Function at 0x46bdc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2003c
call fcn.004936b0
push ebx
push esi
push edi
mov edi, dword [0x4c1e48]
push 1
push 0
push 0xffffffffffffffff
mov esi, ecx
push 0
mov ecx, edi
mov dword [esp + 0x28], edi
call fcn.00471c00
test esi, esi
jne 0x46bdfc
mov esi, 0x57
jmp 0x46c134
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x46c134
mov ecx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push eax
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
call ebx
mov esi, eax
test esi, esi
je 0x46be4c
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46c134
mov eax, dword [esp + 0x1c]
dec eax
cmp eax, 6
ja case.0x46be5a.5
jmp dword [eax*4 + 0x46c158]
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push edx
push eax
mov dword [esp + 0x28], 4
call ebx
mov esi, eax
test esi, esi
jne 0x46c134
mov ecx, dword [esp + 0x20]
push 0x18
push eax
push ecx
mov eax, edi
call fcn.004010e0
jmp 0x46c134
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0
push eax
push ecx
mov dword [esp + 0x28], 0
call ebx
mov esi, eax
test esi, esi
jne 0x46c003
mov eax, dword [esp + 0x10]
test eax, eax
je 0x46c003
push 1
shr eax, 1
push esi
add eax, 2
push eax
push esi
mov ecx, edi
call fcn.00471c00
cmp eax, 1
je 0x46bf00
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [edi + 0x17], 0
jne 0x46bf0b
mov esi, dword [edi + 0xc]
jmp 0x46bf0d
mov esi, edi
test byte [esi + 0x15], 8
je 0x46bf1a
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x46bf33
test byte [esi + 0x15], 4
je 0x46bf2e
mov eax, esi
call fcn.0042f5b0
mov edi, dword [esi + 8]
jmp 0x46bf45
cmp al, 2
jne 0x46bf40
call fcn.00401000
mov edi, eax
jmp 0x46bf45
mov edi, 0x4c3fa8
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 0
push ecx
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x46bf9d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x46bf9d
shr eax, 1
xor ecx, ecx
mov dword [edi + eax*2], ecx
cmp dword [esp + 0x1c], 7
jne 0x46bfa2
mov eax, edi
cmp word [eax], 0
jne 0x46bf98
cmp word [eax + 2], 0
mov ecx, 0xa
mov word [eax], cx
je 0x46bfa2
add eax, 2
jmp 0x46bf83
xor edx, edx
mov word [edi], dx
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46bfa7
mov ebx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, ebx
call fcn.00412c30
cmp byte [ebx + 0x17], 0
jne 0x46bfce
mov eax, dword [ebx + 0xc]
jmp 0x46bfd0
mov eax, ebx
cmp byte [eax + 0x17], 2
jne 0x46bffa
cmp dword [0x4c4b0c], 0
je 0x46bffa
mov ecx, 0x4c4b00
call fcn.00403ca0
test eax, eax
jne 0x46c134
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
and byte [eax + 0x15], 0x86
jmp 0x46c134
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46c134
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x4c]
push edx
push 0
push 0
push eax
push ecx
mov dword [esp + 0x28], 0x1fffe
call ebx
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x46c134
mov eax, dword [esp + 0x10]
push 1
push esi
lea ecx, [eax + eax]
push ecx
push esi
mov ecx, edi
call fcn.00471c00
cmp eax, 1
jne 0x46bef5
cmp byte [edi + 0x17], 0
jne 0x46c070
mov esi, dword [edi + 0xc]
jmp 0x46c072
mov esi, edi
test byte [esi + 0x15], 8
je 0x46c07f
mov eax, esi
call fcn.00401160
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x46c098
test byte [esi + 0x15], 4
je 0x46c093
mov eax, esi
call fcn.0042f5b0
mov eax, dword [esi + 8]
jmp 0x46c0a8
cmp al, 2
jne 0x46c0a3
call fcn.00401000
jmp 0x46c0a8
mov eax, 0x4c3fa8
xor edx, edx
mov word [eax], dx
mov ecx, 8
mov esi, str.0123456789ABCDEF
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
cmp dword [esp + 0x10], edx
jbe 0x46c0fd
jmp 0x46c0d0
movzx ecx, byte [esp + esi + 0x48]
mov edi, ecx
shr ecx, 4
and edi, 0xf
mov di, word [esp + edi*2 + 0x24]
and ecx, 0xf
mov cx, word [esp + ecx*2 + 0x24]
mov word [eax + edx*2 + 2], di
mov word [eax + edx*2], cx
inc esi
add edx, 2
cmp esi, dword [esp + 0x10]
jb 0x46c0d0
xor ecx, ecx
mov word [eax + edx*2], cx
mov eax, dword [esp + 0x18]
cmp byte [eax + 0x17], cl
jne 0x46c10f
mov eax, dword [eax + 0xc]
cmp byte [eax + 0x17], 2
jne 0x46c150
cmp dword [0x4c4b0c], ecx
je 0x46c150
mov ecx, 0x4c4b00
call fcn.00403ca0
test eax, eax
je 0x46bef5
mov esi, 0x65e
mov ecx, dword [ebp + 8]
test esi, esi
setne dl
movzx eax, dl
push esi
push eax
push ecx
call fcn.0042ecf0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
and byte [eax + 0x15], 0x86
jmp case.0x46be5a.5