Function at 0x48b0e0
Capabilities:
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb8e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x28dc
call fcn.004f2630
push ebx
push esi
push edi
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x10], esp
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.004ab6e0
add esp, 4
lea ecx, [ebp - 0x94]
push ecx
call fcn.00401350
add esp, 4
mov dword [ebp - 0x44], edi
call fcn.004b1530
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x28ec]
push edx
push eax
call fcn.004c6c30
add esp, 8
cmp edi, dword [ebp - 0x44]
jge 0x48b217
mov ecx, edi
shl ecx, 7
lea esi, [ebp + ecx - 0x28ec]
push esi
call fcn.004ad380
add esp, 4
push esi
call fcn.004ad610
add esp, 4
push esi
call fcn.004ad890
add esp, 4
push esi
call fcn.004adb10
add esp, 4
push esi
call fcn.004add90
add esp, 4
push esi
call fcn.004ae020
add esp, 4
push esi
call fcn.004ae2a0
add esp, 4
push esi
call fcn.004ae520
add esp, 4
push esi
call fcn.004ad380
add esp, 4
lea edx, [ebp - 0x5ec]
mov byte [ebp - 0x5ec], 0
push esi
push str._sSoftwareMicrosoftWindows_NTCurrentVersionWindows
push edx
call fcn.004f175f
lea eax, [ebp - 0x5ec]
push str.load
push eax
push str.HKCU
call fcn.004bf570
add esp, 0x18
lea ecx, [ebp - 0x5ec]
mov byte [ebp - 0x5ec], 0
push esi
push str._sSoftwareMicrosoftWindows_NTCurrentVersionWindows
push ecx
call fcn.004f175f
lea edx, [ebp - 0x5ec]
push 0x5142f8
push edx
push str.HKCU
call fcn.004bf570
add esp, 0x18
inc edi
jmp 0x48b147
call fcn.004b1500
mov ebx, eax
push 1
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x58], ebx
call fcn.004f0653
push 1
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 1
call fcn.004f0653
push 1
lea ecx, [ebp - 0x1ec]
mov byte [ebp - 4], 2
call fcn.004f0653
push 0x2c0
mov byte [ebp - 4], 3
call fcn.004f266a
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add esp, 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x66c]
push 0x80
push eax
call esi
lea ecx, [ebp - 0x7ec]
push 0x80
push ecx
call esi
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x124]
push edx
push 1
push str.c:endpcache_auto_repair.txt
mov dword [ebp - 0x2c], 0
call fcn.004f0727
mov eax, dword [ebp - 0x124]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x120]
cmp dword [eax + 0x30], 0xffffffff
je 0x48b332
mov esi, dword [ebp - 0x120]
push 0xa
lea edx, [ebp - 0x4ec]
inc esi
push 0x40
push edx
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x120], esi
call fcn.004f0ae9
lea edi, [ebp - 0x4ec]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jle 0x48b332
lea eax, [ebp - 0x4ec]
push str.close
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48b313
mov dword [ebp - 0x2c], 1
lea ecx, [ebp - 0x4ec]
push str.startup
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48b332
mov dword [ebp - 0x2c], 1
lea ecx, [ebp - 0x124]
call fcn.004f076e
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0xdc]
push edx
push 2
push str.c:endpcacheprocess_log_HKCU.txt
call fcn.004f0727
push 0x100
push 0
push str.c:endpcacheprocess_start_list.txt
mov dword [ebp - 0x38], 0
call fcn.004f2f2b
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x48b387
push esi
call fcn.004f2eb3
push esi
call fcn.004f2e00
add esp, 8
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x1ec]
push eax
push 8
push str.c:endpcacheprocess_start_list.txt
call fcn.004f0727
xor esi, esi
mov dword [ebp - 0x24], esi
cmp esi, ebx
jge 0x48c1ff
xor eax, eax
push esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
call fcn.004b1510
mov ebx, eax
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
jge 0x48b506
test ecx, ecx
jle 0x48b506
lea ecx, [ebp - 0x18]
push esi
push ecx
call fcn.004b1440
mov edx, dword [ebp - 0x18]
add esp, 8
add edx, 0x40
push edx
call fcn.004fa6c0
mov esi, eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x48b42c
lea ecx, [ebp - 0x5c]
lea edx, [ebp - 0x3c]
push ecx
push edx
push eax
push 2
push eax
push 0xc30c0c
push eax
push esi
push closesocket
jmp 0x48b447
lea eax, [ebp - 0x5c]
lea ecx, [ebp - 0x3c]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
push 0
push esi
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48b4fd
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
add edx, 0x140
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x48b477
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x18]
push str.load
add edx, 0x140
mov byte [ebp - 0x46c], 0
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x48b4fd
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x94]
add eax, 0x140
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x1a4]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x46c]
push 0x51719c
push eax
call fcn.004f175f
add esp, 0x14
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0xd0]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x3c]
push edx
jmp 0x48c1ea
push str.c:endpcachedownAutohc.exe
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x48c1f0
push str._ProgramFiles_Windows_SidebarSidebar.exe__autoRun
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x48c1f0
push str._ProgramFiles_Windows_SidebarSidebar.exe
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48c1f0
push str.c:endpcache
push ebx
call fcn.004f2d80
push str.soundman.exe
push ebx
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x48b572
cmp dword [0xe56bd8], 1
je 0x48c1f0
lea eax, [ebp - 0x66c]
lea ecx, [ebp - 0x46c]
push eax
push str._sctfmon.exe
push ecx
mov byte [ebp - 0x46c], 0
call fcn.004f175f
lea edx, [ebp - 0x46c]
push edx
push ebx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x48c1f0
lea eax, [ebp - 0x66c]
lea ecx, [ebp - 0x46c]
push eax
push str._sinternat.exe
push ecx
mov byte [ebp - 0x46c], 0
call fcn.004f175f
lea edx, [ebp - 0x46c]
push edx
push ebx
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x48c1f0
push str.ctfmon.exe
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x48c1f0
push str.internat.exe
push ebx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x48c1f0
push str._system32ctfmon.exe
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48c1f0
push str._system32internat.exe
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48c1f0
push str.System32ctfmon.exe
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48c1f0
push str.System32internat.exe
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48c1f0
push str.stem32dumprep
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48c1f0
push str.IMETINTLGNTTINTSETP.EXE
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48c1f0
push str.IMEimjp8_1IMJPMIG.EXE
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48c1f0
mov eax, dword [0xe56da0]
mov esi, 1
cmp eax, esi
jne 0x48b6e8
push str.ShowWelcomeCenter
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48c1f0
cmp dword [0xe56da0], esi
jne 0x48b6e8
push str.Core_StaticCLIStart.exe
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48c1f0
push str..bat
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b6fd
mov dword [ebp - 0x14], esi
push str..reg
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b712
mov dword [ebp - 0x14], esi
push str..com
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b739
push str..com_
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48b739
mov dword [ebp - 0x14], esi
push str..pif
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b74e
mov dword [ebp - 0x14], esi
push str..scr
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b763
mov dword [ebp - 0x14], esi
push str..hta
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b778
mov dword [ebp - 0x14], esi
push str..vbs
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b79a
cmp dword [0xe56bec], esi
jne 0x48b797
mov dword [ebp - 0x1c], esi
jmp 0x48b79a
mov dword [ebp - 0x14], esi
push str..VBS
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b7bc
cmp dword [0xe56bec], esi
jne 0x48b7b9
mov dword [ebp - 0x1c], esi
jmp 0x48b7bc
mov dword [ebp - 0x14], esi
push str..Vbs
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b7de
cmp dword [0xe56bec], esi
jne 0x48b7db
mov dword [ebp - 0x1c], esi
jmp 0x48b7de
mov dword [ebp - 0x14], esi
push str..vba
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b7f3
mov dword [ebp - 0x14], esi
push 0x516fc8
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b808
mov dword [ebp - 0x14], esi
push str..bmp
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b81d
mov dword [ebp - 0x14], esi
push str..BMP
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b832
mov dword [ebp - 0x14], esi
push 0x516860
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b847
mov dword [ebp - 0x14], esi
push str..jse
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b85c
mov dword [ebp - 0x14], esi
push str..wsf
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b871
mov dword [ebp - 0x14], esi
push str..wsh
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b886
mov dword [ebp - 0x14], esi
push str.regedit
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b89b
mov dword [ebp - 0x14], esi
push str.http
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b8b0
mov dword [ebp - 0x14], esi
push str.Http
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b8c5
mov dword [ebp - 0x14], esi
push 0x51688c
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b8da
mov dword [ebp - 0x14], esi
push str.Rundll32
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b8ef
mov dword [ebp - 0x14], esi
push 0x5222fc
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b904
mov dword [ebp - 0x14], esi
push str.IEXPLORE
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b919
mov dword [ebp - 0x14], esi
push str.Temp
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b92e
mov dword [ebp - 0x14], esi
push str.Application_Data
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b943
mov dword [ebp - 0x14], esi
push str.windows_
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b958
mov dword [ebp - 0x14], esi
push str.WINDOWS_
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b96d
mov dword [ebp - 0x14], esi
push str.WINNT_
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b982
mov dword [ebp - 0x14], esi
push str.winnt_
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b997
mov dword [ebp - 0x14], esi
push str._system
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b9ac
mov dword [ebp - 0x14], esi
push str.System
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b9c1
mov dword [ebp - 0x14], esi
push str.regsvr32
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48b9d6
mov dword [ebp - 0x14], esi
push 0x5147e0
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48b9eb
mov dword [ebp - 0x14], esi
push 0x516f24
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48ba00
mov dword [ebp - 0x14], esi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
cmp eax, ecx
jge 0x48ba1c
cmp byte [eax + ebx], 0x5c
jne 0x48ba19
inc edx
inc eax
jmp 0x48ba0e
cmp edx, esi
jne 0x48ba23
mov dword [ebp - 0x14], esi
push 0x515e8c
push ebx
call fcn.004f2d80
push 0x515e88
push ebx
call fcn.004f2d80
push str..pif
push ebx
call fcn.004f2d80
push str..Pif
push ebx
call fcn.004f2d80
push str..kxp
push ebx
call fcn.004f2d80
mov eax, dword [0xe56be4]
add esp, 0x28
xor esi, esi
cmp eax, 1
mov byte [ebp - 0x46c], 0
jne 0x48bab9
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
cmp eax, 2
jge 0x48bab3
mov edi, eax
push ebx
shl edi, 8
lea eax, [edi + 0xc5159c]
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x48baae
lea ecx, [edi + 0x510324]
push ecx
call fcn.004fa6c0
add esp, 4
mov esi, eax
mov dword [ebp - 0x14], 0
jmp 0x48bac4
inc dword [ebp - 0x20]
jmp 0x48ba73
xor eax, eax
test eax, eax
jne 0x48bac4
push ebx
call fcn.00410fd0
add esp, 4
mov esi, eax
push str.load
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push str.HKCU
call fcn.004bf570
add esp, 0xc
push 0x5147b4
push esi
call fcn.004f2d80
push 0x5144fc
push esi
mov dword [ebp - 0x70], eax
call fcn.004f2d80
push 0x516f10
push esi
mov dword [ebp - 0x20], eax
call fcn.004f2d80
push 0x5222e0
push esi
mov dword [ebp - 0x4c], eax
call fcn.004f2d80
push 0x5222d4
push esi
mov edi, eax
call fcn.004f2d80
push 0x516efc
push esi
mov dword [ebp - 0x54], eax
call fcn.004f2d80
push 0x5222c8
push esi
mov dword [ebp - 0x48], eax
call fcn.004f2d80
push str..NET
push esi
mov dword [ebp - 0x68], eax
call fcn.004f2d80
add esp, 0x40
mov dword [ebp - 0x50], eax
test edi, edi
mov edi, 2
jne 0x48bb59
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x48bc33
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x48bc33
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x48bc33
mov eax, dword [ebp - 0x54]
test eax, eax
jne 0x48bc33
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x48bc33
mov eax, dword [ebp - 0x68]
test eax, eax
jne 0x48bc33
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x48bc33
push esi
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x94]
push eax
push ebx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x46c]
push eax
push 0x525e80
push ecx
call fcn.004f175f
mov edx, dword [0xe56d24]
mov ecx, dword [0xe56d68]
add esp, 0x18
inc edx
mov dword [0xe56d24], edx
inc ecx
lea edx, [ebp - 0x46c]
mov dword [0xe56d68], ecx
push edx
lea ecx, [ebp - 0xd0]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edi, 1
mov dword [ebp - 0x38], edi
jmp 0x48bcc1
push esi
lea eax, [ebp - 0x94]
push ebx
push eax
mov byte [ebp - 0x46c], 0
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x1a4]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x46c]
push eax
push 0x525e50
push edx
call fcn.004f175f
add esp, 0x18
lea eax, [ebp - 0x46c]
lea ecx, [ebp - 0xd0]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x48bcba
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x48bcba
mov eax, dword [ebp - 0x54]
test eax, eax
jne 0x48bcba
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x48bcba
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x48bcc1
mov dword [ebp - 0x1c], 1
push str.StartPowerManager
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48bd09
push str.StartBattLog
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48bd09
push str.PwrMgrBkGndMonitor
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x48bd09
push str.Bluetooth
push ebx
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x48bd15
mov dword [ebp - 0x1c], 1
jmp 0x48bf4b
mov esi, 1
cmp edi, esi
jne 0x48be2e
lea ecx, [ebp - 0x94]
push ebx
push ecx
mov byte [ebp - 0x46c], 0
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x1a4]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x46c]
push 0x525de0
push eax
call fcn.004f175f
add esp, 0x14
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0xd0]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x18]
push edx
push eax
mov dword [ebp - 0x38], esi
call fcn.004b1440
mov ecx, dword [ebp - 0x18]
add esp, 8
add ecx, 0x40
push ecx
call fcn.004fa6c0
mov edx, dword [ebp - 0x18]
mov esi, eax
push edx
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x48bdde
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x40]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
push 0
push esi
push closesocket
jmp 0x48bdf9
lea edx, [ebp - 0x6c]
lea eax, [ebp - 0x40]
push edx
push eax
push 0
push 2
push 0
push 0xc30c0c
push 0
push esi
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48be25
