Function at 0x46baf6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x840
mov eax, 0x5c2258
call fcn.004aa3a5
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x82c], edi
idiv edi
dec dword [ebx - 0x76afe7bb]
mov ebp, 0xfffff7d4
mov dword [ebp - 0x84c], ebx
call fcn.004023b0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x838], ebx
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x830], ebx
call fcn.004607a1
test al, al
je 0x46bb7b
mov bh, dh
add ch, byte [edi + esi*8 + 0x1046c6dd]
int3
call fcn.00460579
test al, al
je 0x46bba6
jne 0x46bb28
invalid
lea eax, [ebp - 0x838]
mov esi, 0x20119
push eax
push esi
xor ebx, ebx
push ebx
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x46bbed
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
call fcn.004045e0
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00402450
mov eax, edi
jmp 0x46bdeb
call fcn.004607e6
test al, al
je 0x46bc0d
push edi
add eax, 0x18eaad38
das
salc
sbb bl, byte [edi + esi*4 - 0x6620499]
hlt
lea eax, [ebp - 0x834]
push eax
push esi
push ebx
push dword [ebp - 0x840]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x46bc4f
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push eax
call fcn.004045e0
jmp 0x46bdd7
lea eax, [ebp - 0x830]
push eax
push esi
push ebx
push dword [ebp - 0x844]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x46bc86
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
jmp 0x46bc38
idiv edi
invalid
call fcn.0046030c
test al, al
je 0x46bcae
jg 0x46bc7f
pop eax
popfd
rcl ah, cl
mov bh, 0xa6
sti
mov dl, dh
sbb eax, dword [esi - 0x15f66862]
or al, 0x43
xchg byte [esi + 0xcea0997], bl
inc ebx
xchg ecx, eax
dec edi
xchg ebx, eax
imul edx, dword [eax + 0x33bc1bf1], 0x80068db
add byte [eax], al
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00486960
add esp, 0xc
mov dword [ebp - 0x848], 0x400
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x83c]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004606d2
test al, al
je 0x46bd22
rcl byte [edx + eax*2], cl
xor al, 0xd
aam 0x5f
inc edx
add eax, 0xd484ad4e
jae 0x46bc9c
packsswb mm0, qword [eax + 0x5e7fdecc]
in eax, 0x4e
rcl dword [esi + 0x30], 0x3e
and ah, ah
call fcn.0046016e
test al, al
je 0x46bd41
mov esp, 0x6f2ee465
sub eax, dword [edi + 0x7a]
imul edi, edx, 0xbb8d1e5e
jmp 0x2a0e77ec
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x810]
push eax
call fcn.0049899e
pop ecx
mov dword [ebp - 0x83c], eax
call fcn.004607e6
test al, al
je 0x46bd8e
sub eax, 0x7571ac1b
outsd dx, dword [esi]
mov dh, 0xb3
mov cl, 0xa5
xlatb
invalid
call fcn.0046009f
test al, al
je 0x46bdac
fisub dword [ebp - 0x79]
into
les esi, [ecx]
mov ecx, 0x1c09e383
push 0x3e
xchg edx, eax
adc dword [esi - 0x190fb528], 0xf7c4bd83
invalid
cmp dword [ebp - 0x83c], 0
mov ecx, dword [ebp - 0x82c]
jne 0x46bdc9
lea eax, [ebp - 0x828]
push eax
call fcn.004045e0
jmp 0x46bdd5
lea eax, [ebp - 0x810]
push eax
call fcn.004023b0
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x828]
call fcn.00402450
mov eax, dword [ebp - 0x82c]
call fcn.004aa360
ret