Function at 0x482a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d8
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x7d8], ecx
mov ecx, 9
mov esi, str.Windows_Registry_Editor_Version_5.00
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x33c]
mov dword [ebp - 0x7cc], edx
mov dword [ebp - 0x7d0], eax
movsb byte es:[edi], byte [esi]
call fcn.0047ea60
mov edx, 0x104
mov eax, ebx
cmp byte [eax], 0
je 0x482aa1
inc eax
dec edx
jne 0x482a96
jmp 0x482ac9
test edx, edx
je 0x482ac9
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x33c]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x33c]
cmp byte [eax], 0
je 0x482adf
inc eax
dec edx
jne 0x482ad4
jmp 0x482b07
test edx, edx
je 0x482b07
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.temp.reg
lea ecx, [ebp + ecx - 0x33c]
mov edx, 0x7fffffff
call fcn.00401000
push 0x1041
lea ecx, [ebp - 0x7c4]
push ecx
lea edx, [ebp - 0x33c]
push edx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
jne 0x482b73
cmp dword [0x4c643c], 0x270f
jge 0x482de7
lea edi, [ebp - 0x53c]
call fcn.00483860
push str.GetLastError:__
mov esi, edi
call fcn.0047fb10
add esp, 4
push str.CommandReg__OpenFile_OF_WRITE_OF_CREATE____
lea esi, [ebp - 0x33c]
call fcn.0047fb10
add esp, 4
push 0x4b7c68
mov esi, 0x4b7c68
jmp 0x482ddf
lea eax, [ebp - 0x30]
push eax
push str._s_r_n_r_n
lea ecx, [ebp - 0x234]
push 0x200
push ecx
call fcn.00402830
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 0x10
push 0
lea edx, [ebp - 0x7c8]
push edx
lea eax, [ebp - 0x234]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea ecx, [ebp - 0x234]
push ecx
push edi
call ebx
mov edx, dword [ebp - 0x7d8]
mov eax, dword [ebp - 0x7d4]
push edx
push eax
push str.__s_s__r_n
lea ecx, [ebp - 0x234]
push 0x200
push ecx
call fcn.00402830
add esp, 0x14
push 0
lea edx, [ebp - 0x7c8]
push edx
lea eax, [ebp - 0x234]
push eax
call esi
push eax
lea ecx, [ebp - 0x234]
push ecx
push edi
call ebx
mov edx, 0x4bbc38
lea ecx, [ebp - 0x234]
call fcn.0047dee0
test eax, eax
je 0x482c2b
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
dec eax
je 0x482cf6
sub eax, 3
je 0x482c98
sub eax, 0x62
jne 0x482d8c
mov edx, dword [ebp - 0x7cc]
push edx
push str.__s__
lea eax, [ebp - 0x234]
push 0x200
push eax
call fcn.00402830
add esp, 0x10
mov edx, 0x4bbc38
lea ecx, [ebp - 0x234]
call fcn.0047dee0
test eax, eax
jne 0x482c11
push eax
lea ecx, [ebp - 0x7c8]
push ecx
lea edx, [ebp - 0x234]
push edx
call esi
push eax
lea eax, [ebp - 0x234]
push eax
push edi
call ebx
jmp 0x482d8c
mov ecx, dword [ebp - 0x7d0]
push ecx
call fcn.004a02f9
mov edx, dword [ebp - 0x7cc]
add esp, 4
push eax
push edx
push str.__s_dword:_08d
lea eax, [ebp - 0x234]
push 0x200
push eax
call fcn.00402830
add esp, 0x14
push 0
lea ecx, [ebp - 0x7c8]
push ecx
lea edx, [ebp - 0x234]
push edx
call esi
push eax
lea eax, [ebp - 0x234]
push eax
push edi
call ebx
lea ecx, [ebp - 0x234]
push ecx
mov esi, str.DWORDCreateRegCommand
jmp 0x482d84
mov edx, dword [ebp - 0x7d0]
push edx
call esi
xor edx, edx
test eax, eax
jle 0x482d34
lea ecx, [ebp - 0x73c]
mov ebx, dword [ebp - 0x7d0]
mov bl, byte [ebx + edx]
cmp bl, 0x5c
jne 0x482d23
mov word [ecx], 0x5c5c
add ecx, 2
jmp 0x482d26
mov byte [ecx], bl
inc ecx
inc edx
mov byte [ecx], 0
cmp edx, eax
jl 0x482d0b
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x7cc]
lea eax, [ebp - 0x73c]
push eax
push ecx
push str.__s___s__r_n
lea edx, [ebp - 0x234]
push 0x200
push edx
call fcn.00402830
add esp, 0x14
push 0
lea eax, [ebp - 0x7c8]
push eax
lea ecx, [ebp - 0x234]
push ecx
call esi
push eax
lea edx, [ebp - 0x234]
push edx
push edi
call ebx
lea eax, [ebp - 0x234]
push eax
mov esi, str.StringCreateRegCommand
call fcn.0047fb10
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
lea ecx, [ebp - 0x33c]
call fcn.0047d280
test eax, eax
je 0x482dd5
push str.CreateRegCommand
mov esi, str.Calling_regExecuteRegScript___to_make_change_to_registry_not_possible_from_WinPatrol.exe.
call fcn.0047fb10
add esp, 4
lea ecx, [ebp - 0x33c]
call fcn.0047d070
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
push str.CreateRegCommand_for_Temp_file
mov esi, str.FAILED__No_way_should_this_fail.
call fcn.0047fb10
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret