Function at 0x46be62
Capabilities:
Contain obfuscated stackstrings
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x4b6074]
mov esi, ecx
mov ebx, 0x212
lea edi, [esp + 0x12]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push 0
push edi
call fcn.00472060
add esp, 0xc
lea eax, [esp + 0xc]
mov dword [esp + 4], ebx
push eax
push str.SoftwareSimonTathamPuTTY
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x46bee8
cmp byte [0x4ba2f0], 0
je 0x46bec2
mov ecx, dword [0x4ba2f8]
jmp 0x46bf52
push str.shell32.dll
call fcn.00466b09
add esp, 4
test eax, eax
mov dword [0x4ba2f4], eax
je 0x46bf43
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
jmp 0x46bf45
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push edi
push ecx
push 0
push str.RandSeedFile
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46bf0f
cmp dword [esp + 8], 1
je 0x46bf14
mov byte [esp + 0x12], 0
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x12], 0
je 0x46beae
mov eax, esp
lea ecx, [esp + 0x12]
mov edx, esi
push eax
call fcn.0046c53c
add esp, 4
test al, al
je 0x46beae
jmp 0x46c093
xor ecx, ecx
mov dword [0x4ba2f8], ecx
mov byte [0x4ba2f0], 1
test ecx, ecx
je 0x46bff0
xor ebx, ebx
push edi
push ebx
push ebx
push 0x1c
push ebx
call ecx
test eax, eax
js 0x46bfa4
push edi
call fcn.0047e5a0
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.0046c53c
add esp, 4
test al, al
jne 0x46c093
push edi
push ebx
push ebx
push 0x1a
push ebx
call dword [0x4ba2f8]
test eax, eax
js 0x46bff0
push edi
call fcn.0047e5a0
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.0046c53c
add esp, 4
test al, al
jne 0x46c093
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, 0x212
push ebx
push edi
push str.HOMEDRIVE
call ebp
sub ebx, eax
lea eax, [esp + eax + 0x12]
push ebx
push eax
push str.HOMEPATH
call ebp
test eax, eax
je 0x46c04f
push edi
call fcn.0047e5a0
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.0046c53c
add esp, 4
test al, al
jne 0x46c093
push 0x212
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
call fcn.0047e5a0
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.0046c53c
add esp, 4
test al, al
je 0x46c098
mov esi, dword [esp]
jmp 0x46c09b
xor esi, esi
dec esi
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0046ef41
mov eax, esi
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret