Function at 0x48a360
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0928
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x512f18]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0049eef3
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x48a3a7
push 0x80004005
call fcn.00421000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, str.RegistryMACHINESOFTWAREClasses_
mov byte [ebp - 4], 1
test ecx, 0xffff0000
jne 0x48a3e2
mov edx, ecx
movzx esi, dx
push esi
call fcn.004a6e27
cmp eax, edi
je 0x48a3fd
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.00423ccc
jmp 0x48a3fd
push str.RegistryMACHINESOFTWAREClasses_
call fcn.004ad5da
add esp, 4
push eax
push str.RegistryMACHINESOFTWAREClasses_
lea ecx, [ebp - 0x14]
call fcn.0042424f
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea ebx, [ecx + eax + 4]
mov byte [ebp - 4], 2
mov edx, 0x6b6e
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x44], ebx
cmp word [ebx], dx
jne 0x48aaa6
call fcn.0049eef3
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x48a439
push 0x80004005
call fcn.00421000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 3
test byte [ebx + 2], 0x20
movzx esi, word [ebx + 0x48]
je 0x48a48f
call fcn.0049eef3
push eax
push esi
lea ecx, [ebx + 0x4c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0048aeb0
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x34]
push esi
lea ecx, [ebp - 0x10]
call fcn.0042b1c0
lea eax, [esi - 0x10]
mov byte [ebp - 4], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x48a4cb
shr esi, 1
call fcn.0049eef3
push eax
push esi
lea ecx, [ebx + 0x4c]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00424169
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.00423d5a
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48a4d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp + 0x18], edi
jle 0x48a567
push ecx
mov ecx, esp
mov dword [ebp - 0x40], esp
push 0x4dcf70
call fcn.00423607
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x3c], esp
mov esi, esp
push eax
call fcn.004242c0
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 7
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 0x38], esp
mov esi, esp
push eax
call fcn.004242c0
add eax, 0x10
mov dword [esi], eax
add esp, 4
lea edi, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.004645d0
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 8
call fcn.00423d5a
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48a567
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 0x14]
cmp eax, 2
jne 0x48a59e
mov ecx, dword [ebp + 0xc]
push ebx
push ecx
call fcn.0048a0f0
add esp, 8
test eax, eax
je 0x48a589
mov edx, dword [ebp + 0x1c]
mov dword [edx], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.RegDatFileWalker:_all_good
call fcn.00423607
jmp 0x48aa7b
mov esi, dword [ebp + 0x24]
cmp eax, 1
jne 0x48a5cf
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x20]
push 0
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x48a980
xor edi, edi
mov dword [ebp - 0x34], edi
cmp dword [ebx + 0x24], edi
jbe 0x48a972
jmp 0x48a5e3
mov esi, dword [ebp + 0x24]
mov ecx, dword [ebp + 0xc]
test esi, esi
je 0x48a5fe
push 0
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x48a972
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx + 0x28]
lea eax, [edx + edi*4 + 4]
mov edx, dword [eax + ecx]
lea edi, [edx + ecx + 4]
mov eax, 0x6b76
cmp word [edi], ax
jne 0x48a95f
test dword [edi + 4], 0x80000000
mov edx, dword [edi + 8]
lea eax, [edi + 8]
lea ebx, [edx + ecx + 4]
mov dword [ebp - 0x20], ebx
je 0x48a635
mov ebx, eax
mov dword [ebp - 0x20], eax
call fcn.0049eef3
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x48a39d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 9
test byte [edi + 0x10], 1
movzx esi, word [edi + 2]
je 0x48a69f
call fcn.0049eef3
push eax
push esi
lea ecx, [edi + 0x14]
push ecx
lea ecx, [ebp - 0x38]
call fcn.0048aeb0
mov byte [ebp - 4], 0xa
mov esi, dword [ebp - 0x38]
push esi
lea ecx, [ebp - 0x1c]
call fcn.0042b1c0
lea eax, [esi - 0x10]
mov byte [ebp - 4], 9
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x48a6db
shr esi, 1
call fcn.0049eef3
push eax
push esi
lea ecx, [edi + 0x14]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00424169
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.00423d5a
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48a6e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [edi + 4]
mov ecx, dword [edi + 0xc]
and esi, 0xfffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], 0
cmp esi, 0x3fd8
jbe 0x48a7a2
mov edx, 0x6264
cmp word [ebx], dx
jne 0x48a7a2
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0xc]
