Function at 0x48c160
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3c]
sub esp, 0x3c
push 0xffffffffffffffff
push 0x541e5d
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x595c60]
xor eax, ebp
mov dword [ebp + 0x38], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov eax, dword [0x59e598]
test al, 1
jne 0x48c1c8
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 1
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x48c1dd
cmp byte [eax + 0x19], 6
jb 0x48c1dd
mov al, 1
jmp 0x48c1df
xor al, al
cmp byte [0x59e5a8], 0
jne 0x48c1f9
cmp byte [0x59e5a9], 0
jne 0x48c1f9
test al, al
je 0x48c31b
sub esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa8]
call fcn.0047b550
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 3
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa8]
call fcn.0047eed0
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x288
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a46c
mov ecx, eax
call fcn.0047f130
mov edx, str.Driver::RemoveTombStoneIfPresent
mov ecx, eax
call fcn.0047f130
mov byte [ebp - 4], 3
cmp dword [ebp + 0x34], 0x10
jb 0x48c28a
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c28a
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 5
cmp dword [esi + 0x14], 0x10
jb 0x48c2a7
mov esi, dword [esi]
mov eax, dword [0x59e598]
test al, 1
jne 0x48c2d2
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 6
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 5
push esi
push 6
mov ecx, 0x59e5a8
call fcn.004a0b40
cmp dword [ebp + 0x34], 0x10
jb 0x48c2f5
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c2f5
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.0047b620
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
mov dword [ebp - 4], 0
push 0x22
xor eax, eax
mov dword [ebp + 0x1c], 7
push str.systemCurrentControlSetServices_
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.0047c530
push 0xffffffffffffffff
push 0
lea eax, [ebp + 0x44]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp + 8]
call fcn.00482640
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x48c35e
lea eax, [ebp + 8]
lea ecx, [ebp + 4]
push ecx
push 0xf013f
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48c679
mov eax, dword [0x59e598]
test al, 1
jne 0x48c3a8
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 9
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 8
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x48c3c3
cmp byte [eax + 0x19], 6
jb 0x48c3c3
mov al, 1
jmp 0x48c3c5
xor al, al
cmp byte [0x59e5a8], 0
jne 0x48c3df
cmp byte [0x59e5a9], 0
jne 0x48c3df
test al, al
je 0x48c50b
sub esp, 8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa8]
call fcn.0047b550
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0xb
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xa8]
call fcn.0047eed0
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x290
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Found_existing
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 8]
mov ecx, eax
call fcn.004a0d80
mov edx, str._reg_entry.
mov ecx, eax
call fcn.0047f130
mov byte [ebp - 4], 0xb
cmp dword [ebp + 0x34], 0x10
jb 0x48c47a
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c47a
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0xd
cmp dword [esi + 0x14], 0x10
jb 0x48c497
mov esi, dword [esi]
mov eax, dword [0x59e598]
test al, 1
jne 0x48c4c2
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 0xe
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 0xd
push esi
push 6
mov ecx, 0x59e5a8
call fcn.004a0b40
cmp dword [ebp + 0x34], 0x10
jb 0x48c4e5
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c4e5
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xa
call fcn.0047b620
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
mov dword [ebp - 4], 8
push str.DeleteFlag
push dword [ebp + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
mov eax, dword [0x59e598]
je 0x48c6cc
test al, 1
jne 0x48c54c
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 0x10
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 8
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x48c567
cmp byte [eax + 0x19], 6
jb 0x48c567
mov al, 1
jmp 0x48c569
xor al, al
cmp byte [0x59e5a8], 0
jne 0x48c583
cmp byte [0x59e5a9], 0
jne 0x48c583
test al, al
je 0x48c670
sub esp, 8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xa8]
call fcn.0047b550
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x12
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa8]
call fcn.0047eed0
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x294
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Failed_to_Find_DeleteFlag.
mov ecx, eax
call fcn.0047f130
mov byte [ebp - 4], 0x12
cmp dword [ebp + 0x34], 0x10
jb 0x48c608
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c608
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x14
cmp dword [esi + 0x14], 0x10
jb 0x48c625
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
cmp dword [ebp + 0x34], 0x10
jb 0x48c64a
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c64a
push eax
call fcn.005074d4
add esp, 4
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x58]
call fcn.0047b620
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
mov dword [ebp - 4], 8
push dword [ebp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x59e598]
test al, 1
jne 0x48c6a4
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 0x26
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 8
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x48ca16
cmp byte [eax + 0x19], 6
jb 0x48ca16
mov al, 1
jmp 0x48ca18
test al, 1
jne 0x48c6f2
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 0x16
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 8
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x48c707
cmp byte [eax + 0x19], 6
jb 0x48c707
mov al, 1
jmp 0x48c709
xor al, al
cmp byte [0x59e5a8], 0
jne 0x48c723
cmp byte [0x59e5a9], 0
jne 0x48c723
test al, al
je 0x48c810
sub esp, 8
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xa8]
call fcn.0047b550
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x18
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xa8]
call fcn.0047eed0
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x298
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Deleted_Find_DeleteFlag.
mov ecx, eax
call fcn.0047f130
mov byte [ebp - 4], 0x18
cmp dword [ebp + 0x34], 0x10
jb 0x48c7a8
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c7a8
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x1a
cmp dword [esi + 0x14], 0x10
jb 0x48c7c5
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
cmp dword [ebp + 0x34], 0x10
jb 0x48c7ea
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c7ea
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x17
call fcn.0047b620
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
mov dword [ebp - 4], 8
push 4
lea eax, [ebp]
mov dword [ebp], 3
push eax
push 4
push 0
push str.Start
push dword [ebp + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x48c92c
call fcn.004a0950
mov ecx, dword [0x596f88]
test byte [ecx + 0x1c], 2
je 0x48c858
cmp byte [ecx + 0x19], 6
jb 0x48c858
mov cl, 1
jmp 0x48c85a
xor cl, cl
cmp byte [eax], 0
jne 0x48c86d
cmp byte [eax + 1], 0
jne 0x48c86d
test cl, cl
je 0x48c670
sub esp, 8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xa8]
call fcn.0047b550
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x1d
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xa8]
call fcn.0047eed0
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x29e
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Failed_to_set_Start3.
mov ecx, eax
call fcn.0047f130
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x1d
call fcn.0047ac60
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x1f
cmp dword [esi + 0x14], 0x10
jb 0x48c901
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp + 0x20]
call fcn.0047ac60
mov byte [ebp - 4], 0x1c
jmp 0x48c64e
call fcn.004a0950
mov ecx, dword [0x596f88]
test byte [ecx + 0x1c], 2
je 0x48c947
cmp byte [ecx + 0x19], 6
jb 0x48c947
mov cl, 1
jmp 0x48c949
xor cl, cl
cmp byte [eax], 0
jne 0x48c95c
cmp byte [eax + 1], 0
jne 0x48c95c
test cl, cl
je 0x48c670
sub esp, 8
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xa8]
call fcn.0047b550
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x22
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xa8]
call fcn.0047eed0
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x2a2
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Set_Start3.
mov ecx, eax
call fcn.0047f130
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x22
call fcn.0047ac60
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x24
cmp dword [esi + 0x14], 0x10
jb 0x48c9f0
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp + 0x20]
call fcn.0047ac60
mov byte [ebp - 4], 0x21
jmp 0x48c64e
xor al, al
cmp byte [0x59e5a8], 0
jne 0x48ca32
cmp byte [0x59e5a9], 0
jne 0x48ca32
test al, al
je 0x48cb4d
sub esp, 8
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xa8]
call fcn.0047b550
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x28
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xa8]
call fcn.0047eed0
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x2a8
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a498
mov ecx, eax
call fcn.0047f130
mov edx, str.Driver::RemoveTombStoneIfPresent
mov ecx, eax
call fcn.0047f130
mov byte [ebp - 4], 0x28
cmp dword [ebp + 0x34], 0x10
jb 0x48cac3
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48cac3
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x2a
cmp dword [esi + 0x14], 0x10
jb 0x48cae0
mov esi, dword [esi]
mov eax, dword [0x59e598]
test al, 1
jne 0x48cb0b
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 0x2b
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 0x2a
push esi
push 6
mov ecx, 0x59e5a8
call fcn.004a0b40
cmp dword [ebp + 0x34], 0x10
jb 0x48cb2e
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48cb2e
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x27
call fcn.0047b620
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
cmp dword [ebp + 0x1c], 8
jb 0x48cb63
mov eax, dword [ebp + 8]
test eax, eax
je 0x48cb63
push eax
call fcn.005074d4
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x58], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x48cb8d
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x48cb8d
push eax
call fcn.005074d4
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x38]
xor ecx, ebp
call fcn.00506c7d
lea esp, [ebp + 0x3c]
pop ebp
ret 0x18