Function at 0x460e84cf
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x530
mov eax, dword [0x460ec018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x460ec531], 0
push ebx
push esi
push edi
jne 0x460e879c
push ecx
xor ebx, ebx
mov byte [0x460ec531], 1
lea edx, [ebp - 0x518]
mov byte [0x460ec532], bl
xor ecx, ecx
call fcn.460e79c6
test eax, eax
je 0x460e879c
xor edi, edi
lea esi, [ebp - 0x518]
push 0x5c
inc edi
lea esi, [esi + eax*2]
pop ecx
jmp 0x460e8533
cmp word [esi], cx
je 0x460e8542
sub esi, 2
inc edi
lea eax, [ebp - 0x518]
cmp esi, eax
jne 0x460e852a
cmp word [esi], cx
jne 0x460e8546
dec edi
add esi, 2
test edi, edi
je 0x460e879c
cmp dword [0x460ec72c], 2
lea eax, [ebp - 0x520]
push eax
push 9
mov dword [ebp - 0x520], ebx
push ebx
jne 0x460e8579
push 0x46085f90
push reloc.msls31.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x460e8589
push 0x46085fec
push reloc.msls31.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x460e877f
mov ecx, ebx
mov dword [ebp - 0x51c], ecx
push ebx
push ebx
xor eax, eax
mov dword [ebp - 0x524], 0x104
cmp dword [0x460ec72c], 2
push ebx
mov word [ebp - 0x310], ax
push ebx
jne 0x460e85de
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x310]
push eax
push ecx
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, eax
mov eax, dword [ebp - 0x524]
jmp 0x460e8643
lea eax, [ebp - 0x528]
mov dword [ebp - 0x528], 0x104
push eax
lea eax, [ebp - 0x108]
mov byte [ebp - 0x108], bl
push eax
push ecx
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x52c], eax
test eax, eax
jne 0x460e876f
push ebx
push 0x104
lea eax, [ebp - 0x310]
xor ecx, ecx
push eax
push dword [ebp - 0x528]
lea edx, [ebp - 0x108]
call fcn.460e952e
mov ecx, dword [ebp - 0x52c]
mov dword [ebp - 0x524], eax
test ecx, ecx
jne 0x460e876f
test eax, eax
je 0x460e876f
inc dword [ebp - 0x51c]
mov edx, 0x103
cmp eax, edx
jb 0x460e866a
mov eax, edx
mov dword [ebp - 0x524], eax
lea edx, [eax + eax]
cmp edx, 0x208
jae 0x460e87b5
xor ecx, ecx
inc eax
mov word [ebp + edx - 0x310], cx
mov ecx, dword [ebp - 0x51c]
cmp eax, edi
jne 0x460e8599
lea edx, [ebp - 0x310]
mov ecx, esi
call fcn.460e7969
test eax, eax
je 0x460e86ae
mov ecx, dword [ebp - 0x51c]
jmp 0x460e8599
xor eax, eax
mov dword [ebp - 0x51c], ebx
inc eax
lea ecx, [ebp - 0x51c]
cmp dword [0x460ec72c], 2
push ecx
push eax
mov byte [0x460ec532], al
push ebx
jne 0x460e86e3
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x460e86f6
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x460e8758
cmp dword [0x460ec72c], 2
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x52c]
mov dword [ebp - 0x528], 4
push eax
lea eax, [ebp - 0x530]
push eax
push ebx
jne 0x460e8736
push 0x46086034
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x460e8747
push 0x4608604c
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x460e8758
mov al, byte [ebp - 0x52c]
and al, 1
mov byte [0x460ec532], al
cmp dword [ebp - 0x51c], ebx
je 0x460e876c
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
inc ebx
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x460e879c
cmp edi, 0xc
jne 0x460e879c
mov edx, 0x4608601c
mov ecx, esi
call fcn.460e7969
test eax, eax
jne 0x460e879c
inc eax
mov byte [0x460ec532], al
jmp 0x460e87a1
mov al, byte [0x460ec532]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
movzx eax, al
pop ebx
call fcn.460ea320
mov esp, ebp
pop ebp
ret
call fcn.460ea46a
int3