Function at 0x48a810
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3118
call fcn.004a9b70
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x85b]
push ebx
push eax
mov byte [ebp - 0x85c], bl
call fcn.004a3190
add esp, 0xc
mov dword [ebp - 0x30f8], 0x104
mov dword [ebp - 0x30e4], ebx
cmp dword [0x4d2afc], ebx
je 0x48a88b
mov ecx, dword [0x4c6444]
mov edx, dword [0x4c6448]
mov dword [ebp - 0x30e8], ecx
mov dword [ebp - 0x30f4], edx
mov dword [0x4c6444], 0x20019
mov dword [0x4c6448], 0x20006
cmp dword [0x4cd38c], ebx
je 0x48a898
call fcn.0048fcc0
push 0x80
lea edx, [ebp - 0x8dc]
mov ecx, 0x2da
mov dword [0x4cd38c], ebx
call fcn.00499890
add esp, 4
push str.SYSTEMCurrentControlSetServices
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x24c]
call fcn.00401000
mov ecx, dword [0x4c6444]
lea eax, [ebp - 0x30e0]
push eax
push ecx
push ebx
lea edx, [ebp - 0x24c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x48accd
lea eax, [ebp - 0x3118]
push eax
lea ecx, [ebp - 0x3110]
push ecx
lea edx, [ebp - 0x3108]
push edx
lea eax, [ebp - 0x3100]
push eax
lea ecx, [ebp - 0x3104]
push ecx
lea edx, [ebp - 0x310c]
push edx
lea eax, [ebp - 0x30fc]
push eax
lea ecx, [ebp - 0x30e4]
push ecx
mov ecx, dword [ebp - 0x30e0]
push ebx
lea edx, [ebp - 0x30f8]
push edx
lea eax, [ebp - 0x85c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x30e4], ebx
je 0x48accd
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x30f0], ebx
mov dword [ebp - 0x30ec], ebx
mov esi, dword [ebp - 0x30f0]
mov eax, dword [ebp - 0x30e0]
push 0xff
lea edx, [ebp - 0x44c]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, dword [ebp - 0x30ec]
mov edx, ecx
inc esi
inc ecx
mov dword [ebp - 0x30f0], esi
mov dword [ebp - 0x30ec], ecx
cmp edx, dword [ebp - 0x30e4]
ja 0x48acb7
cmp eax, 0x103
je 0x48acb7
test eax, eax
jne 0x48a96b
lea eax, [ebp - 0x44c]
push eax
call edi
test eax, eax
je 0x48a96b
push str.SYSTEMCurrentControlSetServices_
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x24c]
call fcn.00401000
mov edx, 0x200
lea eax, [ebp - 0x24c]
mov edi, edi
cmp byte [eax], 0
je 0x48a9fb
inc eax
dec edx
jne 0x48a9f0
jmp 0x48aa25
test edx, edx
je 0x48aa25
mov ecx, 0x200
sub ecx, edx
lea edx, [ebp - 0x44c]
mov eax, 0x200
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x24c]
mov edx, 0x7fffffff
call fcn.00401000
push 0x200
lea eax, [ebp - 0x24c]
push str.ImagePath
push eax
lea ecx, [ebp - 0x64c]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
lea ecx, [ebp - 0x64c]
push ecx
call edi
test eax, eax
jle 0x48a96b
cmp dword [ebp + 8], 0
mov esi, 0x2bc
jne 0x48ac8e
lea edx, [ebp - 0xcdc]
push edx
lea ebx, [ebp - 0x44c]
call fcn.00491910
add esp, 4
test eax, eax
jne 0x48aaa4
push 0x200
lea eax, [ebp - 0x24c]
push str.DisplayName
push eax
mov ecx, ebx
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
jmp 0x48aac0
lea ecx, [ebp - 0xcdc]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x44c]
call fcn.00401000
push 0x1000
lea edx, [ebp - 0x24c]
push str.Description
push edx
lea ecx, [ebp - 0x1cdc]
mov edx, 0x80000002
call fcn.0048e050
lea eax, [ebp - 0x4c]
add esp, 0xc
push eax
lea ecx, [ebp - 0x24c]
call fcn.004919b0
add esp, 4
test eax, eax
jne 0x48ab0c
push 0x40
lea edx, [ebp - 0x4c]
mov ecx, 0x268
call fcn.00499890
add esp, 4
mov edx, str..exe
lea ecx, [ebp - 0x64c]
call fcn.0047dee0
test eax, eax
jne 0x48ab38
mov edx, str.svchost
lea ecx, [ebp - 0x64c]
call fcn.0047dee0
test eax, eax
je 0x48a96b
mov edx, str.svchost
lea ecx, [ebp - 0x64c]
call fcn.0047dee0
test eax, eax
je 0x48abe0
mov esi, 0x2bd
mov eax, 0x200
lea ecx, [ebp - 0x24c]
cmp byte [ecx], 0
je 0x48ab6b
inc ecx
dec eax
jne 0x48ab60
jmp 0x48ab93
test eax, eax
je 0x48ab93
mov ecx, 0x200
sub ecx, eax
mov eax, 0x200
sub eax, ecx
push str.Parameters
lea ecx, [ebp + ecx - 0x24c]
mov edx, 0x7fffffff
call fcn.00401000
push 0x200
lea ecx, [ebp - 0x24c]
push str.ServiceDll
push ecx
lea ecx, [ebp - 0xadc]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
lea edx, [ebp - 0xadc]
push edx
call edi
test eax, eax
je 0x48abe0
lea eax, [ebp - 0xadc]
push eax
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x64c]
call fcn.00401000
cmp dword [0x4d2a8c], 0
jle 0x48ac67
lea ecx, [ebp - 0x754]
push ecx
lea ecx, [ebp - 0x64c]
call fcn.0047f1b0
add esp, 4
push 0x1400
lea edx, [ebp - 0x30dc]
push 0
push edx
call fcn.004a3190
lea eax, [ebp - 0x754]
add esp, 0xc
push eax
lea ecx, [ebp - 0x30dc]
call fcn.0048e9d0
add esp, 4
mov edx, 0x4b1938
lea ecx, [ebp - 0x28dc]
call fcn.0047dee0
test eax, eax
jne 0x48a96b
push eax
push esi
lea ecx, [ebp - 0x1cdc]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea edx, [ebp - 0x754]
lea ecx, [ebp - 0x44c]
call fcn.0048f730
add esp, 0x10
jmp 0x48a96b
push 0
push esi
lea eax, [ebp - 0x1cdc]
push eax
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x64c]
lea ecx, [ebp - 0x44c]
call fcn.0048f730
add esp, 0x10
jmp 0x48a96b
push 0
push 0x2bc
push 0x4b17de
push 0x4b17de
mov edx, 0x4b17de
lea ecx, [ebp - 0x44c]
call fcn.0048f730
add esp, 0x10
jmp 0x48a96b
mov edx, dword [ebp - 0x30e0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4d2afc], 0
jmp 0x48ace0
mov edx, dword [ebp - 0x30e0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4d2afc], ebx
je 0x48acf9
mov eax, dword [ebp - 0x30e8]
mov ecx, dword [ebp - 0x30f4]
mov dword [0x4c6444], eax
mov dword [0x4c6448], ecx
mov ecx, dword [ebp - 8]
mov eax, dword [0x4cd38c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret