Function at 0x4b50a0
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61853b
push eax
mov dword fs:[0], esp
sub esp, 0x220
lea eax, [esp + 0xc]
push esi
mov esi, ecx
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x6ec0c8
push 0
push 0x6c4938
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4b513a
lea ecx, [esp + 0x14]
call fcn.004ab420
push 1
push 0x6c4904
lea ecx, [esp + 0x1c]
mov dword [esp + 0x234], 0
call fcn.004ab540
lea ecx, [esp + 0x14]
mov dword [esp + 0x22c], 0xffffffff
call fcn.004ab530
pop esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
add esp, 0x22c
ret
push ebx
push ebp
push edi
push 0
mov byte [esp + 0x17], 0
mov ebp, 0x60
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
test edi, edi
je 0x4b5170
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push edi
call ebx
push 0x5a
push edi
mov ebp, eax
call ebx
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp ebp, 0x60
je 0x4b517a
mov byte [esp + 0x13], 1
lea ebx, [esi + 0xe0]
xor edi, edi
mov dword [esp + 0x18], ebx
mov eax, dword [ebx + 4]
test eax, eax
mov al, byte [esp + 0x13]
je 0x4b51b5
push 0
push edi
test al, al
push 0x101d
je 0x4b51a9
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4b51bb
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4b51c5
test al, al
je 0x4b51c7
mov eax, dword [ebx]
push ebp
push 0x60
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebx], eax
inc edi
add ebx, 8
cmp edi, 0xb
jl 0x4b5186
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 8
push ecx
push 0
push 0
push 0x6c41e8
push edx
call edi
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0xe8]
push 8
push eax
push 0
push 0
push 0x6c48f8
push ecx
call edi
mov eax, dword [esp + 0x14]
lea edx, [esi + 0xf0]
push 8
push edx
push 0
push 0
push 0x6c334c
push eax
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esi + 0xf8]
push 8
push ecx
push 0
push 0
push 0x6c41d4
push edx
call edi
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0x100]
push 8
push eax
push 0
push 0
push 0x6c48f0
push ecx
call edi
mov eax, dword [esp + 0x14]
lea edx, [esi + 0x108]
push 8
push edx
push 0
push 0
push 0x6c48e4
push eax
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esi + 0x110]
push 8
push ecx
push 0
push 0
push 0x6c48d4
push edx
call edi
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0x118]
push 8
push eax
push 0
push 0
push 0x6c48cc
push ecx
call edi
mov eax, dword [esp + 0x14]
lea edx, [esi + 0x120]
push 8
push edx
push 0
push 0
push 0x6c41c0
push eax
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esi + 0x128]
push 8
push ecx
push 0
push 0
push 0x6c41cc
push edx
call edi
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0x130]
push 8
push eax
push 0
push 0
push 0x6c48c4
push ecx
call edi
lea ebx, [esi + 0x138]
push 0xb
push ebx
mov ecx, esi
call fcn.005f5215
test eax, eax
je 0x4b530e
mov edx, dword [esp + 0x14]
push 0x2c
push ebx
push 0
push 0
push 0x6c48bc
push edx
call edi
mov al, byte [esp + 0x13]
test al, al
je 0x4b5333
mov esi, dword [esp + 0x18]
mov edi, 0xb
mov eax, dword [esi]
push 0x60
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [esi], eax
add esi, 8
dec edi
jne 0x4b531f
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x230]
pop edi
pop ebp
pop ebx
pop esi
mov dword fs:[0], ecx
add esp, 0x22c
ret