Function at 0x4d0d88
Capabilities:
Set registry value

Disassembly:
push 0x320
mov eax, 0x5536eb
call fcn.00513ea1
push 0x45
pop ecx
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x124]
mov esi, str.QV0QeXUIWTvhGdZR1Q2JzgJnGfNkTRGIAVQUjTXy5g3lZXFZSCPnB81UAnbSEF7H0JRjJC3vRWLNqMcSSI95lFo1PuOm2apYxyoFf6hgrNOASovYkkBNK7njGZ7c5oSG393WmcpoEylgfPrZvOmJXGfVH7eMI6YDfLXN0YuyFKq6UG2KEyI6396w3A56PE7n6Q98mcvyVFw0aJH3Uj9mSOFmHjTHQYyeY4Sd3W2ZiWilpELqfA9YRCXy1WIb5uougrBDPC0H1VnUw8sSxsb
mov ebx, dword [ebp + 0x14]
rep movsd dword es:[edi], dword [esi]
push 0x72
pop ecx
mov esi, str.9JE9p3YEulXw2gsotAGnJVRck7eVJH4BQSekgtUMsBBGUfIG4fVcyoLKJJLLvo66BcIPge3MTaWAUCAV1gaen0iIk8x2vtqwxYcMHKLeiVf1ifUTHIF5kyYofskBRzJ11z2neubYcB9ISKJ7zRJ5XZ3GEeROlK4yaEXSngmnvILuo8Il1STyi9ern6Ori5hmqCHFK4Pp02DkkHuDyRUvXdtwUKZmetpzUWaJTEkao5onhLss8Pjbu7IF3BnyHbxZngCHOwAkhopht0kU9o2HJ2M2BH49wua62RpprmIZE03FF81r1gvZ2iNcf26YlKuagT88H5o4c7HwOiOLjtHk415H7ZRVcQQaBAl1Bl3fSpbvoBVCWREo5ZcJ0lBQvLT8nNAcBimI558kOlHXMX6tQcYQZqlGYLZnP2IH0JYYf3TAy5pqs7cOuvV2LxPsstYjPpY37uSw3P
mov dword [ebp - 0x318], eax
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x2f0]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x320], eax
xor eax, eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x324], eax
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x308]
lea eax, [ebp - 0x124]
push eax
call fcn.004057d0
lea eax, [ebp - 0x308]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x32c]
call fcn.00408170
push 0
push 1
lea ecx, [ebp - 0x308]
mov byte [ebp - 4], 0
call fcn.004096c0
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x308]
call fcn.004057d0
lea eax, [ebp - 0x308]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x32c]
call fcn.00408170
push 0
push 1
lea ecx, [ebp - 0x308]
call fcn.004096c0
lea eax, [ebp - 0x314]
xor ecx, ecx
push eax
mov edi, 0xf013f
mov dword [ebp - 0x314], ecx
push edi
push ecx
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x310], ecx
mov dword [ebp - 0x30c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4d0f4b
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x310]
xor ecx, ecx
push ecx
push eax
push ecx
push edi
push ecx
push ecx
push ecx
push dword [ebp - 0x318]
push dword [ebp - 0x314]
call esi
test eax, eax
je 0x4d0ed0
push dword [ebp - 0x314]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d0f4b
xor ecx, ecx
lea eax, [ebp - 0x30c]
push ecx
push eax
push ecx
push edi
push ecx
push ecx
push ecx
push dword [ebp - 0x31c]
push dword [ebp - 0x310]
call esi
test eax, eax
je 0x4d0f07
push dword [ebp - 0x310]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x30c]
jmp 0x4d0f49
push ebx
call fcn.00500d29
pop ecx
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push dword [ebp - 0x320]
push dword [ebp - 0x30c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x30c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x310]
call esi
push dword [ebp - 0x314]
call esi
lea ecx, [ebp - 0x32c]
call fcn.0047920e
call fcn.00513e4b
ret