Function at 0x48f9f0
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x64137b
push eax
mov eax, 0x3554
mov dword fs:[0], esp
call fcn.00609d40
mov eax, dword [0x6f7b78]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x24], eax
xor ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x356c], ebx
lea eax, [esp + 0x14]
lea edx, [esp + 0x24]
push eax
push edx
mov byte [esp + 0x3574], 1
call fcn.0048eb20
test eax, eax
je 0x49043a
lea ecx, [esp + 0x80]
mov dword [esp + 0x20], ebx
call fcn.00524830
lea ecx, [esp + 0x90]
mov byte [esp + 0x356c], 2
call fcn.00524830
mov edx, dword [0x6fcacc]
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x20]
neg edx
push eax
push 1
sbb edx, edx
push ebx
add edx, 0x80000002
push ecx
push edx
mov byte [esp + 0x3580], 3
call edi
mov esi, eax
cmp esi, ebx
je 0x48fbf5
cmp esi, 2
je 0x48fb6a
mov eax, dword [0x6f7b78]
mov dword [esp + 0x10], eax
mov eax, dword [0x6fcacc]
mov byte [esp + 0x356c], 4
cmp eax, ebx
mov eax, str.CURRENT_USER
jne 0x48fad1
mov eax, str.MACHINE
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push eax
push 0x6c9ce8
push edx
call fcn.0061fae1
mov eax, dword [esp + 0x20]
add esp, 0x10
lea ecx, [esp + 0x80]
push eax
call fcn.005248e0
test eax, eax
je 0x48fb1e
mov eax, dword [0x6fcacc]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
neg eax
push ecx
push 1
sbb eax, eax
push ebx
add eax, 0x80000002
push edx
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x48fb59
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x84]
call fcn.005249b0
test eax, eax
je 0x48fb59
mov ecx, dword [0x6fcacc]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
neg ecx
push edx
push 1
sbb ecx, ecx
push ebx
add ecx, 0x80000002
push eax
push ecx
call edi
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x356c], 3
call fcn.00622d8a
cmp esi, ebx
je 0x48fbf5
cmp dword [0x6fcacc], ebx
jne 0x48fbf5
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push 1
push ebx
push eax
push 0x80000001
call edi
test eax, eax
je 0x48fbf5
mov ecx, dword [0x6f7b78]
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push str.CURRENT_USER_s
push eax
mov byte [esp + 0x3578], 5
call fcn.0061fae1
mov ecx, dword [esp + 0x28]
add esp, 0xc
push ecx
lea ecx, [esp + 0x94]
call fcn.005248e0
test eax, eax
je 0x48fbe4
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push 1
push ebx
push eax
push 0x80000001
call edi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x356c], 3
call fcn.00622d8a
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x490412
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xb0]
mov dword [esp + 0x20], ebx
call fcn.00524830
lea ecx, [esp + 0xa0]
mov byte [esp + 0x356c], 6
call fcn.00524830
mov eax, dword [0x6fcacc]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push ebx
push 0xf003f
neg eax
push ebx
push ebx
sbb eax, eax
push ebx
add eax, 0x80000002
push edx
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x48fe13
cmp esi, 2
je 0x48fd38
mov ecx, dword [0x6f7b78]
mov dword [esp + 0x10], ecx
mov eax, dword [0x6fcacc]
mov byte [esp + 0x356c], 8
cmp eax, ebx
mov eax, str.CURRENT_USER
jne 0x48fc8f
mov eax, str.MACHINE
mov edx, dword [esp + 0x24]
push edx
push eax
lea eax, [esp + 0x18]
push 0x6c9ce8
push eax
call fcn.0061fae1
mov ecx, dword [esp + 0x20]
add esp, 0x10
push ecx
lea ecx, [esp + 0xb4]
call fcn.005248e0
test eax, eax
je 0x48fce5
mov ecx, dword [0x6fcacc]
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x20]
push ebx
push edx
push ebx
neg ecx
push 0xf003f
push ebx
sbb ecx, ecx
push ebx
push ebx
add ecx, 0x80000002
push eax
push ecx
call edi
mov esi, eax
cmp esi, ebx
je 0x48fd27
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xb0]
push edx
call fcn.005249b0
test eax, eax
je 0x48fd27
mov edx, dword [0x6fcacc]
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x20]
push ebx
push eax
push ebx
neg edx
push 0xf003f
push ebx
sbb edx, edx
push ebx
push ebx
add edx, 0x80000002
push ecx
push edx
call edi
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x356c], 7
call fcn.00622d8a
cmp esi, ebx
je 0x48fe13
cmp dword [0x6fcacc], ebx
jne 0x48fe13
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x20]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push 0x80000001
call edi
mov esi, eax
cmp esi, ebx
je 0x48fe13
mov edx, dword [0x6f7b78]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x10]
push eax
push str.CURRENT_USER_s
push ecx
mov byte [esp + 0x3578], 9
call fcn.0061fae1
mov edx, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0xa0]
push edx
call fcn.005248e0
test eax, eax
je 0x48fdcc
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x20]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push 0x80000001
call edi
mov esi, eax
cmp esi, ebx
je 0x48fe02
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xa0]
push edx
call fcn.005249b0
test eax, eax
je 0x48fe02
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x20]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push ecx
push 0x80000001
call edi
mov esi, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x356c], 7
call fcn.00622d8a
cmp esi, ebx
mov dword [esp + 0x18], 1
jne 0x490169
cmp dword [esp + 0x20], ebx
je 0x490169
mov al, 0x63
mov cl, 0x37
mov byte [esp + 0x53], al
mov byte [esp + 0x58], al
mov al, 0x78
mov byte [esp + 0x59], cl
mov byte [esp + 0x5b], al
mov byte [esp + 0x5f], al
mov dl, 0x76
mov byte [esp + 0x62], cl
lea edi, [esp + 0x48]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x48], 0x44
mov byte [esp + 0x49], 0x58
mov byte [esp + 0x4a], 0x51
mov byte [esp + 0x4b], 0x43
mov byte [esp + 0x4c], 0x40
mov byte [esp + 0x4d], 0x56
mov byte [esp + 0x4e], 0x45
mov byte [esp + 0x4f], 0x52
mov byte [esp + 0x50], 0x4b
mov byte [esp + 0x51], 0x5e
mov byte [esp + 0x52], 0x79
mov byte [esp + 0x54], 0x72
mov byte [esp + 0x55], 0x65
mov byte [esp + 0x56], 0x79
mov byte [esp + 0x57], 0x72
mov byte [esp + 0x5a], 0x53
mov byte [esp + 0x5c], 0x60
mov byte [esp + 0x5d], 0x79
mov byte [esp + 0x5e], 0x7b
mov byte [esp + 0x60], dl
mov byte [esp + 0x61], 0x73
mov byte [esp + 0x63], 0x5a
mov byte [esp + 0x64], dl
mov byte [esp + 0x65], 0x79
mov byte [esp + 0x66], dl
mov byte [esp + 0x67], 0x70
mov byte [esp + 0x68], 0x72
mov byte [esp + 0x69], 0x65
mov byte [esp + 0x6a], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jle 0x48fef6
xor byte [esp + eax + 0x48], 0x17
inc eax
cmp eax, ecx
jl 0x48feec
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x28], 0x44
mov byte [esp + 0x29], 0x72
mov byte [esp + 0x2a], 0x65
mov byte [esp + 0x2b], 0x7e
mov byte [esp + 0x2c], dl
mov byte [esp + 0x2d], 0x7b
mov byte [esp + 0x2e], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jle 0x48ff39
mov dl, byte [esp + eax + 0x28]
xor dl, 0x17
mov byte [esp + eax + 0x28], dl
inc eax
cmp eax, ecx
jl 0x48ff29
lea edx, [esp + 0x1c]
lea eax, [esp + 0x48]
push edx
push 1
push ebx
mov ebp, 0x32
push eax
push 0x80000002
mov byte [esp + 0xf4], bl
xor esi, esi
mov dword [esp + 0x24], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0xe0]
push ecx
push edx
test eax, eax
push ebx
lea eax, [esp + 0x34]
push ebx
push eax
jne 0x490477
mov ecx, dword [esp + 0x30]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
call edi
test eax, eax
je 0x48ffb5
lea edx, [esp + 0x10]
lea eax, [esp + 0xe0]
push edx
mov edx, dword [0x6fcafc]
push eax
push ebx
lea ecx, [esp + 0x34]
push ebx
push ecx
push edx
mov dword [esp + 0x28], ebp
call edi
test eax, eax
jne 0x48ffba
mov esi, 1
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x490154
cmp byte [esp + 0xe0], bl
je 0x490154
mov ecx, 8
xor eax, eax
lea edi, [esp + 0xc0]
lea edx, [esp + 0xe0]
rep stosd dword es:[edi], eax
push 0x1f
lea eax, [esp + 0xc4]
push edx
push eax
call fcn.00609f00
mov al, 0x27
mov cl, 0x25
mov byte [esp + 0x3f], al
mov byte [esp + 0x40], cl
mov byte [esp + 0x45], al
mov byte [esp + 0x46], al
mov byte [esp + 0x47], cl
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
mov byte [esp + 0x30], 0x7b
mov byte [esp + 0x31], 0x7a
mov byte [esp + 0x32], 0x40
mov byte [esp + 0x35], 0x7c
mov byte [esp + 0x36], 0x7d
mov byte [esp + 0x37], 0x5a
mov byte [esp + 0x38], 0x23
mov byte [esp + 0x3c], 0x51
mov byte [esp + 0x3d], 0x56
mov byte [esp + 0x3e], 0x79
mov byte [esp + 0x3f], 0x6d
mov byte [esp + 0x40], 0x60
mov byte [esp + 0x41], 0x60
mov byte [esp + 0x42], 0x64
mov byte [esp + 0x43], 0x56
mov byte [esp + 0x44], 0x26
mov byte [esp + 0x45], bl
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0xdf], bl
cmp ecx, ebx
jle 0x490099
mov dl, byte [esp + eax + 0x30]
xor dl, 0x17
mov byte [esp + eax + 0x30], dl
inc eax
cmp eax, ecx
jl 0x490089
mov dword [esp + 0x7c], 0x65a24c
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc0]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x356c], 0xa
push ecx
lea ecx, [esp + 0x34]
push ecx
push 0x20
push edx
lea ecx, [esp + 0x8c]
call fcn.00451890
lea ecx, [esp + 0x114]
call fcn.0057f400
lea eax, [esp + 0x6c]
lea ecx, [esp + 0xc0]
push eax
push 0x20
push ecx
lea ecx, [esp + 0x120]
mov byte [esp + 0x3578], 0xb
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x78], ebx
call fcn.00592860
test eax, eax
je 0x49012f
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x20]
push edx
push eax
push 1
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x49012f
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x6c]
cmp eax, ebx
je 0x490140
push eax
call fcn.00609aba
add esp, 4
lea ecx, [esp + 0x114]
mov byte [esp + 0x356c], 0xa
call fcn.005ed570
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x18], ebx
je 0x4903ea
mov eax, dword [0x6f7b78]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x14]
push 0x5c
push ecx
mov byte [esp + 0x3574], 0xc
call fcn.0060ab40
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x4903d9
mov byte [ebp], bl
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push 0x6c910c
push eax
call fcn.0061fae1
add esp, 0xc
lea ecx, [esp + 0x30]
inc ebp
mov dword [esp + 0x10], ebx
call fcn.00524830
lea ecx, [esp + 0x6c]
mov byte [esp + 0x356c], 0xd
call fcn.00524830
mov eax, dword [0x6fcacc]
mov edx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
neg eax
push ecx
push 0xf003f
sbb eax, eax
push ebx
add eax, 0x80000002
push edx
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x49039c
cmp esi, 2
je 0x4902c6
mov ecx, dword [0x6f7b78]
mov dword [esp + 0x1c], ecx
mov eax, dword [0x6fcacc]
mov byte [esp + 0x356c], 0xf
cmp eax, ebx
mov eax, str.CURRENT_USER
jne 0x49022b
mov eax, str.MACHINE
mov edx, dword [esp + 0x18]
push edx
push eax
lea eax, [esp + 0x24]
push 0x6c9ce8
push eax
call fcn.0061fae1
mov ecx, dword [esp + 0x2c]
add esp, 0x10
push ecx
lea ecx, [esp + 0x34]
call fcn.005248e0
test eax, eax
je 0x49027a
mov ecx, dword [0x6fcacc]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x10]
neg ecx
push edx
push 0xf003f
sbb ecx, ecx
push ebx
add ecx, 0x80000002
push eax
push ecx
call edi
mov esi, eax
cmp esi, ebx
je 0x4902b5
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push edx
call fcn.005249b0
test eax, eax
je 0x4902b5
mov edx, dword [0x6fcacc]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
neg edx
push eax
push 0xf003f
sbb edx, edx
push ebx
add edx, 0x80000002
push ecx
push edx
call edi
mov esi, eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x356c], 0xe
call fcn.00622d8a
cmp esi, ebx
je 0x49039c
cmp dword [0x6fcacc], ebx
jne 0x490398
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push ecx
push 0x80000001
call edi
mov esi, eax
cmp esi, ebx
je 0x49039c
cmp esi, 2
je 0x490398
mov edx, dword [0x6f7b78]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push str.CURRENT_USER_s
push ecx
mov byte [esp + 0x3578], 0x10
call fcn.0061fae1
mov edx, dword [esp + 0x28]
add esp, 0xc
lea ecx, [esp + 0x6c]
push edx
call fcn.005248e0
test eax, eax
je 0x490358
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push ecx
push 0x80000001
call edi
mov esi, eax
cmp esi, ebx
je 0x490387
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x6c]
push edx
call fcn.005249b0
test eax, eax
je 0x490387
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push ecx
push 0x80000001
call edi
mov esi, eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x356c], 0xe
call fcn.00622d8a
cmp esi, ebx
jne 0x4903b7
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4903b7
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x6c]
mov byte [esp + 0x356c], 0xd
call fcn.00524870
lea ecx, [esp + 0x30]
mov byte [esp + 0x356c], 0xc
call fcn.00524870
lea ecx, [esp + 0x18]
mov byte [esp + 0x356c], 7
call fcn.00622d8a
lea ecx, [esp + 0xa0]
mov byte [esp + 0x356c], 6
call fcn.00524870
lea ecx, [esp + 0xb0]
mov byte [esp + 0x356c], 3
call fcn.00524870
lea ecx, [esp + 0x90]
mov byte [esp + 0x356c], 2
call fcn.00524870
lea ecx, [esp + 0x80]
mov byte [esp + 0x356c], 1
call fcn.00524870
lea ecx, [esp + 0x14]
mov byte [esp + 0x356c], bl
call fcn.00622d8a
lea ecx, [esp + 0x24]
mov dword [esp + 0x356c], 0xffffffff
call fcn.00622d8a
mov ecx, dword [esp + 0x3564]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3560
ret
mov ecx, dword [0x6fcafc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x490154
jmp 0x48ffcd