Function at 0x468020
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4ebedc
mov eax, dword fs:[0]
push eax
mov eax, 0x32428
call fcn.004e03c0
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x32424], eax
push ebx
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x32438]
mov dword fs:[0], eax
mov edi, dword [esp + 0x3244c]
push 0x18fff
lea eax, [esp + 0x439]
push 0
push eax
mov dword [esp + 0x20], edi
mov byte [esp + 0x440], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
xor esi, esi
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x32440], esi
jmp 0x4680c8
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
push 0x400
lea ecx, [esp + 0x38]
push 0
push ecx
call sub.MSVCR90.dll_memset
push 0x19000
lea edx, [esp + 0x19444]
push 0
push edx
call sub.MSVCR90.dll_memset
push 0x19000
lea eax, [esp + 0x450]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0x24
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x19438]
push edx
lea eax, [esp + 0x28]
push eax
push 0
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x48]
push edx
push esi
push edi
mov dword [esp + 0x3c], 0x400
mov dword [esp + 0x38], 0x19000
mov dword [esp + 0x40], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
inc esi
cmp byte [esp + 0x34], 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esi
je 0x46839c
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x19434]
cmp eax, 1
jne 0x46816e
test dl, dl
je 0x46839c
cmp byte [esp + 0x32448], 0
je 0x46828f
sub eax, 1
je 0x46822b
sub eax, 3
jne 0x46839c
lea eax, [esp + 0x34]
xor bl, bl
mov dword [esp + 0x10], edx
xor esi, esi
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4681a0
sub eax, edi
je 0x4681e1
jmp 0x4681b0
movsx eax, byte [esp + esi + 0x34]
push eax
call dword [sym.imp.MSVCR90.dll_toupper]
add bl, al
lea eax, [esp + 0x38]
add esp, 4
inc esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4681d0
sub eax, edx
cmp esi, eax
jb 0x4681b0
mov edx, dword [esp + 0x10]
movsx eax, bl
and eax, 0x8000001f
jns 0x4681f0
dec eax
or eax, 0xffffffe0
inc eax
movsx ecx, al
mov eax, dword [esp + 0x14]
and ecx, 0x1f
push 4
ror edx, cl
lea ecx, [esp + 0x14]
push ecx
push 4
mov dword [esp + 0x1c], edx
push 0
lea edx, [esp + 0x44]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x46839c
push 0
push str.Encrypt_err
jmp 0x46838f
lea edx, [esp + 0x434]
push edx
lea eax, [esp + 0x19438]
push eax
push 0x101e7d8
push 1
call fcn.004915e0
lea eax, [esp + 0x444]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x468254
sub eax, edx
push eax
lea ecx, [esp + 0x438]
push ecx
push 1
push 0
lea edx, [esp + 0x44]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x46839c
push 0
push str.Encrypt_err2
lea eax, [esp + 0x3c]
push eax
jmp 0x468394
sub eax, 1
je 0x468339
sub eax, 3
jne 0x46839c
lea eax, [esp + 0x34]
xor bl, bl
mov dword [esp + 0x10], edx
xor esi, esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4682b0
sub eax, edi
je 0x4682f1
jmp 0x4682c0
movsx ecx, byte [esp + esi + 0x34]
push ecx
call dword [sym.imp.MSVCR90.dll_toupper]
add bl, al
lea eax, [esp + 0x38]
add esp, 4
inc esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4682e0
sub eax, edx
cmp esi, eax
jb 0x4682c0
mov edx, dword [esp + 0x10]
movsx eax, bl
and eax, 0x8000001f
jns 0x468300
dec eax
or eax, 0xffffffe0
inc eax
movsx ecx, al
and ecx, 0x1f
rol edx, cl
mov ecx, dword [esp + 0x14]
push 4
lea eax, [esp + 0x38]
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x46839c
push 0
push str.Decrypt_err
lea edx, [esp + 0x3c]
push edx
jmp 0x468394
lea eax, [esp + 0x434]
push eax
lea ecx, [esp + 0x19438]
push ecx
push 0x101e7d8
push 0
call fcn.004915e0
lea eax, [esp + 0x444]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x468362
sub eax, edx
push eax
lea edx, [esp + 0x438]
push edx
push 1
push 0
lea eax, [esp + 0x44]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x46839c
push 0
push str.Decrypt_err2
lea ecx, [esp + 0x3c]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x30], 0x103
jne 0x4680c0
mov dword [esp + 0x32440], 0xffffffff
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x32438]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x32424]
xor ecx, esp
call fcn.004e0148
add esp, 0x32434
ret