Function at 0x4bdf08
Capabilities:
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a2d31
mov eax, dword fs:[0]
push eax
sub esp, 0x1e0
mov eax, dword [0x694240]
xor eax, esp
mov dword [esp + 0x1d8], eax
push ebx
push esi
push edi
mov eax, dword [0x694240]
xor eax, esp
push eax
lea eax, [esp + 0x1f0]
mov dword fs:[0], eax
push ecx
lea ecx, [esp + 0x9c]
call fcn.00480cdf
mov dword [esp + 0x1f8], 1
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x9c]
call fcn.00590c00
mov byte [esp + 0x1f8], 2
lea ecx, [esp + 0x80]
push eax
call fcn.00480cdf
mov byte [esp + 0x1f8], 4
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.0047997f
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x1f8], 6
lea eax, [esp + 0x2c]
push eax
call fcn.004be4c5
mov byte [esp + 0x1f8], 7
lea ecx, [esp + 0x1c]
push eax
call fcn.004c0158
mov byte [esp + 0x1f8], 6
lea ecx, [esp + 0x2c]
push ebx
push 1
call fcn.0047997f
lea eax, [esp + 0x2c]
push eax
call fcn.004be5b5
mov byte [esp + 0x1f8], 8
lea ecx, [esp + 0x1c]
push eax
call fcn.004c0158
mov byte [esp + 0x1f8], 6
lea ecx, [esp + 0x2c]
push ebx
push 1
call fcn.0047997f
mov esi, dword [esp + 0x1c]
mov bh, 1
cmp esi, dword [esp + 0x20]
je 0x4be44d
xor edi, edi
inc edi
push 0x60fc9c
mov edx, esi
mov byte [esp + 0x1b], 0
lea ecx, [esp + 0x15c]
call fcn.004ae0f5
pop ecx
mov byte [esp + 0x1f8], 9
lea ecx, [esp + 0x80]
push ecx
mov edx, eax
lea ecx, [esp + 0x48]
call fcn.0047abca
pop ecx
mov byte [esp + 0x1f8], 0xb
lea ecx, [esp + 0x158]
push 0
push edi
call fcn.0047997f
lea eax, [esp + 0x1d0]
push eax
call fcn.004be6a5
mov byte [esp + 0x1f8], 0xc
lea ecx, [esp + 0x17]
push 0
push ecx
push eax
lea edx, [esp + 0x50]
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d8425
mov bl, al
add esp, 0xc
neg bl
sbb bl, bl
mov byte [esp + 0x1f8], 0xb
push 0
push edi
lea ecx, [esp + 0x1d8]
call fcn.0047997f
inc bl
je 0x4be0c5
xor bh, bh
jmp 0x4be42c
cmp byte [esp + 0x17], 0
je 0x4be42c
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], eax
mov word [esp + 0x2c], ax
mov byte [esp + 0x1f8], 0xd
lea eax, [esp + 0xb0]
push eax
call fcn.004be750
mov byte [esp + 0x1f8], 0xe
lea ecx, [esp + 0x2c]
push 0
push ecx
push eax
lea edx, [esp + 0x50]
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d82bf
add esp, 0xc
mov byte [esp + 0x1f8], 0xd
push 0
push edi
lea ecx, [esp + 0xb8]
call fcn.0047997f
lea eax, [esp + 0x140]
push eax
call fcn.004be8a7
mov edi, eax
mov byte [esp + 0x1f8], 0xf
lea eax, [esp + 0x110]
push eax
call fcn.004be7fb
mov byte [esp + 0x1f8], 0x10
lea ecx, [esp + 0x80]
push ecx
mov edx, eax
lea ecx, [esp + 0xe4]
call fcn.0047abca
pop ecx
mov byte [esp + 0x1f8], 0x11
mov edx, eax
push edi
lea ecx, [esp + 0xcc]
call fcn.00481ff5
pop ecx
mov byte [esp + 0x1f8], 0x12
lea ecx, [esp + 0x2c]
push ecx
mov edx, eax
lea ecx, [esp + 0x18c]
call fcn.0047abca
mov edi, eax
mov byte [esp + 0x1fc], 0x13
lea ecx, [esp + 0x12c]
mov dword [esp], 0x60fad4
call fcn.00479014
mov byte [esp + 0x1f8], 0x14
mov edx, str.FGUUD2LG1LEJPT19V2JDSN6FHXGXOHLAGP317VX7LSFDCTZ9S3ZG011TYMBDDOZQOED91YSAJTFRSYCQSUQZJGAIL4FPXP3EJ4LZKSTYF1HCYNU7V6I4MTZTPJAMDFK6PWTZWEHRP88I2KP1RZEG0H4PUFALYXWODYRABFLV
push eax
lea ecx, [esp + 0x1bc]
call fcn.0048177b
mov byte [esp + 0x1fc], 0x15
mov edx, eax
lea ecx, [esp + 0xfc]
mov dword [esp], str.TWTMHKD9F3MTR6AZOSWYI44FUC4C
call fcn.004817bf
mov byte [esp + 0x1fc], 0x16
mov edx, eax
push ecx
push edi
call fcn.004ae7d0
add esp, 0xc
mov byte [esp + 0x1f8], 0x15
xor edi, edi
lea ecx, [esp + 0xf8]
push 0
inc edi
push edi
call fcn.0047997f
mov byte [esp + 0x1f8], 0x14
lea ecx, [esp + 0x1b8]
push 0
push edi
call fcn.0047997f
mov byte [esp + 0x1f8], 0x13
lea ecx, [esp + 0x128]
push 0
push edi
call fcn.0047997f
mov byte [esp + 0x1f8], 0x12
lea ecx, [esp + 0x188]
push 0
push edi
call fcn.0047997f
mov byte [esp + 0x1f8], 0x11
lea ecx, [esp + 0xc8]
push 0
push edi
call fcn.0047997f
mov byte [esp + 0x1f8], 0x10
lea ecx, [esp + 0xe0]
push 0
push edi
call fcn.0047997f
mov byte [esp + 0x1f8], 0xf
lea ecx, [esp + 0x110]
push 0
push edi
call fcn.0047997f
mov byte [esp + 0x1f8], 0xd
lea ecx, [esp + 0x140]
push 0
push edi
call fcn.0047997f
xor eax, eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], eax
mov word [esp + 0x5c], ax
mov byte [esp + 0x1f8], 0x17
inc eax
push eax
mov dword [esp + 0x7c], eax
call fcn.005726f9
mov dword [esp + 0x80], eax
pop ecx
mov cl, byte [0x60fd34]
mov byte [eax], cl
mov dword [esp + 0x74], edi
mov byte [esp + 0x1f8], 0x18
lea eax, [esp + 0x170]
push eax
call fcn.004be955
mov edi, eax
mov byte [esp + 0x1f8], 0x19
and dword [esp + 0x18], 0
cmp dword [esp + 0x54], 0
je 0x4be3a7
cmp dword [esp + 0x58], 8
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x4c]
cmovae ecx, dword [esp + 0x4c]
xor eax, eax
push eax
push 0xf003f
push eax
push eax
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4be3a7
cmp dword [edi + 0x14], 8
jb 0x4be379
mov edi, dword [edi]
push dword [esp + 0x78]
push dword [esp + 0x80]
push dword [esp + 0x7c]
push 0
push edi
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
test eax, eax
je 0x4be4b4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
test al, al
sete bl
mov byte [esp + 0x1f8], 0x18
xor edi, edi
lea ecx, [esp + 0x170]
push 0
inc edi
push edi
call fcn.0047997f
mov byte [esp + 0x1f8], 0xd
lea ecx, [esp + 0x5c]
call fcn.004e54a0
test bl, bl
je 0x4be418
lea eax, [esp + 0x1a0]
push eax
call fcn.004bea00
mov byte [esp + 0x1f8], 0x1a
lea edx, [esp + 0x44]
push ecx
push eax
call fcn.004d822b
pop ecx
pop ecx
mov byte [esp + 0x1f8], 0xd
lea ecx, [esp + 0x1a0]
push 0
push edi
call fcn.0047997f
xor bh, bh
mov byte [esp + 0x1f8], 0xb
lea ecx, [esp + 0x2c]
push 0
push edi
call fcn.0047997f
mov byte [esp + 0x1f8], 6
lea ecx, [esp + 0x44]
push 0
push edi
call fcn.0047997f
add esi, 0x18
cmp esi, dword [esp + 0x20]
jne 0x4be023
mov byte [esp + 0x1f8], 4
lea ecx, [esp + 0x1c]
call fcn.0049919b
mov byte [esp + 0x1f8], 1
lea ecx, [esp + 0x80]
push 0
push 1
call fcn.0047997f
or dword [esp + 0x1f8], 0xffffffff
lea ecx, [esp + 0x98]
push 0
push 1
call fcn.0047997f
mov al, bh
mov ecx, dword [esp + 0x1f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1d8]
xor ecx, esp
call fcn.005712ac
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg eax
sbb al, al
inc al
jmp 0x4be3a9