Function at 0x481725
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc54
mov eax, dword [0x4dd52c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc38], eax
push ebx
xor eax, eax
push esi
push edi
xor ebx, ebx
mov edx, 0x81
mov word [ebp - 0xa24], bx
mov ecx, edx
lea edi, [ebp - 0xa22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x81c], bx
mov ecx, edx
lea edi, [ebp - 0x81a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x40c], bx
mov ecx, edx
lea edi, [ebp - 0x40a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x614], bx
mov ecx, edx
lea edi, [ebp - 0x612]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0xc2c], bx
mov ecx, edx
lea edi, [ebp - 0xc2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7f
pop ecx
xor eax, eax
mov word [ebp - 0x204], bx
lea edi, [ebp - 0x202]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x412790
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc40], eax
push 0x405e8c
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x81c]
push eax
push dword [ebp - 0xc30]
mov esi, 0x405a00
mov dword [ebp - 0xc54], esi
mov dword [ebp - 0xc50], 0x412520
mov dword [ebp - 0xc44], esi
mov dword [ebp - 0xc34], ebx
call fcn.00480395
call fcn.004807e7
push esi
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0xc34]
push eax
call fcn.004805f0
cmp eax, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x481893
push 0x200
lea eax, [ebp - 0x204]
push eax
push 0x412778
push dword [ebp - 0xc34]
call fcn.004807ae
push dword [ebp - 0xc34]
mov dword [ebp - 0xc48], eax
call edi
cmp dword [ebp - 0xc48], ebx
jne 0x481893
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
jne 0x4818ea
lea eax, [ebp - 0x204]
push eax
call fcn.004800bd
push esi
lea eax, [ebp - 0xc34]
push eax
push dword [ebp - 0xc30]
call fcn.0048045b
test eax, eax
jne 0x4818ea
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push ebx
push 0x412778
push dword [ebp - 0xc34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc34]
call edi
cmp dword [ebp + 0x14], 1
mov esi, 0x82
jne 0x4819ae
cmp dword [ebp - 0xc3c], ebx
je 0x4819ae
lea eax, [ebp - 0x204]
mov dword [ebp - 0xc30], ebx
mov dword [ebp - 0xc44], eax
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x614]
rep stosd dword es:[edi], eax
mov ecx, esi
lea edi, [ebp - 0x40c]
rep stosd dword es:[edi], eax
movsx eax, word [ebp - 0xc30]
push dword [ebp + eax*4 - 0xc44]
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x614]
push 0x40c920
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0xc2c]
push eax
lea eax, [ebp - 0x40c]
push eax
push 0x104
push 0x41276c
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0xa24]
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x481999
inc dword [ebp - 0xc30]
cmp word [ebp - 0xc30], 3
jne 0x481917
jmp 0x4819ae
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0xc3c]
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
cmp dword [ebp + 0x18], 1
jne 0x481a6d
cmp dword [ebp - 0xc38], ebx
je 0x481a6d
lea eax, [ebp - 0x204]
push 0x412520
push eax
mov dword [ebp - 0xc54], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4819e3
xor ebx, ebx
inc ebx
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x614]
rep stosd dword es:[edi], eax
mov ecx, esi
lea edi, [ebp - 0x40c]
rep stosd dword es:[edi], eax
movsx eax, bx
push dword [ebp + eax*4 - 0xc54]
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x614]
push 0x40c920
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0xc2c]
push eax
lea eax, [ebp - 0x40c]
push eax
push 0x104
push 0x412760
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0xa24]
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x481a58
inc ebx
cmp bx, 3
jne 0x4819e3
jmp 0x481a6d
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0xc38]
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004a9585
leave
ret 0x14