Function at 0x48c7f0
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x641077
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x248
mov eax, dword [0x6f7b78]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x30], eax
xor ebp, ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x260], ebp
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
mov byte [esp + 0x26c], 2
call fcn.0048e470
add esp, 0xc
test eax, eax
je 0x48ca82
mov edx, dword [0x6fcacc]
mov ecx, dword [esp + 0x30]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor bl, bl
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebp
neg edx
push eax
push 0x20019
sbb edx, edx
push ebp
add edx, 0x80000002
push ecx
push edx
call edi
cmp eax, ebp
jne 0x48c9d3
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x58]
push eax
push ecx
push ebp
push ebp
push ebp
push edx
mov dword [esp + 0x4c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
jne 0x48c8b9
mov bl, 1
jmp 0x48c9c0
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x5c]
push ecx
push edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x2c], ebp
call fcn.00592e50
add esp, 0xc
test eax, eax
je 0x48c9af
mov eax, dword [esp + 0x20]
cmp eax, 8
jbe 0x48c9af
mov ecx, dword [0x6fcc58]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 0x14c9
push 0x111
push ecx
call esi
mov edx, dword [0x6f7b78]
mov dword [esp + 0x24], edx
mov ecx, dword [0x6fcc58]
lea eax, [esp + 0x24]
push eax
push 0x14cc
push 0x111
push ecx
mov byte [esp + 0x270], 3
call esi
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
push 8
push edx
push eax
call fcn.0060d550
add esp, 0xc
test eax, eax
je 0x48c99e
mov eax, dword [0x6fcc58]
mov ecx, dword [0x6f7b78]
lea edx, [esp + 0x1c]
mov bl, 1
push edx
push 0x14c6
push 0x111
push eax
mov dword [esp + 0x2c], ecx
call esi
mov eax, dword [esp + 0x1c]
cmp byte [eax], 0x7b
jne 0x48c995
mov ecx, dword [esp + 0x14]
push ecx
push eax
call fcn.0060a000
add esp, 8
test eax, eax
jne 0x48c995
xor bl, bl
lea ecx, [esp + 0x1c]
call fcn.00622d8a
lea ecx, [esp + 0x24]
mov byte [esp + 0x260], 2
call fcn.00622d8a
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x48c9c0
push eax
call fcn.00609aba
add esp, 4
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x48cc37
mov edx, dword [0x6fcacc]
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x10]
neg edx
push eax
push 1
sbb edx, edx
push ebp
add edx, 0x80000002
push ecx
push edx
call edi
cmp dword [esp + 0x10], ebp
je 0x48ca24
cmp eax, ebp
jne 0x48ca24
mov eax, dword [0x6fcc58]
push ebp
push 0x14cf
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x48cc37
mov edi, dword [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00622acb
mov edx, eax
add esp, 4
cmp edx, ebp
je 0x48cc37
mov edi, dword [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
push edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x14ce
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x111
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x6fcc58]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x48cc37
mov ecx, dword [0x6fcacc]
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x20]
push ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push ebp
push 0xf003f
neg ecx
push ebp
push ebp
sbb ecx, ecx
push ebp
add ecx, 0x80000002
push eax
push ecx
mov dword [esp + 0x44], ebp
call esi
cmp eax, ebp
jne 0x48cc37
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x14], 0x4b
mov byte [esp + 0x15], 0x78
mov byte [esp + 0x16], 0x6f
mov byte [esp + 0x17], 0x6e
mov byte [esp + 0x18], 0x74
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1a], 0x73
mov byte [esp + 0x1b], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebp
jle 0x48cb05
mov bl, byte [esp + eax + 0x14]
xor bl, 0x1d
mov byte [esp + eax + 0x14], bl
inc eax
cmp eax, ecx
jl 0x48caf5
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
push ebp
push edx
push ebp
push 0xf003f
push ebp
push ebp
lea eax, [esp + 0x2c]
push ebp
push eax
push ecx
mov dword [esp + 0x34], ebp
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x48cc30
lea edx, [esp + 0x24]
push edx
call fcn.0061fc90
push ebp
lea ecx, [esp + 0x28]
call fcn.0061fca3
mov esi, dword [eax + 0x14]
push ebp
lea ecx, [esp + 0x28]
add esi, 0x76c
call fcn.0061fca3
mov edi, dword [eax + 0x10]
push ebp
lea ecx, [esp + 0x28]
inc edi
call fcn.0061fca3
lea ecx, [esi + esi*2]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x34], 0x20
lea ecx, [edi + ecx*4]
lea ecx, [ecx + ecx*2]
lea edx, [ecx + ecx*4]
lea ecx, [esp + 0x38]
lea esi, [eax + edx*2 - 0xa6fe0]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x34]
push eax
push ecx
push ebp
push ebp
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48cbd3
lea eax, [esp + 0x38]
push eax
call fcn.00609da8
add esp, 4
cmp eax, ebp
je 0x48cc29
sub esi, eax
cmp esi, 0x3c
jbe 0x48cc29
mov ecx, dword [0x6fcc58]
push ebp
push 0x14d0
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x48cc29
mov edx, dword [0x6f7b78]
mov dword [esp + 0x1c], edx
push esi
lea eax, [esp + 0x20]
push 0x6c91b4
push eax
mov byte [esp + 0x26c], 4
call fcn.0061fae1
mov edx, dword [esp + 0x28]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 1
push ebp
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x260], 2
call fcn.00622d8a
mov edx, dword [esp + 0x10]
push edx
call ebx
mov eax, dword [esp + 0x20]
push eax
call ebx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x260], 1
call fcn.00622d8a
lea ecx, [esp + 0x28]
mov byte [esp + 0x260], 0
call fcn.00622d8a
lea ecx, [esp + 0x30]
mov dword [esp + 0x260], 0xffffffff
call fcn.00622d8a
mov ecx, dword [esp + 0x258]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x254
ret