Function at 0x4d0b85
Capabilities:
Set registry value

Disassembly:
push 0x2e4
mov eax, 0x5536a2
call fcn.00513ea1
push 0x4f
pop ecx
mov esi, str.sgCpRlZbRG7uf4lWn9VgVKTlzGmg6RfQJvSSXnOCmRePUp9sWqPZyWQ6IpeRivDDAU6wDWqZrcKBMPcdd9h6BJzWhoiSx8JxI6pu6U1LRra7IQFf2d2k6FgvSTQ4tAh32ZPoZT6LGKOPGhAcUtwLij3ZuMTy2CZsDRrMFzAxvd58f0Yga2jmEFkX3yWLvWwDLPcFa5kgTXcysPotNMWVJyyszRl0suWErT5TjzatE2GN0ETSbcL73FOx0sbaBo1QwBgS13fWLGeZK9FDFtIN99QuqWvpt71vMDSmBBeesAcpYBLUSJ2EMz9ALmpa
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x150]
mov ebx, dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
push 0x56
pop ecx
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp + 0x10]
movsb byte es:[edi], byte [esi]
mov esi, str.fQ8KmGTLgEqNAZ8JiGgOJquLeF5psAypeC9vooDWmKm0qOycM8XiCNsMpod7AW4wQGMuVPPyHuqD07g3ybrXJu3YgU1S0tcPZjVQXgoMLIVwQHWR3pwCH2geLErMO1fTITc1CSV2pj9PPHGvZMswMfSceoZqVaxuvJQR1GMSrZk0hub6Ege5rBe4JW09X0crSiRIuI6DafbiAvO9uwASWueVWlTGYLfdIHTdGpr4SvWfYABm8ICc8PqP8hwWJvmv5DQkLcs8ZxRUlmHUhBPa9WNcBEVp0nhbRg7qqBXtRc62ok7sV09gR0ff7nq0pH5Y5Js3zLIrc1yTaYdwYN6pUz8dj
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp + 0x14]
lea edi, [ebp - 0x2ac]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2e0], eax
xor eax, eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2c4]
lea eax, [ebp - 0x150]
push eax
call fcn.004057d0
lea eax, [ebp - 0x2c4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x2f0]
call fcn.00408170
push 0
push 1
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0
call fcn.004096c0
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.004057d0
lea eax, [ebp - 0x2c4]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x2f0]
call fcn.00408170
push 0
push 1
lea ecx, [ebp - 0x2c4]
call fcn.004096c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x2c8]
push eax
xor ecx, ecx
mov edi, 0xf013f
push edi
push ecx
push ebx
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 0x2c8], ecx
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x2d4], ecx
call esi
test eax, eax
jne 0x4d0d77
lea eax, [ebp - 0x2cc]
xor ebx, ebx
push eax
push edi
push ebx
push str.SoftWare
push dword [ebp - 0x2c8]
call esi
test eax, eax
je 0x4d0cd2
push dword [ebp - 0x2c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d0d77
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2d0]
push ebx
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x2d8]
push dword [ebp - 0x2cc]
call esi
test eax, eax
je 0x4d0cff
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d0d67
push ebx
lea eax, [ebp - 0x2d4]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push dword [ebp - 0x2dc]
push dword [ebp - 0x2d0]
call esi
test eax, eax
je 0x4d0d26
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d0d5f
mov esi, dword [ebp - 0x2e0]
push esi
call fcn.00500d29
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push ebx
push dword [ebp - 0x2e4]
push dword [ebp - 0x2d4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2d4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2d0]
call esi
push dword [ebp - 0x2cc]
call esi
push dword [ebp - 0x2c8]
call esi
lea ecx, [ebp - 0x2f0]
call fcn.0047920e
call fcn.00513e4b
ret