Function at 0x468050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
je 0x468294
jne 0x468294
movsx ecx, word [ebx + 0x10]
add byte [ebx + 0x3c], bl
mov dword [ecx], 0x41bb2e
push ebp
into
xor eax, edx
dec ebp
mov dh, 0x4c
dec edx
test esp, esp
test byte [ebp - 0x777af040], al
add dword [eax], eax
add byte [ebx - 0x77cf3bb], cl
add dword [edi], ecx
test byte [ebp], ch
add byte [eax], al
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4680fd
cmp eax, 2
jne 0x46831a
je 0x4680fd
jne 0x4680fd
call dword [0x1141a198]
movzx eax, word [reloc.winhttp.dll_WinHttpQueryDataAvailable]
push 0xabeaf8
mov dword [ebp - 0x14], 0x1019cce0
jp 0x468084
sbb ch, ah
test eax, 0xcc25d
test eax, 0xcccc1118
mov eax, 0x102c0e08
mov esi, 0xbb6d38
mov dword [ebp - 0x2c], 0x626180
mov dword [ebp - 0x48], 0xa0000065
mov esi, dword [edi*4 + 0x4270a0]
adc edx, dword [ecx + 0x14]
mov dword [0x10332040], eax
das
and al, 0xcb
jno 0x468119
pop ebp
ret 0xc
aad 0x5c
or eax, 0x4d8bd098
adc byte [edi], cl
test byte [ecx + 0xf000000], dl
test dword [ebx - 0x39000000], ecx
inc ebp
in al, dx
lodsb al, byte [esi]
pop ecx
or al, 0x10
mov ecx, dword [ebp + 0x10]
je 0x468197
jne 0x468197
mov dword [ebp - 0x14], 0x100c59ac
mov dword [0x1153ee00], eax
cmp dword [ebp - 4], 0x30
push 0xa86908
imul edx, dword [esi + 0xa], 0xa8f6973
adc dword [ebx + 0x6830fc7d], eax
or byte [ecx - 0x58], ch
add byte [ecx + 0x56], ch
or dh, byte [ebx + 0x69]
invalid
jge 0x468117
xor byte [eax + 8], ch
imul ebp, dword [eax + 0xa566900], 0xa8f6973
mov dword [esi + 0x2a4], ecx
mov dword [0xcfa614], ebx
push 0xae3f34
mov eax, dword [0x1153f6b8]
push 0x114881fc
fadd qword [0x438fa0]
test dword [ebx + 0xc], ebp
sahf
cmp dword [esi + 0x13], esp
invalid
shr eax, 1
push 0x46830e
ret
test esi, esi
je 0x468206
test ecx, ecx
je 0x468201
test cl, 1
je 0x4682e7
jne 0x4682e7
lea ecx, [ecx + edi + 0x44]
mov dword [ebx + 0xd3c], eax
mov ecx, dword [ebx - 0xc4]
mov dword [0x463988], eax
mov byte [0xd44b8c], 1
mov byte [0xceb116], al
lea edi, [ecx + eax*4]
mov eax, 0x101b34f4
lea ecx, [eax + 0x7c4]
xor eax, dword [eax]
cmp dword [edx], 0x1f
cmpsd dword [esi], dword es:[edi]
xchg ebp, eax
mov edx, dword [0x6f840929]
xchg ebx, esp
push ecx
xor al, 0xb8
or eax, 0x5e000000
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
mov dword [edi], ecx
xor eax, eax
pop edi
pop esi
je 0x4680c3
jne 0x4680c3
push 0x1022b6d9
push 0x50d104
push 0x10081f48
call dword [fcn.0045040c]
imul esi, dword [eax - 0x4c], 0xb4c86975
mov ecx, dword [0x491484]
push 0x10276b78
cmp edx, dword [ecx + 0xd0]
push 0xffffffffffffff8a
push esi
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
mov dword [edi], 0
jmp 0x468362
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
je 0x46824a
jne 0x46824a
and dword [0x43db84], 0
cmp dword [edi + 0x83c], 0
mov eax, 0x105cc948
test dl, 5
push 0xb0bda8
push 0x10213f54
movzx eax, byte [ebp - 0x61]
lea ecx, [ebp - 0x54c]
mov eax, 0x11537df0
jmp dword [eax*4 + 0x408df1]
jne 0x46831a
mov eax, ecx
jmp 0x468152
pop edi
push reloc.winhttp.dll_WinHttpCrackUrl
ret
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x46807c
ret