Function at 0x465cf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x238
mov eax, dword [0x4ed394]
xor eax, esp
mov dword [esp + 0x234], eax
mov eax, dword [esp + 0x23c]
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4f1ea8]
mov esi, dword [edi + 0x5c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], edi
cmp esi, dword [edi + 0x60]
jbe 0x465d2a
call fcn.0047a626
mov ebx, dword [edi + 0x50]
mov dword [esp + 0x20], ebx
mov ebp, esi
mov esi, dword [edi + 0x60]
mov dword [esp + 0x24], ebp
cmp dword [edi + 0x5c], esi
jbe 0x465d44
call fcn.0047a626
mov eax, dword [edi + 0x50]
test ebx, ebx
je 0x465d4f
cmp ebx, eax
je 0x465d54
call fcn.0047a626
cmp ebp, esi
je 0x466153
mov dword [esp + 0x1c], 0
test ebx, ebx
jne 0x465e51
call fcn.0047a626
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x465d7d
call fcn.0047a626
mov edi, dword [ebp + 0xb4]
cmp edi, dword [ebp + 0xb8]
jbe 0x465d90
call fcn.0047a626
mov esi, dword [ebp + 0xa8]
mov dword [esp + 0x18], edi
lea ebx, [ebx]
test ebx, ebx
jne 0x465e58
call fcn.0047a626
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x465db9
call fcn.0047a626
mov ebx, dword [ebp + 0xb8]
cmp dword [ebp + 0xb4], ebx
jbe 0x465dcc
call fcn.0047a626
mov eax, dword [ebp + 0xa8]
test esi, esi
je 0x465dda
cmp esi, eax
je 0x465ddf
call fcn.0047a626
cmp dword [esp + 0x18], ebx
je 0x465fef
test esi, esi
jne 0x465e5f
call fcn.0047a626
xor eax, eax
mov ecx, dword [esp + 0x18]
cmp ecx, dword [eax + 0x10]
jb 0x465e02
call fcn.0047a626
test esi, esi
jne 0x465e63
call fcn.0047a626
xor eax, eax
mov edx, dword [esp + 0x18]
cmp edx, dword [eax + 0x10]
jb 0x465e1b
call fcn.0047a626
cmp dword [esp + 0x1c], 0
jne 0x465fc0
test esi, esi
jne 0x465e67
call fcn.0047a626
xor eax, eax
mov ecx, dword [esp + 0x18]
cmp ecx, dword [eax + 0x10]
jb 0x465e3f
call fcn.0047a626
mov ebp, dword [esp + 0x18]
add ebp, 0x20
cmp dword [ebp + 0x14], 8
jb 0x465e6b
mov ebx, dword [ebp]
jmp 0x465e6d
mov eax, dword [ebx]
jmp 0x465d73
mov eax, dword [ebx]
jmp 0x465daf
mov eax, dword [esi]
jmp 0x465df4
mov eax, dword [esi]
jmp 0x465e0d
mov eax, dword [esi]
jmp 0x465e31
mov ebx, ebp
test esi, esi
jne 0x465eeb
call fcn.0047a626
xor eax, eax
mov edx, dword [esp + 0x18]
cmp edx, dword [eax + 0x10]
jb 0x465e86
call fcn.0047a626
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x2c]
push eax
push 0x20019
push 0
push ebx
call fcn.004659c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x42]
push edx
mov edi, eax
mov word [esp + 0x44], cx
call fcn.0047c520
add esp, 0xc
mov dword [esp + 0x30], 0x208
test esi, esi
jne 0x465eef
call fcn.0047a626
xor eax, eax
mov ecx, dword [esp + 0x18]
cmp ecx, dword [eax + 0x10]
jb 0x465ee0
call fcn.0047a626
cmp dword [ebp + 0x30], 8
jb 0x465ef3
mov eax, dword [ebp + 0x1c]
jmp 0x465ef6
mov eax, dword [esi]
jmp 0x465e78
mov eax, dword [esi]
jmp 0x465ed2
lea eax, [ebp + 0x1c]
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x3c]
push ecx
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test esi, esi
jne 0x465f5d
call fcn.0047a626
xor eax, eax
mov ecx, dword [esp + 0x18]
cmp ecx, dword [eax + 0x10]
jb 0x465f2b
call fcn.0047a626
cmp dword [ebp + 0x48], 0
jbe 0x465f84
test ebx, ebx
jne 0x465fc0
test esi, esi
jne 0x465f61
call fcn.0047a626
xor eax, eax
mov edx, dword [esp + 0x18]
cmp edx, dword [eax + 0x10]
jb 0x465f52
call fcn.0047a626
cmp dword [ebp + 0x4c], 8
jb 0x465f65
mov eax, dword [ebp + 0x38]
jmp 0x465f68
mov eax, dword [esi]
jmp 0x465f1d
mov eax, dword [esi]
jmp 0x465f44
lea eax, [ebp + 0x38]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0047982d
add esp, 8
test eax, eax
jne 0x465fc0
mov dword [esp + 0x1c], 1
jmp 0x465fc0
test esi, esi
jne 0x465fb1
call fcn.0047a626
xor eax, eax
mov ecx, dword [esp + 0x18]
cmp ecx, dword [eax + 0x10]
jb 0x465f9d
call fcn.0047a626
cmp dword [ebp + 0x2c], 0
jbe 0x465fb5
test ebx, ebx
jne 0x465fc0
mov dword [esp + 0x1c], 1
jmp 0x465fc0
mov eax, dword [esi]
jmp 0x465f8f
xor edx, edx
test edi, edi
sete dl
mov dword [esp + 0x1c], edx
test esi, esi
jne 0x465feb
call fcn.0047a626
xor eax, eax
mov ecx, dword [esp + 0x18]
cmp ecx, dword [eax + 0x10]
jb 0x465fd9
call fcn.0047a626
add dword [esp + 0x18], 0x70
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
jmp 0x465da0
mov eax, dword [esi]
jmp 0x465fcb
cmp dword [esp + 0x1c], 0
jne 0x46611f
mov edi, dword [esp + 0x20]
test edi, edi
jne 0x4660df
call fcn.0047a626
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x466017
call fcn.0047a626
test edi, edi
jne 0x4660e6
call fcn.0047a626
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x466030
call fcn.0047a626
mov esi, dword [ebp + 0x9c]
cmp esi, dword [ebp + 0xa0]
jbe 0x466043
call fcn.0047a626
mov ebx, dword [ebp + 0x90]
lea esp, [esp]
test edi, edi
jne 0x4660ed
call fcn.0047a626
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x466069
call fcn.0047a626
mov edi, dword [ebp + 0xa0]
cmp dword [ebp + 0x9c], edi
jbe 0x46607c
call fcn.0047a626
mov eax, dword [ebp + 0x90]
test ebx, ebx
je 0x46608a
cmp ebx, eax
je 0x46608f
call fcn.0047a626
cmp esi, edi
je 0x4660fc
test ebx, ebx
jne 0x4660f4
call fcn.0047a626
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x4660a8
call fcn.0047a626
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
jb 0x4660b3
mov eax, dword [eax]
mov ecx, eax
call fcn.00465a60
test eax, eax
jne 0x46611f
test ebx, ebx
jne 0x4660f8
call fcn.0047a626
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x4660d3
call fcn.0047a626
mov edi, dword [esp + 0x20]
add esi, 0x1c
jmp 0x466050
mov eax, dword [edi]
jmp 0x46600d
mov eax, dword [edi]
jmp 0x466026
mov eax, dword [edi]
jmp 0x46605f
mov eax, dword [ebx]
jmp 0x46609e
mov eax, dword [ebx]
jmp 0x4660c9
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x46614b
call fcn.0047a626
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x466115
call fcn.0047a626
mov edi, dword [esp + 0x28]
push ebp
call fcn.00466650
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x46614f
call fcn.0047a626
xor eax, eax
cmp ebp, dword [eax + 0x10]
jb 0x466138
call fcn.0047a626
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x34]
add ebp, 0xc0
jmp 0x465d33
mov eax, dword [eax]
jmp 0x46610b
mov eax, dword [eax]
jmp 0x46612e
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047946c
add esp, 0x238
ret 4