lea edx, [eax + ecx + 4]
push esi
mov dword [ebp - 0x3c], edx
call fcn.004ade42
mov dword [ebp - 0x18], eax
xor eax, eax
add esp, 4
xor edi, edi
cmp ax, word [ebx + 2]
jae 0x48a79f
movzx eax, di
mov ecx, eax
imul ecx, ecx, 0x3fd8
cmp ecx, esi
jae 0x48a79f
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp + 0xc]
lea ebx, [eax + edx + 4]
lea eax, [ecx + 0x3fd8]
cmp eax, esi
jae 0x48a767
mov eax, 0x3fd8
jmp 0x48a785
mov eax, 0xa0643f
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0xd
mov edx, eax
imul edx, edx, 0x3fd8
mov eax, esi
sub eax, edx
push eax
mov eax, dword [ebp - 0x18]
add ecx, eax
push ebx
push ecx
call fcn.004ad860
mov ecx, dword [ebp - 0x20]
inc edi
add esp, 0xc
cmp di, word [ecx + 2]
jb 0x48a73a
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp - 0x1c]
cmp eax, 1
jne 0x48a819
mov edx, dword [ebp - 0x28]
push esi
mov esi, dword [ebp - 0x30]
push ebx
push esi
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x48a7eb
push ecx
mov ecx, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x3c], esp
push edi
push ecx
push esi
push str.Preparing_RegValue__d_:__s:__s
push eax
call fcn.00464a80
add esp, 0x14
call fcn.00489dd0
add esp, 4
jmp 0x48a92f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
mov edx, esp
mov dword [ebp - 0x3c], esp
push eax
mov eax, dword [ebp + 8]
push edi
push eax
push esi
push str._Failed_setting_RegValue__d_:__s:__s__LE_d
push edx
call fcn.00464a80
add esp, 0x18
call fcn.00489dd0
add esp, 4
jmp 0x48a92f
test eax, eax
jne 0x48a92f
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x30]
push edi
push ecx
push edx
lea eax, [ebp - 0x24]
push str.__.2d___ws:__ws
push eax
call fcn.00464a80
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x40]
push 0x4dd468
push edx
mov byte [ebp - 4], 0xd
call fcn.004238ab
add esp, 0x20
mov byte [ebp - 4], 0xe
mov esi, dword [eax]
call fcn.0049eef3
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x48a39d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0xf
test esi, esi
je 0x48a8a3
test esi, 0xffff0000
jne 0x48a8a3
movzx esi, si
push esi
call fcn.004a6e27
test eax, eax
je 0x48a8ac
push esi
push eax
lea ecx, [ebp - 0x20]
call fcn.0042511b
jmp 0x48a8ac
push esi
lea ecx, [ebp - 0x20]
call fcn.00424ff3
mov byte [ebp - 4], 0xe
mov esi, dword [ebp - 0x20]
push esi
call fcn.004b2c44
lea eax, [esi - 0x10]
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48a8d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48a8fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x24]
push ecx
push str.RegDump
call fcn.00462e80
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48a92f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x48a93f
push eax
call fcn.004add25
add esp, 4
lea eax, [edi - 0x10]
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48a95f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x44]
inc edi
mov dword [ebp - 0x34], edi
cmp edi, dword [ebx + 0x24]
jb 0x48a5e0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x48a980
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebx + 0x14], 0
jbe 0x48aa83
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebp + 0xc]
lea eax, [ecx + edx + 4]
xor ecx, ecx
mov dword [ebp - 0x24], eax
xor edi, edi
cmp cx, word [eax + 2]
jae 0x48aa83
mov ebx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
je 0x48a9c3
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x48aa43
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax]
mov edx, 0x666c
cmp cx, dx
je 0x48a9f4
mov edx, 0x686c
cmp cx, dx
je 0x48a9f4
mov edx, 0x6972
cmp cx, dx
je 0x48a9ee
mov edx, 0x696c
cmp cx, dx
jne 0x48aa5c
mov eax, dword [eax + edi*4 + 4]
jmp 0x48a9f8
mov eax, dword [eax + edi*8 + 4]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
push ecx
mov ecx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push ebx
inc ecx
push ecx
push edx
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x44], esp
mov esi, esp
push eax
call fcn.004242c0
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0048a360
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + 2]
inc edi
add esp, 0x20
cmp edi, ecx
jl 0x48a9a8
jmp 0x48aa83
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x48aa9a
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x24]
sub ecx, dword [ebp + 0xc]
push ecx
mov edx, esp
mov dword [ebp - 0x44], esp
push ecx
push eax
push str._Invalid_block:__s__offset_u
push edx
call fcn.00464a80
add esp, 0x10
call fcn.00489dd0
add esp, 4
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48aaa6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48aac9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48aaef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret