Function at 0x464fee
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x848
mov eax, 0x5e4f47
call fcn.0046d2ba
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x830], eax
xor edi, edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp + 0x1c]
push eax
mov dword [ebp - 0x854], edi
call fcn.00403b30
mov dword [ebp - 4], edi
mov dword [ebp - 0x82c], edi
mov dword [ebp - 0x83c], edi
mov dword [ebp - 0x838], edi
mov dword [ebp - 0x834], edi
call fcn.004732f2
test al, al
je 0x46507a
push ebp
aad 0x2d
cwde
cld
mov ah, 0x6e
sbb byte [ecx + 0x4b77e252], dh
xchg esi, eax
push ebp
add byte [ecx], ah
adc dword [eax + eax], edx
call fcn.004737cc
test al, al
je 0x4650a0
ljmp 0x6721:0x78fecc9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x82c]
push eax
mov esi, 0x20119
xor edi, edi
push esi
push edi
push dword [ebp - 0x844]
push reloc.WS2_32.dll_closesocket
call ebx
test eax, eax
je 0x4650de
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x828]
push eax
call fcn.00454193
jmp 0x4652f5
lea eax, [ebp - 0x83c]
push eax
push esi
push edi
push str.SoftWare
push dword [ebp - 0x82c]
call ebx
test eax, eax
je 0x465106
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4650c7
lea eax, [ebp - 0x838]
push eax
push esi
push edi
push dword [ebp - 0x840]
push dword [ebp - 0x83c]
call ebx
mov dword [ebp - 0x840], eax
call fcn.0047362e
test al, al
je 0x465155
sal byte [ecx + ebp - 0x65], 0x7d
cli
wait
jge 0x465129
into
jne 0x465150
out dx, eax
invalid
mov esi, 0x20119
cmp dword [ebp - 0x840], 0
je 0x465179
push dword [ebp - 0x83c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
jmp 0x4650c7
lea eax, [ebp - 0x834]
push eax
push esi
push edi
push dword [ebp - 0x848]
push dword [ebp - 0x838]
call ebx
test eax, eax
je 0x4651aa
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x838]
jmp 0x46516a
call fcn.004735a4
test al, al
je 0x4651c3
mov bh, 0x94
dec ecx
adc eax, 0xc2656bcf
and byte [edx + 0x4d], 0x42
xor al, 0xe7
mov es, eax
push 0x800
lea eax, [ebp - 0x810]
push edi
push eax
call fcn.004830b0
add esp, 0xc
mov dword [ebp - 0x84c], 0x400
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push dword [ebp - 0x850]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x834]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0x838]
call ebx
call fcn.0047337c
test al, al
je 0x465233
sbb bl, byte [0x76e1f147]
aad 0xd0
xchg esi, eax
inc eax
jmp 0x30f7d8e6
call fcn.0047355f
test al, al
je 0x46524c
xchg esi, eax
cli
je 0x46527e
stosd dword es:[edi], eax
and ecx, dword [edx + 0x47]
pushal
int3
call fcn.00473811
test al, al
je 0x46526a
jecxz 0x465291
jp 0x465240
cmc
or word [esi + 0x1d8732dd], bp
stosb byte es:[edi], al
and dl, byte [eax + 0x2742b858]
adc eax, 0xc4b5ff01
idiv edi
dec dword [ebx + 0x5e800035]
add bh, bh
salc
xor al, byte [edi - 0x6fdd55e3]
pop eax
mov eax, 0x1152742
push dword [ebp - 0x83c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
call fcn.0047362e
test al, al
je 0x46529a
hlt
or eax, 0x12665a9c
xor eax, 0xe8a1b60f
sbb esp, esp
add byte [eax], al
call fcn.004736b8
test al, al
je 0x4652c2
pop ebx
jmp 0x46525e
lea eax, [ebp - 0x810]
push eax
call fcn.00491757
pop ecx
mov ecx, dword [ebp - 0x830]
test eax, eax
jne 0x4652e7
lea eax, [ebp - 0x828]
push eax
call fcn.00454193
jmp 0x4652f3
lea eax, [ebp - 0x810]
push eax
call fcn.00403b30
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x828]
call fcn.0041f8c0
mov eax, dword [ebp - 0x830]
call fcn.0046d264
ret