Function at 0x4b4e12
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5f8
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1f]
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 7]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x54a0b4]
lea edi, [ebp - 0x3b]
mov byte [ebp - 0x3c], al
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xa
stosb byte es:[edi], al
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x73
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x5c
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6d
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x6e
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x5c
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x72
mov byte [ebp - 5], 0x76
mov byte [ebp - 4], 0x64
mov byte [ebp - 3], 0x61
mov byte [ebp - 2], 0x74
mov byte [ebp - 1], bl
call fcn.0045fb6d
test eax, eax
je 0x4b4edb
mov eax, 0x20000
jmp 0x4b518c
cmp dword [ebp + 8], ebx
jne 0x4b4ee7
push 1
jmp 0x4b509f
mov esi, 0x54a0b4
push esi
push dword [ebp + 8]
call fcn.004dd6c0
pop ecx
test eax, eax
pop ecx
je 0x4b4ee0
cmp dword [ebp + 0xc], ebx
je 0x4b4ee0
push esi
push dword [ebp + 0xc]
call fcn.004dd6c0
pop ecx
test eax, eax
pop ecx
je 0x4b4ee0
cmp dword [ebp + 0x10], ebx
je 0x4b4ee0
push 0x1f4
lea eax, [ebp - 0x5f8]
push ebx
push eax
call fcn.004d9ad0
mov edi, 0x100
lea eax, [ebp - 0x23c]
push edi
push ebx
push eax
call fcn.004d9ad0
push edi
lea eax, [ebp - 0x13c]
push ebx
push eax
call fcn.004d9ad0
push edi
lea eax, [ebp - 0x33c]
push ebx
push eax
call fcn.004d9ad0
push 0xc8
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.004d9ad0
push str._hdYx_px_nxk_izOR_q_t
call fcn.00448e7d
mov esi, eax
add esp, 0x40
cmp esi, ebx
mov dword [ebp - 0x28], esi
jge 0x4b4f84
push 2
jmp 0x4b509f
call fcn.00491f71
push dword [ebp + 0x10]
lea eax, [ebp - 0x5f8]
push dword [ebp + 0xc]
push esi
push str._d_s_s
push 0x1f3
push eax
call fcn.004de975
lea eax, [ebp - 0x5f8]
push esi
push eax
mov byte [ebp - 0x405], bl
call fcn.00461fa2
push eax
mov esi, 0xff
push str._08lX
lea eax, [ebp - 0x23c]
push esi
push eax
call fcn.004de975
push edi
call fcn.004dd48b
add esp, 0x34
cmp eax, ebx
mov dword [ebp - 0x24], eax
jne 0x4b4feb
mov eax, 0xc8001007
jmp 0x4b518c
push esi
push dword [ebp + 8]
push eax
call fcn.004dded0
mov edi, 0x51c940
push edi
push dword [ebp - 0x24]
call fcn.004df6d4
add esp, 0x14
test eax, eax
je 0x4b503f
push edi
push ebx
call fcn.004df6d4
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
je 0x4b503f
lea eax, [ebp - 0x23c]
push eax
call fcn.004d9400
mov ecx, esi
sub ecx, eax
lea eax, [ebp - 0x23c]
push ecx
push dword [ebp + 8]
push eax
call fcn.004de840
add esp, 0x10
jmp 0x4b500a
push dword [ebp - 0x24]
call fcn.004dce85
lea eax, [ebp - 0x20]
push esi
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004dded0
lea eax, [ebp - 0x13c]
push eax
call fcn.004d9400
mov ecx, esi
sub ecx, eax
lea eax, [ebp - 0x23c]
push ecx
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004de840
add esp, 0x20
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x13c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x4b50a5
push 8
pop eax
jmp 0x4b518c
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x33c]
push eax
call fcn.004dded0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x404]
push 0xc8
push eax
push dword [ebp + 0xc]
push edi
call fcn.00481133
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x404]
push dword [ebp + 0x10]
push eax
call fcn.0048dcb8
lea eax, [ebp - 0x33c]
push eax
call fcn.004b4aef
add esp, 0x2c
cmp eax, ebx
mov esi, 0x8000
je 0x4b510a
cmp eax, esi
je 0x4b510a
or eax, 0x10000000
jmp 0x4b518c
call fcn.004b49f3
cmp eax, ebx
je 0x4b511a
or eax, 0x20000000
jmp 0x4b518c
call fcn.004b48f4
cmp eax, ebx
je 0x4b512a
or eax, 0x40000000
jmp 0x4b518c
push edi
call fcn.004b4b0e
cmp eax, ebx
pop ecx
je 0x4b5140
cmp eax, esi
je 0x4b5140
or eax, 0x80000000
jmp 0x4b518c
push edi
call fcn.004b4c0e
cmp eax, ebx
pop ecx
je 0x4b5156
cmp eax, esi
je 0x4b5156
or eax, 0xf0000000
jmp 0x4b518c
push edi
call fcn.004b4d10
cmp eax, ebx
pop ecx
je 0x4b516c
cmp eax, esi
je 0x4b516c
or eax, 0x1000000
jmp 0x4b518c
call fcn.004b597c
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.004b5207
pop ecx
mov esi, eax
pop ecx
call fcn.004b597c
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret