Function at 0x48c0d0
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3c]
sub esp, 0x3c
push 0xffffffffffffffff
push 0x5424ed
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x596c60]
xor eax, ebp
mov dword [ebp + 0x38], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov eax, dword [0x59f554]
test al, 1
jne 0x48c138
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 1
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x48c14d
cmp byte [eax + 0x19], 6
jb 0x48c14d
mov al, 1
jmp 0x48c14f
xor al, al
cmp byte [0x59f560], 0
jne 0x48c169
cmp byte [0x59f561], 0
jne 0x48c169
test al, al
je 0x48c28b
sub esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa8]
call fcn.0047b4d0
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 3
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa8]
call fcn.0047ee50
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x288
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b46c
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Driver::RemoveTombStoneIfPresent
mov ecx, eax
call fcn.0047f0b0
mov byte [ebp - 4], 3
cmp dword [ebp + 0x34], 0x10
jb 0x48c1fa
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c1fa
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 5
cmp dword [esi + 0x14], 0x10
jb 0x48c217
mov esi, dword [esi]
mov eax, dword [0x59f554]
test al, 1
jne 0x48c242
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 6
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 5
push esi
push 6
mov ecx, 0x59f560
call fcn.004a1510
cmp dword [ebp + 0x34], 0x10
jb 0x48c265
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c265
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.0047b5a0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
mov dword [ebp - 4], 0
push 0x22
xor eax, eax
mov dword [ebp + 0x1c], 7
push str.systemCurrentControlSetServices_
lea ecx, [ebp + 8]
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
call fcn.0047c4b0
push 0xffffffffffffffff
push 0
lea eax, [ebp + 0x44]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp + 8]
call fcn.004825c0
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x48c2ce
lea eax, [ebp + 8]
lea ecx, [ebp + 4]
push ecx
push 0xf013f
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48c5e9
mov eax, dword [0x59f554]
test al, 1
jne 0x48c318
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 9
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 8
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x48c333
cmp byte [eax + 0x19], 6
jb 0x48c333
mov al, 1
jmp 0x48c335
xor al, al
cmp byte [0x59f560], 0
jne 0x48c34f
cmp byte [0x59f561], 0
jne 0x48c34f
test al, al
je 0x48c47b
sub esp, 8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa8]
call fcn.0047b4d0
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0xb
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xa8]
call fcn.0047ee50
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x290
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Found_existing
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 8]
mov ecx, eax
call fcn.004a1750
mov edx, str._reg_entry.
mov ecx, eax
call fcn.0047f0b0
mov byte [ebp - 4], 0xb
cmp dword [ebp + 0x34], 0x10
jb 0x48c3ea
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c3ea
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0xd
cmp dword [esi + 0x14], 0x10
jb 0x48c407
mov esi, dword [esi]
mov eax, dword [0x59f554]
test al, 1
jne 0x48c432
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 0xe
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 0xd
push esi
push 6
mov ecx, 0x59f560
call fcn.004a1510
cmp dword [ebp + 0x34], 0x10
jb 0x48c455
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c455
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xa
call fcn.0047b5a0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
mov dword [ebp - 4], 8
push str.DeleteFlag
push dword [ebp + 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
mov eax, dword [0x59f554]
je 0x48c63c
test al, 1
jne 0x48c4bc
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 0x10
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 8
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x48c4d7
cmp byte [eax + 0x19], 6
jb 0x48c4d7
mov al, 1
jmp 0x48c4d9
xor al, al
cmp byte [0x59f560], 0
jne 0x48c4f3
cmp byte [0x59f561], 0
jne 0x48c4f3
test al, al
je 0x48c5e0
sub esp, 8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xa8]
call fcn.0047b4d0
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x12
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa8]
call fcn.0047ee50
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x294
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Failed_to_Find_DeleteFlag.
mov ecx, eax
call fcn.0047f0b0
mov byte [ebp - 4], 0x12
cmp dword [ebp + 0x34], 0x10
jb 0x48c578
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c578
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x14
cmp dword [esi + 0x14], 0x10
jb 0x48c595
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
cmp dword [ebp + 0x34], 0x10
jb 0x48c5ba
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c5ba
push eax
call fcn.00507b54
add esp, 4
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x58]
call fcn.0047b5a0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
mov dword [ebp - 4], 8
push dword [ebp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x59f554]
test al, 1
jne 0x48c614
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 0x26
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 8
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x48c986
cmp byte [eax + 0x19], 6
jb 0x48c986
mov al, 1
jmp 0x48c988
test al, 1
jne 0x48c662
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 0x16
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 8
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x48c677
cmp byte [eax + 0x19], 6
jb 0x48c677
mov al, 1
jmp 0x48c679
xor al, al
cmp byte [0x59f560], 0
jne 0x48c693
cmp byte [0x59f561], 0
jne 0x48c693
test al, al
je 0x48c780
sub esp, 8
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xa8]
call fcn.0047b4d0
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x18
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xa8]
call fcn.0047ee50
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x298
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Deleted_Find_DeleteFlag.
mov ecx, eax
call fcn.0047f0b0
mov byte [ebp - 4], 0x18
cmp dword [ebp + 0x34], 0x10
jb 0x48c718
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c718
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x1a
cmp dword [esi + 0x14], 0x10
jb 0x48c735
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
cmp dword [ebp + 0x34], 0x10
jb 0x48c75a
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48c75a
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x17
call fcn.0047b5a0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
mov dword [ebp - 4], 8
push 4
lea eax, [ebp]
mov dword [ebp], 3
push eax
push 4
push 0
push str.Start
push dword [ebp + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x48c89c
call fcn.004a1320
mov ecx, dword [0x597f88]
test byte [ecx + 0x1c], 2
je 0x48c7c8
cmp byte [ecx + 0x19], 6
jb 0x48c7c8
mov cl, 1
jmp 0x48c7ca
xor cl, cl
cmp byte [eax], 0
jne 0x48c7dd
cmp byte [eax + 1], 0
jne 0x48c7dd
test cl, cl
je 0x48c5e0
sub esp, 8
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xa8]
call fcn.0047b4d0
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x1d
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xa8]
call fcn.0047ee50
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x29e
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Failed_to_set_Start3.
mov ecx, eax
call fcn.0047f0b0
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x1d
call fcn.0047abe0
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x1f
cmp dword [esi + 0x14], 0x10
jb 0x48c871
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp + 0x20]
call fcn.0047abe0
mov byte [ebp - 4], 0x1c
jmp 0x48c5be
call fcn.004a1320
mov ecx, dword [0x597f88]
test byte [ecx + 0x1c], 2
je 0x48c8b7
cmp byte [ecx + 0x19], 6
jb 0x48c8b7
mov cl, 1
jmp 0x48c8b9
xor cl, cl
cmp byte [eax], 0
jne 0x48c8cc
cmp byte [eax + 1], 0
jne 0x48c8cc
test cl, cl
je 0x48c5e0
sub esp, 8
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xa8]
call fcn.0047b4d0
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x22
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xa8]
call fcn.0047ee50
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x2a2
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Set_Start3.
mov ecx, eax
call fcn.0047f0b0
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x22
call fcn.0047abe0
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x24
cmp dword [esi + 0x14], 0x10
jb 0x48c960
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp + 0x20]
call fcn.0047abe0
mov byte [ebp - 4], 0x21
jmp 0x48c5be
xor al, al
cmp byte [0x59f560], 0
jne 0x48c9a2
cmp byte [0x59f561], 0
jne 0x48c9a2
test al, al
je 0x48cabd
sub esp, 8
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xa8]
call fcn.0047b4d0
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x28
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xa8]
call fcn.0047ee50
mov edx, str..Driver.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x2a8
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b498
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Driver::RemoveTombStoneIfPresent
mov ecx, eax
call fcn.0047f0b0
mov byte [ebp - 4], 0x28
cmp dword [ebp + 0x34], 0x10
jb 0x48ca33
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48ca33
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x2a
cmp dword [esi + 0x14], 0x10
jb 0x48ca50
mov esi, dword [esi]
mov eax, dword [0x59f554]
test al, 1
jne 0x48ca7b
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 0x2b
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 0x2a
push esi
push 6
mov ecx, 0x59f560
call fcn.004a1510
cmp dword [ebp + 0x34], 0x10
jb 0x48ca9e
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x48ca9e
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x27
call fcn.0047b5a0
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
cmp dword [ebp + 0x1c], 8
jb 0x48cad3
mov eax, dword [ebp + 8]
test eax, eax
je 0x48cad3
push eax
call fcn.00507b54
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x58], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x48cafd
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x48cafd
push eax
call fcn.00507b54
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x38]
xor ecx, ebp
call fcn.005072fd
lea esp, [ebp + 0x3c]
pop ebp
ret 0x18