Function at 0x46555a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x187c
call fcn.005a41d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x7e
pop ebx
xor eax, eax
push ebx
mov word [ebp - 0x88], ax
xor esi, esi
lea eax, [ebp - 0x86]
push esi
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x88]
push 0x3f
push eax
call fcn.0045ddce
pop ecx
pop ecx
test eax, eax
je 0x4655cf
lea eax, [ebp - 0x88]
push 0x20
push eax
call fcn.0059289e
pop ecx
pop ecx
test eax, eax
jne 0x4655cf
lea eax, [ebp - 0x88]
push 9
push eax
call fcn.0059289e
pop ecx
pop ecx
test eax, eax
je 0x4655ea
push 0x5dd7f4
push 0x5db9e0
lea eax, [ebp - 0x88]
push 0x3f
push eax
call fcn.0058f42f
add esp, 0x10
xor eax, eax
push ebx
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push esi
push eax
call fcn.00596530
add esp, 0xc
push esi
lea eax, [ebp - 0x208]
push 0x3f
push eax
call fcn.00428a33
add esp, 0xc
xor eax, eax
push ebx
mov word [ebp - 0x188], ax
lea eax, [ebp - 0x186]
push esi
push eax
call fcn.00596530
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
lea eax, [ebp - 0x1878]
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x187c]
push eax
push 0x5df64c
push str.Softwarehao123JuziBrowser
push 0x80000001
mov dword [ebp - 0x187c], 1
mov dword [ebp - 0x1878], ebx
call edi
xor eax, eax
push ebx
mov word [ebp - 0x108], ax
lea eax, [ebp - 0x106]
push esi
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x3f
push eax
call fcn.00429311
pop ecx
pop ecx
push 4
pop ebx
lea eax, [ebp - 0x1874]
push eax
lea eax, [ebp - 0x186c]
push eax
lea eax, [ebp - 0x1870]
push eax
push str.ucount
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsJzbstall.exe
push 0x80000002
mov dword [ebp - 0x186c], esi
mov dword [ebp - 0x1870], ebx
mov dword [ebp - 0x1874], ebx
call edi
test eax, eax
jne 0x4656dd
cmp dword [ebp - 0x1870], ebx
je 0x4656e3
mov dword [ebp - 0x186c], esi
mov eax, 0x7fff
cmp dword [ebp - 0x186c], eax
jbe 0x4656f6
mov dword [ebp - 0x186c], eax
xor eax, eax
push 0x40e
mov word [ebp - 0x820], ax
lea eax, [ebp - 0x81e]
push esi
push eax
call fcn.00596530
xor eax, eax
add esp, 0xc
cmp ax, word [0x63f288]
jne 0x465728
call fcn.00404168
mov edi, eax
jmp 0x46572d
mov edi, 0x63f288
push dword [ebp - 0x186c]
lea eax, [ebp - 0x108]
push eax
call fcn.004292bd
movzx eax, al
push eax
call fcn.00428f9a
movzx eax, al
push eax
call fcn.00429189
movzx eax, al
push eax
xor eax, eax
cmp dword [ebp + 0xc], esi
push esi
push dword [ebp + 8]
sete al
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x88]
push eax
push edi
push str.typeinstallEndver_scid_smid_sumid_si_dir_diec_dos_dsafe_die_dflash_sch7_d
lea eax, [ebp - 0x820]
push 0x207
push eax
call fcn.0058f42f
add esp, 0x3c
xor eax, eax
push 0x1046
mov word [ebp - 0x1868], ax
lea eax, [ebp - 0x1866]
push esi
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x820]
push eax
push str.http:__log.123juzi.net_log.php
push 0x5e9d1c
lea eax, [ebp - 0x1868]
push 0x823
push eax
call fcn.0058f42f
add esp, 0x14
xor eax, eax
push 0x206
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push esi
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
push esi
push esi
push 0x1388
push 1
push esi
push esi
push esi
xor edx, edx
lea ecx, [ebp - 0x1868]
call fcn.0047b304
add esp, 0x20
test eax, eax
jne 0x46582d
cmp dword [ebp + 8], esi
je 0x46582d
lea edx, [ebp - 0x1868]
call fcn.0044b399
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret 8