Function at 0x46563a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x838
mov eax, 0x5e5f56
call fcn.0046d2ba
push esi
pop edi
pop esi
add al, ch
jno 0x4656c3
add byte [eax], al
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x830], eax
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp + 0x14]
push eax
mov dword [ebp - 0x844], ebx
call fcn.00403b30
mov dword [ebp - 4], ebx
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x834], ebx
call fcn.0047362e
test al, al
je 0x4656a4
idiv edi
dec dword [ebx - 0x76afebbb]
popfd
mov esp, 0xe8fffff7
mov ch, 0xe4
stc
dec dword [ecx - 0x627603a3]
aam 0xf7
invalid
out dx, al
loope 0x465669
pop esp
leave
stosb byte es:[edi], al
loopne 0x465640
retf
call fcn.004736b8
test al, al
je 0x4656cc
movsd dword es:[edi], dword [esi]
invalid
push eax
cmpsb byte [esi], byte es:[edi]
pushal
inc ebp
xor dh, byte [ebx]
and byte [edi - 0x2b7a72d6], dl
idiv edi
call dword [eax + 0x68]
sbb dword [ecx], eax
add al, byte [eax]
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x465705
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x828]
push eax
call fcn.00454193
jmp 0x4658f7
call fcn.0047337c
test al, al
je 0x46571e
bnd ret 0xccc5
invalid
call fcn.0047355f
test al, al
je 0x465737
loop 0x465710
mov ch, 0x17
popfd
jbe 0x465738
pop edx
mov esi, 0xdc199ad8
xchg edx, eax
ret 0xe838
call fcn.00473811
aad 0xe0
add byte [eax], al
test al, al
je 0x465755
mov esp, 0x3eb4ce26
push edi
cli
mov esp, 0x52feb9e3
pop ecx
ljmp 0xb779
lea eax, [ebp - 0x834]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x83c]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x46579e
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x828]
push eax
call fcn.00454193
push ebx
jmp 0x4658f9
call fcn.00473490
test al, al
je 0x4657ba
pop edi
sbb cl, byte [ebx + 0x108c628d]
sbb al, 0xd9
mov ebp, 0x2dda3eb4
invalid
call fcn.004733c1
test al, al
je 0x4657e3
mul byte [eax + ebx*4 - 0x12]
jp 0x465792
dec edi
pop es
ror dl, 0x27
xchg ecx, eax
popfd
psrlq mm6, mm7
pop esi
inc edx
int 0x68
adc dh, byte [edx + 0x46]
salc
pop esp
mov byte [0xd18f24e], al
push ds
out 0x68, eax
add byte [eax], cl
add byte [eax], al
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.004830b0
add esp, 0xc
mov dword [ebp - 0x840], 0x400
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x838]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call fcn.0047362e
test al, al
je 0x46584c
pop es
push edi
sub ecx, edi
pop ds
inc esp
out 0x18, eax
lds edx, [eax + 0x21]
pop ds
fidiv dword [edi - 0x8f2c6aa]
mov ecx, 0x367e8b
popal
rcr ch, cl
sbb edi, dword [ebx + 0x14]
push edi
call fcn.00473925
call fcn.00473925
test al, al
je 0x46586f
jns 0x465884
stosd dword es:[edi], eax
loopne 0x4658d4
test eax, 0xa2bfbfc1
stosb byte es:[edi], al
push edi
sbb ebp, dword [ebp + 0x36]
invalid
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
salc
lea eax, [ebp - 0x810]
push eax
call fcn.00491757
mov ebx, eax
pop ecx
mov dword [ebp - 0x838], ebx
call fcn.004732f2
test al, al
je 0x4658be
inc ebx
and eax, 0xedd9e311
mov bh, 0x60
clc
popal
stc
pushfd
or eax, ecx
pop esi
mov byte [eax + 0x16b13c61], cl
mov ebx, dword [ebp - 0x838]
call fcn.004738e0
test al, al
je 0x4658dd
push ecx
cli
jne 0x4658f3
xor esi, dword [esi - 0x46a86206]
jne 0x465923
dec edi
pushal
and byte [edx + 0x772b8d72], 1
les ecx, [ebx - 0x82f73]
inc dword [ebp + 0x9840fdb]
invalid
mov ecx, dword [ebp - 0x830]
test ebx, ebx
je 0x4656f4
lea eax, [ebp - 0x810]
push eax
call fcn.00403b30
cmp edx, esp
stc
jmp [edx]
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.0041f8c0
mov eax, dword [ebp - 0x830]
call fcn.0046d264
ret
mov eax, 0x2040
call fcn.0046cf20
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2028]
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x203c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2040], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2048], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x202c], ebx
mov dword [ebp - 0x204c], esi
call fcn.00403b30
mov dword [ebp - 4], esi
mov dword [ebp - 0x2038], esi
mov dword [ebp - 0x2034], esi
mov dword [ebp - 0x2030], esi
call fcn.0047362e
test al, al
je 0x4659bc
push esi
and dword [edx - 0x31], esp
add byte [eax - 0x67bd5e18], 0x11
adc dword [esi], ebp
invalid
call fcn.00473925
test al, al
je 0x4659e5
ret
lea eax, [ebp - 0x2038]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x465a2b
lea eax, [ebp - 0x2028]
mov ecx, ebx
push eax
call fcn.00454193
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.0041f8c0
mov eax, ebx
jmp 0x465c1d
call fcn.004732f2
test al, al
je 0x465a49
daa
xor al, 0xd
add al, 0xf7
mov eax, ss
leave
dec edx
popfd
fmul dword [esp + eax - 0x40fbc170]
xchg byte [eax - 0x48], cl
call fcn.004738e0
test al, al
je 0x465a68
cmpsb byte [esi], byte es:[edi]
cli
scasb al, byte es:[edi]
out dx, eax
test dword [ebx + eax - 0x7deea676], edi
sbb ebp, dword [edx + 0x79197e2d]
sbb al, 4
fist word [ebx + 0x78358b20]
sbb byte [esi], 0x8d
test esp, ecx
invalid
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2034]
xor ebx, ebx
push ebx
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x203c]
push dword [ebp - 0x2038]
call esi
test eax, eax
je 0x465ab7
push dword [ebp - 0x2038]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2028]
push eax
call fcn.00454193
push ebx
jmp 0x465c0a
push ebx
lea eax, [ebp - 0x2030]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x2040]
push dword [ebp - 0x2034]
call esi
test eax, eax
je 0x465af2
push dword [ebp - 0x2034]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2030]
call esi
jmp 0x465a9f
int3
call fcn.00473856
test al, al
je 0x465b0f
jb 0x465b2d
jle 0x465adc
push eax
in al, dx
invalid
call fcn.0047351a
test al, al
je 0x465b2c
mov bh, 0xce
mov al, 0xd8
mov dword [0xccd015b7], eax
mov al, byte [0xd3c1dc94]
invalid
call fcn.004733c1
test al, al
je 0x465b49
nop
fadd dword [eax]
add byte [eax + eax*8 + 0x2c851474], al
xchg edi, eax
test dword [edi + edx*4], ebp
xor edi, dword [ebx - 0x47]
dec esp
mov dr6, ebx
or al, 0xe6
add eax, 0xbd21bede
xchg esi, eax
mov dh, 0x40
push 0x2000
xor ebx, ebx
lea eax, [ebp - 0x2010]
push ebx
push eax
call fcn.004830b0
add esp, 0xc
mov dword [ebp - 0x2044], 0x1000
lea eax, [ebp - 0x2044]
push eax
lea eax, [ebp - 0x2010]
push eax
push ebx
push ebx
push dword [ebp - 0x2048]
push dword [ebp - 0x2030]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2030]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2034]
call esi
push dword [ebp - 0x2038]
call esi
lea eax, [ebp - 0x2010]
push eax
call fcn.00491757
pop ecx
test eax, eax
je 0x465a9f
call fcn.00473811
test al, al
je 0x465bdc
jbe 0x465c31
sbb dword [ebx + 0x6b], eax
mov eax, dword [0xbf956613]
fisubr dword [esi + 0x11]
xlatb
dec esp
push cs
int3
call fcn.0047396a
test al, al
je 0x465bf6
iretd
mov ecx, dword [ebp - 0x202c]
lea eax, [ebp - 0x2010]
push eax
call fcn.00403b30
push 0
push 1
lea ecx, [ebp - 0x2028]
call fcn.0041f8c0
mov eax, dword [ebp - 0x202c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret
sal dword [ecx], 1
add byte [ebx + 0x55c35de5], cl
push ebp