Function at 0x48a4f0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x110c
call fcn.00517f10
mov edi, dword [ebp + 8]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
test edi, edi
je 0x48a951
cmp dword [ebp + 0xc], 0x20
jl 0x48a951
mov dword [ebp - 0x1114], 1
mov dword [ebp - 0x1118], 0x400
lea esi, [ebp - 0x1110]
push 0x400
push 0
push esi
call fcn.006030b0
add esp, 0xc
lea eax, [ebp - 0x1118]
lea ecx, [ebp - 0x1114]
push eax
push esi
push ecx
push 0x645f38
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x48a70c
push esi
call fcn.0061fdf0
add esp, 4
cmp eax, 0x40
jne 0x48a70c
mov eax, 0x80
xor ecx, ecx
nop
movzx edx, byte [ebp + ecx - 0x1110]
test dl, dl
je 0x48a5f2
mov byte [ebp + ecx - 0x90], dl
movzx edx, byte [ebp + ecx - 0x110f]
test dl, dl
je 0x48a5fc
mov byte [ebp + ecx - 0x8f], dl
movzx edx, byte [ebp + ecx - 0x110e]
test dl, dl
je 0x48a606
mov byte [ebp + ecx - 0x8e], dl
movzx edx, byte [ebp + ecx - 0x110d]
test dl, dl
je 0x48a610
mov byte [ebp + ecx - 0x8d], dl
add eax, 0xfffffffc
add ecx, 4
cmp ecx, 0x20
jne 0x48a590
lea edx, [ecx + ebp]
add edx, 0xffffff70
jmp 0x48a625
add ecx, ebp
add ecx, 0xffffff70
jmp 0x48a61d
add ecx, ebp
add ecx, 0xffffff71
jmp 0x48a618
add ecx, ebp
add ecx, 0xffffff72
jmp 0x48a618
add ecx, ebp
add ecx, 0xffffff73
mov eax, 1
lea edx, [ecx - 1]
test eax, eax
cmovne edx, ecx
mov byte [edx], 0
mov ecx, 0x80
xor edx, edx
lea eax, [ebp - 0x91]
nop word cs:[eax + eax]
nop
movzx ebx, byte [ebp + edx - 0x10f0]
test bl, bl
je 0x48a69c
mov byte [ebp + edx - 0x110], bl
movzx ebx, byte [ebp + edx - 0x10ef]
test bl, bl
je 0x48a6a6
mov byte [ebp + edx - 0x10f], bl
movzx ebx, byte [ebp + edx - 0x10ee]
test bl, bl
je 0x48a6b0
mov byte [ebp + edx - 0x10e], bl
movzx ebx, byte [ebp + edx - 0x10ed]
test bl, bl
je 0x48a6ba
mov byte [ebp + edx - 0x10d], bl
add ecx, 0xfffffffc
add edx, 4
cmp edx, 0x80
jne 0x48a640
jmp 0x48a6ce
lea eax, [edx + ebp]
add eax, 0xfffffef0
jmp 0x48a6c7
lea eax, [edx + ebp]
add eax, 0xfffffef1
jmp 0x48a6c2
lea eax, [edx + ebp]
add eax, 0xfffffef2
jmp 0x48a6c2
lea eax, [edx + ebp]
add eax, 0xfffffef3
mov ecx, 1
test ecx, ecx
jne 0x48a6ce
add eax, 0xffffffff
mov byte [eax], 0
push 0x400
push 0
push esi
call fcn.006030b0
add esp, 0xc
lea ecx, [ebp - 0x90]
mov edx, esi
push 0x400
call fcn.0048a1d0
add esp, 4
lea eax, [ebp - 0x110]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x48a966
push 0x1000
push 0
push esi
call fcn.006030b0
add esp, 0xc
push 0x1000
push esi
call fcn.00489f30
add esp, 8
lea edi, [ebp - 0x90]
push 0x64
push edi
call fcn.00488c40
add esp, 8
test al, al
jne 0x48a770
push 0x64
push edi
call fcn.00488f80
add esp, 8
test al, al
jne 0x48a770
push 0x64
push edi
call fcn.004893a0
add esp, 8
test al, al
jne 0x48a770
push 0x64
push edi
call fcn.004895a0
add esp, 8
test al, al
je 0x48a84a
push edi
call fcn.0061fdf0
add esp, 4
test eax, eax
je 0x48a797
nop dword [eax]
cmp byte [ebp + eax - 0x91], 0x20
jne 0x48a797
mov byte [ebp + eax - 0x91], 0
add eax, 0xffffffff
jne 0x48a780
mov ecx, 0xfffff000
mov eax, 0xffd
nop word cs:[eax + eax]
nop dword [eax + eax]
cmp byte [ebp + ecx - 0x110], 0
je 0x48a7e2
cmp byte [ebp + ecx - 0x10f], 0
je 0x48a7e8
cmp byte [ebp + ecx - 0x10e], 0
je 0x48a7ed
cmp byte [ebp + ecx - 0x10d], 0
je 0x48a7f0
add eax, 0xfffffffc
add ecx, 4
jne 0x48a7b0
jmp 0x48a84a
neg ecx
mov eax, ecx
jmp 0x48a7f0
add eax, 2
jmp 0x48a7f0
add eax, 1
mov ecx, 0x1000
sub ecx, eax
mov edi, esi
add esi, ecx
add esi, 0xfffff000
xor edx, edx
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, byte [ebp + edx - 0x90]
test bl, bl
je 0x48a830
mov byte [esi + edx + 0x1000], bl
add edx, 1
cmp eax, edx
jne 0x48a810
mov esi, edi
add ecx, edi
jmp 0x48a838
mov esi, edi
add ecx, edi
cmp eax, edx
jne 0x48a83f
add ecx, edx
add ecx, 0xffffffff
jmp 0x48a841
add ecx, edx
lea edi, [ebp - 0x90]
mov byte [ecx], 0
push 0x64
push edi
call fcn.00489830
add esp, 8
test al, al
jne 0x48a86c
push 0x64
push edi
call fcn.00489c90
add esp, 8
test al, al
je 0x48a910
mov ecx, 0xfffff000
mov eax, 0xffd
nop word cs:[eax + eax]
cmp byte [ebp + ecx - 0x110], 0
je 0x48a8b2
cmp byte [ebp + ecx - 0x10f], 0
je 0x48a8b8
cmp byte [ebp + ecx - 0x10e], 0
je 0x48a8bd
cmp byte [ebp + ecx - 0x10d], 0
je 0x48a8c0
add eax, 0xfffffffc
add ecx, 4
jne 0x48a880
jmp 0x48a910
neg ecx
mov eax, ecx
jmp 0x48a8c0
add eax, 2
jmp 0x48a8c0
add eax, 1
mov ecx, 0x1000
sub ecx, eax
mov edi, esi
add esi, ecx
add esi, 0xfffff000
xor edx, edx
nop word cs:[eax + eax]
nop dword [eax]
movzx ebx, byte [ebp + edx - 0x90]
test bl, bl
je 0x48a8fe
mov byte [esi + edx + 0x1000], bl
add edx, 1
cmp eax, edx
jne 0x48a8e0
add ecx, edi
jmp 0x48a904
add ecx, edi
cmp eax, edx
jne 0x48a90b
add ecx, edx
add ecx, 0xffffffff
jmp 0x48a90d
add ecx, edx
mov byte [ecx], 0
cmp byte [ebp - 0x1110], 0
jne 0x48a93d
mov dword [ebp - 0x1110], 0x3264694d
mov dword [ebp - 0x110c], 0x6c696146
mov word [ebp - 0x1108], 0x6465
mov byte [ebp - 0x1106], 0
lea ecx, [ebp - 0x1110]
mov edx, dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.0048a1d0
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517c1a
add esp, 0x110c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jle 0x48a9ad
lea esi, [ebx - 1]
cmp esi, 0x7ffffffd
mov edx, 0x7ffffffd
cmovb edx, esi
sub esi, edx
add edx, 1
xor ecx, ecx
nop word cs:[eax + eax]
nop
movzx eax, byte [ebp + ecx - 0x90]
test al, al
je 0x48a9bb
mov byte [edi + ecx], al
add ebx, 0xffffffff
add ecx, 1
cmp edx, ecx
jne 0x48a990
add ecx, edi
jmp 0x48a9bf
je 0x48a70c
mov byte [edi], 0
jmp 0x48a70c
add ecx, edi
mov esi, ebx
lea eax, [ecx - 1]
test esi, esi
cmovne eax, ecx
mov byte [eax], 0
lea esi, [ebp - 0x1110]
jne 0x48a951
jmp 0x48a70c