Function at 0x48f440
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
call fcn.00487a00
mov ecx, dword [0x5a23ec]
push eax
call fcn.0045e98e
mov edx, dword [esi]
mov ebx, eax
xor eax, eax
cmp byte [edx + 0x14ec], al
lea edi, [edx + 0x14e8]
cmove edi, eax
xor ecx, ecx
mov esi, edi
test edi, edi
jne 0x48f4c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c40]
test eax, eax
je 0x48f48c
cmp word [eax], cx
jne 0x48f49b
cmp byte [ebx + 0xd], cl
je 0x48f499
lea eax, [ebx + 0xe]
cmp word [eax], cx
jne 0x48f49b
mov eax, ecx
test eax, eax
je 0x48f4c4
cmp word [eax], cx
je 0x48f4c4
mov ecx, dword [0x5a23ec]
push eax
call fcn.00463b01
xor esi, esi
test eax, eax
js 0x48f4cd
mov ecx, dword [0x5a23ec]
push eax
call fcn.00463add
mov esi, eax
test esi, esi
je 0x48f4cd
mov al, byte [esi + 5]
jmp 0x48f4d4
mov ecx, ebx
call fcn.004a2a56
mov edi, dword [ebp + 8]
mov byte [edi], al
test esi, esi
je 0x48f4e2
mov al, byte [esi + 6]
jmp 0x48f4e9
mov ecx, ebx
call fcn.004a2686
mov edx, dword [ebp + 0xc]
mov byte [edx], al
mov cl, byte [edi]
cmp cl, 0xf
jbe 0x48f50a
cmp al, 0xf
jbe 0x48f50a
mov eax, dword [ebp - 4]
xor cl, cl
mov byte [edx], 0x10
mov byte [edi], 0x10
mov byte [eax + 0x11], 7
jmp 0x48f571
cmp cl, 0x10
jb 0x48f516
push 7
pop ecx
mov byte [edi], cl
mov al, byte [edx]
cmp al, 0x10
jb 0x48f521
mov byte [edx], 0
xor al, al
mov cl, byte [edi]
cmp cl, al
jne 0x48f564
mov eax, dword [ebp - 4]
mov ecx, dword [0x5a23f0]
push dword [eax]
call fcn.0046b4c0
test al, al
je 0x48f550
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [0x5a23ec]
inc edx
mov cl, byte [ecx]
shl edx, cl
test dword [eax + 0xeb0], edx
jne 0x48f561
mov edx, dword [ebp + 0xc]
cmp byte [edx], 0
setne al
dec al
and al, 7
mov byte [edi], al
jmp 0x48f564
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov al, byte [edi]
mov byte [ecx + 0x11], al
mov cl, byte [edx]
mov eax, dword [ebp - 4]
mov byte [eax + 0x12], cl
test esi, esi
je 0x48f57d
mov al, byte [esi + 7]
jmp 0x48f584
mov ecx, ebx
call fcn.004a2954
mov edx, dword [ebp + 0x10]
mov byte [edx], al
test esi, esi
je 0x48f592
mov al, byte [esi + 8]
jmp 0x48f59c
mov ecx, ebx
call fcn.004a2935
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov byte [esi], al
mov cl, byte [edx]
cmp cl, 0xf
jbe 0x48f5bd
cmp al, 0xf
jbe 0x48f5bd
mov ebx, dword [ebp - 4]
mov al, 0xf
mov byte [esi], 0x10
mov byte [edx], 0x10
mov byte [ebx + 0x13], 5
jmp 0x48f5ed
cmp cl, 0x10
jb 0x48f5c9
push 5
pop ecx
mov byte [edx], cl
mov al, byte [esi]
cmp al, 0x10
jb 0x48f5d4
mov byte [esi], 0xf
mov al, 0xf
mov cl, byte [edx]
cmp cl, al
jne 0x48f5e5
test cl, cl
setne al
dec al
and al, 0xf
mov byte [esi], al
mov cl, byte [edx]
mov ebx, dword [ebp - 4]
mov byte [ebx + 0x13], cl
mov al, byte [esi]
cmp byte [ebp + 0x18], 0
mov byte [ebx + 0x14], al
je 0x48f6e2
mov edx, dword [ebp + 0x1c]
xor ecx, ecx
mov byte [ebp + 0x1b], cl
test edx, edx
jne 0x48f649
push ecx
lea eax, [ebp + 0x1c]
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push 0x556238
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x48f642
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push 0x556258
call fcn.00420ad9
add esp, 0x14
xor edx, edx
mov dword [ebp + 0x1c], edx
jmp 0x48f649
mov edx, dword [ebp + 0x1c]
mov byte [ebp + 0x1b], 1
mov ah, byte [edi]
cmp ah, 0xf
jbe 0x48f658
mov ah, byte [ebx + 0x11]
and ah, 0xf
mov byte [edi], ah
mov ecx, dword [ebp + 0xc]
mov al, byte [ecx]
cmp al, 0xf
jbe 0x48f66a
mov al, byte [ebx + 0x12]
and al, 0xf
mov byte [ecx], al
mov ah, byte [edi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
shl al, 4
movzx ecx, al
movzx eax, ah
and eax, 0xf
or ecx, eax
mov dword [ebp + 8], ecx
test edx, edx
je 0x48f69a
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x5562cc
push edx
call edi
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0xf
jbe 0x48f6a7
cmp byte [esi], 0xf
ja 0x48f6d5
test edx, edx
je 0x48f6d5
mov al, byte [ebx + 0x14]
shl al, 4
movzx ecx, al
movzx eax, byte [ebx + 0x13]
and eax, 0xf
push 4
or ecx, eax
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push 0x5562e8
push edx
mov dword [ebp + 0xc], ecx
call edi
mov edx, dword [ebp + 0x1c]
cmp byte [ebp + 0x1b], 0
je 0x48f6e2
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 0x18