Function at 0x48b150
Capabilities:
Query or enumerate registry value
Set environment variable

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
push 2
call fcn.00445f00
mov ebx, eax
xor ebp, ebp
add esp, 4
cmp ebx, ebp
mov dword [esp + 0x10], ebx
je 0x48b170
mov word [ebx], bp
push 2
call fcn.00445f00
add esp, 4
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x48b185
mov word [eax], bp
mov ecx, dword [esp + 0x54]
cmp word [ecx], bp
mov edi, SysReAllocStringLen
mov dword [esp + 0x24], ebp
jne 0x48b19b
mov dword [esp + 0x54], ebp
mov esi, dword [esp + 0x50]
xor ecx, ecx
cmp word [esi], cx
sete dl
test dl, dl
mov byte [esp + 0x50], dl
jne 0x48b249
push 5
push esi
push str.HKCU_
call fcn.00440450
add esp, 0xc
test al, al
je 0x48b1dd
mov dword [esp + 0x24], 2
mov ebp, dword [esp + 0x24]
add esi, 0xa
xor ecx, ecx
jmp 0x48b260
push 0x13
push esi
push str.HKEY_CURRENT_USER_
call fcn.00440450
add esp, 0xc
test al, al
je 0x48b204
mov dword [esp + 0x24], 2
mov ebp, dword [esp + 0x24]
add esi, 0x24
xor ecx, ecx
jmp 0x48b260
push 5
push esi
push str.HKLM_
call fcn.00440450
add esp, 0xc
test al, al
je 0x48b21d
add esi, 0xa
jmp 0x48b234
push 0x13
push esi
push str.HKEY_LOCAL_MACHINE_
call fcn.00440450
add esp, 0xc
test al, al
je 0x48b239
add esi, 0x26
mov edi, SysReAllocStringLen
mov dword [esp + 0x24], 2
mov ebp, dword [esp + 0x24]
xor ecx, ecx
jmp 0x48b260
cmp ebp, 3
jae 0x48b6dc
mov edi, dword [ebp*4 + 0x4f6cc8]
mov esi, dword [ebp*4 + 0x4f6cbc]
movzx eax, word [0x518dc4]
lea edx, [esp + 0x1c]
push edx
or eax, 0xf003f
push eax
push ecx
push esi
push edi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x48b679
push 0
push 0
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
jne 0x48b689
mov eax, dword [esp + 0x28]
lea eax, [eax*4 + 8]
xor edi, edi
test eax, eax
mov dword [esp + 0x18], edi
jl 0x48b2f6
lea edx, [eax + eax + 2]
push edx
call fcn.00445f00
add esp, 4
test eax, eax
mov dword [esp + 0x18], eax
mov edi, eax
je 0x48b2f6
mov word [eax], si
mov eax, dword [esp + 0x2c]
lea eax, [eax*4 + 8]
xor ebp, ebp
test eax, eax
mov dword [esp + 0x20], ebp
jl 0x48b327
lea eax, [eax + eax + 2]
push eax
call fcn.00445f00
add esp, 4
test eax, eax
mov dword [esp + 0x20], eax
mov ebp, eax
je 0x48b327
mov word [eax], 0
mov ecx, dword [esp + 0x3c]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x44], eax
jle 0x48b639
lea esp, [esp]
mov ecx, dword [esp + 0x28]
lea edx, [ecx*4]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x48], edx
lea edx, [ecx*4]
lea ecx, [esp + 0x40]
push ecx
push ebp
push 0
push 0
mov dword [esp + 0x50], edx
lea edx, [esp + 0x58]
push edx
push edi
push eax
mov word [edi], 0
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x48b624
cmp word [edi], ax
je 0x48b624
mov eax, dword [esp + 0x54]
test eax, eax
je 0x48b3a8
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x48b624
mov ecx, dword [esp + 0x40]
shr ecx, 1
mov word [ebp + ecx*2], 0
mov esi, ebp
mov dword [esp + 0x30], edi
mov eax, edi
mov ecx, str.PATH
mov dl, byte [ecx]
test dl, dl
jne 0x48b3ce
cmp word [eax], 0
je 0x48b3ec
movzx ebx, word [eax]
movsx edx, dl
or ebx, 0x20
or edx, 0x20
add eax, 2
inc ecx
cmp edx, ebx
mov ebx, dword [esp + 0x10]
jne 0x48b48d
jmp 0x48b3c2
cmp word [ebp], 0
je 0x48b483
cmp word [ebx], 0
je 0x48b43c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
call ebx
push 0x4f6cb0
mov edi, eax
call ebx
mov ecx, dword [esp + 0x10]
mov esi, eax
inc esi
lea eax, [esi + edi]
shl eax, 1
push ecx
call fcn.00445f60
lea edx, [esi + esi]
push edx
mov dword [esp + 0x18], eax
lea eax, [eax + edi*2]
push 0x4f6cb0
push eax
call fcn.004aee50
add esp, 0x10
jmp 0x48b442
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, dword [esp + 0x10]
xor edi, edi
test eax, eax
je 0x48b451
push eax
call ebx
mov edi, eax
push ebp
call ebx
mov ecx, dword [esp + 0x10]
mov esi, eax
inc esi
lea eax, [esi + edi]
shl eax, 1
push ecx
call fcn.00445f60
lea edx, [esi + esi]
push edx
mov dword [esp + 0x18], eax
lea eax, [eax + edi*2]
push ebp
push eax
call fcn.004aee50
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
add esp, 0x10
mov esi, ebx
mov dword [esp + 0x30], 0x4f6ca4
push 0
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
push ecx
push esi
mov ecx, 0x519150
call fcn.00451c30
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov al, byte [esp + 0x50]
test al, al
je 0x48b624
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x30]
mov eax, dword [ebx + 0x4efe14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x48b610
push 0x4f6c9c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea edx, [esi + 2]
push edx
call fcn.00445f00
mov ecx, esi
mov ebp, eax
mov eax, ecx
shr ecx, 2
mov esi, 0x4f6c9c
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebx + 0x4efe14]
add esp, 4
test ebx, ebx
mov esi, ebp
je 0x48b564
test ebp, ebp
mov dword [esp + 0x34], 0
je 0x48b534
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esp + 0x34], eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x34]
mov edi, eax
inc edi
lea eax, [edi + ecx]
shl eax, 1
push ebp
call fcn.00445f60
mov esi, eax
mov eax, dword [esp + 0x38]
lea edx, [edi + edi]
push edx
lea ecx, [esi + eax*2]
push ebx
push ecx
call fcn.004aee50
add esp, 0x10
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ebx, ebx
test esi, esi
je 0x48b575
push esi
call ebp
mov ebx, eax
push 0x4f6c24
call ebp
mov edi, eax
inc edi
lea eax, [edi + ebx]
shl eax, 1
push esi
call fcn.00445f60
lea edx, [edi + edi]
push edx
mov esi, eax
lea eax, [esi + ebx*2]
push 0x4f6c24
push eax
call fcn.004aee50
mov edi, dword [esp + 0x24]
add esp, 0x10
test edi, edi
je 0x48b5dc
xor ebx, ebx
test esi, esi
je 0x48b5b4
push esi
call ebp
mov ebx, eax
push edi
call ebp
mov edi, eax
inc edi
lea eax, [edi + ebx]
shl eax, 1
push esi
call fcn.00445f60
mov edx, dword [esp + 0x18]
lea ecx, [edi + edi]
push ecx
mov esi, eax
push edx
lea eax, [esi + ebx*2]
push eax
call fcn.004aee50
add esp, 0x10
push 1
push 0
push 0
push esi
mov ecx, 0x519150
call fcn.0046b160
test esi, esi
je 0x48b604
mov ecx, dword [0x51927c]
add esi, 0xfffffff8
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x18]
add ebx, 8
cmp ebx, 0x40
mov dword [esp + 0x38], ebx
jb 0x48b4c3
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x3c]
inc eax
cmp eax, ecx
mov dword [esp + 0x44], eax
jl 0x48b340
test ebp, ebp
je 0x48b650
mov edx, dword [0x51927c]
add ebp, 0xfffffff8
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x48b666
mov eax, dword [0x51927c]
add edi, 0xfffffff8
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x48b675
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
inc ebp
mov dword [esp + 0x24], ebp
xor ecx, ecx
jmp 0x48b249
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x48b698
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x1c], 0
je 0x48b6bb
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x48b6d2
mov edx, dword [0x51927c]
add ebx, 0xfffffff8
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
mov edx, dword [esp + 0x54]
cmp edx, ecx
je 0x48b758
push edx
push str.PATH
call fcn.00440490
add esp, 8
test al, al
je 0x48b752
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x1c]
push eax
push ebx
mov ecx, 0x519150
call fcn.00451c30
mov esi, dword [esp + 0x14]
push esi
push 0x4f6ca4
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test esi, esi
je 0x48b731
mov ecx, dword [0x51927c]
add esi, 0xfffffff8
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x48b785
mov edx, dword [0x51927c]
add ebx, 0xfffffff8
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, ecx
je 0x48b76f
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
cmp ebx, ecx
je 0x48b785
add ebx, 0xfffffff8
push ebx
push ecx
mov ecx, dword [0x51927c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret