push dword [ebp - 0x2030]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2030]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2034]
call esi
salc
push dword [ebp - 0x2038]
call esi
lea eax, [ebp - 0x2010]
push eax
call fcn.00491bc7
pop ecx
test eax, eax
je 0x468b1a
call fcn.00453cc9
test al, al
je 0x468c23
invalid
push ecx
retf
cli
jnp 0x468be9
sub ebx, dword [edi + 0x70]
add dword [esi - 0x63664daf], esp
invalid
call fcn.00453c3f
test al, al
je 0x468c47
jp 0x468c0a
jecxz 0x468c16
rcl byte [ebx + 0x47]
pop ds
enter 0xffffffffffffe80c, 0x72
and eax, 0xc6950ee
mov ecx, 0xa86876cd
xchg edx, eax
test al, 0x92
fdiv qword [eax + 0x2e]
and eax, 0xfeafaee8
inc dword [eax + eax*8 + 0xbac1974]
test dword [esi + 0x9cf8a17], eax
pop esp
xchg ecx, eax
jl 0x468c9e
call fcn.00453bfa
test al, al
je 0x468c69
lodsb al, byte [esi]
or eax, dword [ebp - 0x3075e87a]
or dword [ecx + edx*4 + 0x7c], ebx
inc edx
push esp
jbe 0x468c41
dec esp
invalid
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2010]
push eax
call fcn.00404170
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.0041ed70
mov eax, dword [ebp - 0x202c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret