Function at 0x4b16231e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x10], 0
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_malloc]
push esi
push edi
mov esi, 0x2000
push esi
mov dword [ebp - 8], ecx
call ebx
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 0x20], edi
jne 0x4b162352
mov esi, 0x8007000e
jmp 0x4b1625b0
mov ecx, dword [ebp - 8]
push edi
call fcn.4b161c1f
test eax, eax
jge 0x4b162366
mov esi, eax
jmp 0x4b1625a6
lea eax, [ebp - 2]
push eax
push edi
call fcn.4b1619f8
test eax, eax
jne 0x4b16237e
mov esi, 0x80020009
jmp 0x4b1625a6
push esi
call ebx
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 0xc], edi
jne 0x4b162395
mov esi, 0x8007000e
jmp 0x4b1625a6
mov ecx, dword [ebp - 8]
call fcn.4b161bf6
mov ecx, dword [ebp - 8]
push edi
call fcn.4b161c1f
test eax, eax
jge 0x4b1623b1
mov esi, eax
jmp 0x4b16259c
movzx eax, word [ebp - 2]
sub eax, 8
je 0x4b1624a7
sub eax, 9
je 0x4b1623ed
dec eax
dec eax
jne 0x4b162587
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push edi
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.4b161700
jmp 0x4b162587
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test al, 1
mov dword [ebp + 0x14], eax
jne 0x4b1624c6
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0x400
mov dword [ebp - 4], esi
ja 0x4b16242c
push esi
call fcn.4b161553
test al, al
je 0x4b16242c
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.4b167950
mov ebx, esp
jmp 0x4b162437
push esi
lea ecx, [ebp - 0x10]
call fcn.4b1622f3
mov ebx, eax
test ebx, ebx
je 0x4b1624c6
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp dword [ebp + 0x14], edi
jle 0x4b16248d
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ebx]
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + edi*2]
push eax
call fcn.4b161a82
mov ecx, edi
and ecx, 1
shl ecx, 2
mov edx, ecx
push 4
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp + 0x14]
jl 0x4b16245a
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push ebx
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x4b162587
mov dword [ebp - 4], edi
xor edi, edi
cmp byte [ebp + 0x14], 0
je 0x4b16256d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xffe
jle 0x4b1624d0
mov esi, 0x80004005
jmp 0x4b16259c
push esi
call ebx
mov edi, eax
test edi, edi
pop ecx
jne 0x4b1624e4
mov esi, 0x8007000e
jmp 0x4b16259c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
and dword [ebp - 0x1c], 0
push 0x4b1535bc
call fcn.4b162165
test eax, eax
mov dword [ebp + 0x14], eax
je 0x4b162565
mov ebx, dword [ebp - 0xc]
push eax
push ebx
call fcn.4b161b30
mov esi, eax
test esi, esi
mov dword [ebp - 0x18], esi
je 0x4b162565
cmp esi, dword [ebp + 0x10]
je 0x4b162525
push esi
push ebx
call dword [sym.imp.USER32.dll_CharPrevW]
cmp word [eax], 0x22
je 0x4b162565
and word [edi], 0
sub esi, ebx
sar esi, 1
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebx, 0x4b1535b8
push ebx
push edi
call esi
push dword [ebp + 0x14]
push edi
call esi
push ebx
push edi
call esi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*2]
push eax
push edi
call esi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x1c]
call fcn.4b161f7f
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp - 4]
call fcn.4b161723
test edi, edi
je 0x4b162587
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
call fcn.4b161c1f
test eax, eax
jl 0x4b1623aa
xor esi, esi
push dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x20]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
lea ecx, [ebp - 0x10]
call fcn.4b161f7f
mov eax, esi
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
leave
ret 0x10