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x40]
add ecx, 0x140
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x48be25
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x40]
push ecx
jmp 0x48bf45
cmp edi, 2
jne 0x48bf4b
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x48bf4b
lea edx, [ebp - 0x94]
push ebx
push edx
mov byte [ebp - 0x46c], 0
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x46c]
push eax
push 0x525d84
push ecx
call fcn.004f175f
add esp, 0x14
lea edx, [ebp - 0x46c]
lea ecx, [ebp - 0xd0]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x18]
push eax
push ecx
mov dword [ebp - 0x38], esi
call fcn.004b1440
mov edx, dword [ebp - 0x18]
add esp, 8
add edx, 0x40
push edx
call fcn.004fa6c0
mov esi, eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x48befa
lea ecx, [ebp - 0x74]
lea edx, [ebp - 0x34]
push ecx
push edx
push eax
push edi
push eax
push 0xc30c0c
push eax
push esi
push closesocket
jmp 0x48bf15
lea eax, [ebp - 0x74]
lea ecx, [ebp - 0x34]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
push 0
push esi
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48bf41
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
add edx, 0x140
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x48bf41
mov ecx, dword [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2c], 1
jne 0x48c097
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x48c097
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x94]
add eax, 0x140
mov byte [ebp - 0x46c], 0
push eax
push ebx
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x1a4]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x46c]
push 0x525d48
push eax
call fcn.004f175f
add esp, 0x18
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0xd0]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x18]
push edx
push eax
call fcn.004b1440
mov ecx, dword [ebp - 0x18]
add esp, 8
add ecx, 0x40
push ecx
call fcn.004fa6c0
mov edx, dword [ebp - 0x18]
mov esi, eax
add edx, 0x40
push edx
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x8ec]
push 0x50d39c
push eax
call fcn.004f175f
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x48c040
lea edx, [ebp - 0x60]
lea eax, [ebp - 0x28]
push edx
push eax
push 0
push 2
push 0
push 0xc30c0c
push 0
push esi
push closesocket
jmp 0x48c061
lea ecx, [ebp - 0x60]
lea edx, [ebp - 0x28]
push ecx
push edx
push 0
push 2
push 0
push 0xc30c0c
lea eax, [ebp - 0x8ec]
push 0
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48c08d
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
add ecx, 0x140
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x48c08d
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x58]
mov esi, dword [ebp - 0x44]
sub edx, esi
sub edx, 3
cmp edx, 0xe1
jle 0x48c1f0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x48c1f0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x94]
add eax, 0x140
mov byte [ebp - 0x46c], 0
push eax
push ebx
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x1a4]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x46c]
push 0x525d48
push eax
call fcn.004f175f
add esp, 0x18
lea ecx, [ebp - 0x46c]
push ecx
lea ecx, [ebp - 0xd0]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x18]
push edx
push eax
call fcn.004b1440
mov ecx, dword [ebp - 0x18]
add esp, 8
add ecx, 0x40
push ecx
call fcn.004fa6c0
mov edx, dword [ebp - 0x18]
mov esi, eax
add edx, 0x40
push edx
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x76c]
push 0x50d39c
push eax
call fcn.004f175f
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x48c199
lea edx, [ebp - 0x64]
lea eax, [ebp - 0x30]
push edx
push eax
push 0
push 2
push 0
push 0xc30c0c
push 0
push esi
push closesocket
jmp 0x48c1ba
lea ecx, [ebp - 0x64]
lea edx, [ebp - 0x30]
push ecx
push edx
push 0
push 2
push 0
push 0xc30c0c
lea eax, [ebp - 0x76c]
push 0
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x48c1e6
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x30]
add ecx, 0x140
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x48c1e6
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x58]
inc esi
mov dword [ebp - 0x24], esi
jmp 0x48b3a4
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x48c2b4
lea edx, [ebp - 0x94]
push ebx
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x46c]
push eax
push 0x525d0c
push ecx
call fcn.004f175f
mov eax, dword [ebp - 0x2c]
add esp, 0x14
cmp eax, 1
jne 0x48c277
mov edi, 0x516d9c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x46c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0xd8]
cmp dword [eax + 0x30], 0xffffffff
je 0x48c2b4
lea edx, [ebp - 0x46c]
lea ecx, [ebp - 0xd0]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0xdc]
call fcn.004f076e
lea ecx, [ebp - 0x1ec]
call fcn.004f076e
mov eax, dword [ebp - 0x18]
push eax
call fcn.004f265f
add esp, 4
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x1d8]
call fcn.004f05fb
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 1
call fcn.004f0714
lea ecx, [ebp - 0xc8]
call fcn.004f05fb
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x110]
call fcn.004f05fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret