Function at 0x4f7790
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a34c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdbc
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x63c]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
je 0x4f77e2
mov eax, dword [ebx + 0x408]
push edi
push edi
push eax
lea ecx, [ebx + 0x20]
call fcn.004feee0
mov dword [ebx + 0x63c], edi
cmp dword [ebx + 0x778], edi
je 0x4f77f4
mov dword [ebx + 0x768], 0x7540
cmp dword [ebx + 0x768], 0x7573
jne 0x4f7830
push 3
mov ecx, ebx
call fcn.004f9050
lea ecx, [ebx + 0x42c]
mov dword [ebx + 8], edi
mov dword [ebx + 0x768], edi
call fcn.004c97e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
mov ecx, ebx
call fcn.004f9050
cmp dword [ebx + 0x778], edi
je 0x4f7872
mov ecx, dword [ebx + 0x408]
mov edx, dword [0x5bb508]
mov eax, dword [ebx + 0x768]
push 1
push ecx
push edx
push eax
lea ecx, [ebx + 0x20]
call fcn.004fdd80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x768]
cmp eax, 0x754b
jg 0x4f7db3
cmp eax, 0x754a
jge 0x4f7d85
cmp eax, 0x274c
jg 0x4f7b52
je 0x4f7c94
cmp eax, 0x271d
jg 0x4f7a4f
je 0x4f7a21
cmp eax, 0xffffffff
jg 0x4f7953
je 0x4f792e
cmp eax, 0x80090304
je case.0x4f7dc9.30030
cmp eax, 0x8009030e
je case.0x4f7dc9.30030
cmp eax, 0xfffffffc
je case.0x4f7dc9.30030
mov edx, dword [0x5bb760]
lea ecx, [ebx + 0x430]
push ecx
lea eax, [ebp - 0xdc8]
push edx
push eax
call fcn.0051d0e8
add esp, 0xc
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4f7911
push 0
push 0x13c7
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [ebx + 0x42c]
test edi, edi
je 0x4f8399
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x4f839b
mov eax, dword [0x5bb764]
lea ecx, [ebx + 0x798]
lea edx, [ebx + 0x430]
push ecx
push edx
lea ecx, [ebp - 0xdc8]
push eax
push ecx
call fcn.0051d0e8
add esp, 0x10
jmp 0x4f78f7
cmp eax, 5
je 0x4f79f3
cmp eax, 0x70
jne case.0x4f7dc9.30045
mov edx, dword [0x5b5ecc]
mov dword [ebp + 0xc], edx
push edi
lea eax, [ebp - 0x14]
push edi
push eax
push 0x400
push 0x70
push edi
push 0x1100
mov byte [ebp - 4], 0x16
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [ebp - 0x14]
lea edx, [ebp + 0xc]
push ecx
push 0x597ddc
push edx
call fcn.0053091a
mov eax, dword [ebp - 0x14]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebx + 0x42c]
call fcn.004c9920
mov edi, dword [0x5bb758]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 4], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp + 0xc]
call fcn.00537b04
jmp 0x4f78f7
mov edi, dword [0x5bb0b4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb74c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
add eax, 0xffffd8d8
cmp eax, 0x1e
ja case.0x4f7dc9.30045
xor ecx, ecx
mov cl, byte [eax + 0x4f8684]
jmp dword [ecx*4 + 0x4f8668]
mov edi, dword [0x5bb748]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb744]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb734]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb730]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb72c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
cmp eax, 0x7533
jg 0x4f7cc2
cmp eax, 0x7532
jge 0x4f7c94
cmp eax, 0x2af9
jg 0x4f7c52
je 0x4f7c1d
sub eax, 0x274d
je 0x4f7be8
sub eax, 3
je 0x4f7bba
dec eax
jne case.0x4f7dc9.30045
mov edi, dword [0x5bb738]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb740]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb750]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 0x348], 1
jmp 0x4f78f7
mov edi, dword [0x5bb73c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 0x348], 1
jmp 0x4f78f7
sub eax, 0x2afa
je case.0x4f7dc9.30030
sub eax, 2
jne case.0x4f7dc9.30045
mov ecx, dword [0x5bafb8]
mov edx, dword [0x5bb538]
push ecx
push edx
lea eax, [ebp - 0xdc8]
push str._s_r_n_r_n_s
push eax
call fcn.0051d0e8
add esp, 0x10
mov byte [ebx + 0x348], 1
jmp 0x4f78f7
mov edi, dword [0x5bb4ec]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
add eax, 0xffff8ac7
cmp eax, 0xf
ja case.0x4f7dc9.30045
xor ecx, ecx
mov cl, byte [eax + 0x4f86bc]
jmp dword [ecx*4 + 0x4f86a4]
push 2
mov ecx, ebx
call fcn.004f9050
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [0x5bb728]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb754]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb75c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb6c0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
add eax, 0xffff8ab4
cmp eax, 0x2b
ja case.0x4f7dc9.30045
xor ecx, ecx
mov cl, byte [eax + 0x4f8714]
jmp dword [ecx*4 + 0x4f86cc]
cmp dword [ebx + 8], edi
jne 0x4f80b6
cmp dword [ebx + 4], edi
jne 0x4f80b6
mov al, byte [ebp + 8]
test al, al
je 0x4f80b6
mov eax, dword [ebx + 0x428]
cmp eax, edi
je 0x4f7e0d
mov edx, dword [eax + 0x1c]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4f7e0d
mov esi, dword [ebx + 0x428]
jmp 0x4f7e0f
xor esi, esi
mov eax, dword [ebx + 0x44]
cmp eax, edi
jne 0x4f7e1d
mov eax, str.ftp:__
jmp 0x4f7e38
cmp eax, 1
jne 0x4f7e29
mov eax, str.http:__
jmp 0x4f7e38
cmp eax, 3
mov eax, str.mms:__
je 0x4f7e38
mov eax, str.https:__
push eax
lea ecx, [ebp - 0x14]
call fcn.00537b72
mov eax, dword [ebx + 0x20c]
mov ecx, dword [ebp - 0x14]
lea edi, [ebx + 0x20]
push esi
push eax
mov byte [ebp - 4], 1
mov eax, dword [edi]
push eax
push ecx
lea ecx, [ebp - 0x18c]
call fcn.00486860
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 2
call fcn.00533ae5
cmp eax, 1
jne 0x4f8026
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4f7e94
push 0
push 0x138a
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
push edx
push eax
mov ecx, ebx
mov dword [ebx + 0x14], 0
call fcn.004f9320
mov eax, dword [ebx + 0x408]
test eax, eax
je 0x4f7f12
mov ecx, dword [ebx + 0x3c8]
test ecx, ecx
jne 0x4f7ec6
push eax
mov ecx, edi
call fcn.004ffed0
mov esi, dword [ebx + 0x3c8]
test esi, esi
je 0x4f7f12
mov edx, dword [ebp - 0x40]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
push 0x5a5d74
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call esi
mov edx, dword [ebp - 0x3c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebx + 0x3c8]
push edx
push 1
push eax
push 0x5a5d68
push ecx
call esi
mov edx, dword [0x5b5ecc]
mov dword [ebp + 8], edx
mov eax, dword [ebx + 0x768]
mov ecx, dword [0x5bb76c]
push eax
push ecx
lea edx, [ebp + 8]
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
push edx
mov byte [ebp - 4], 3
call fcn.0053091a
mov eax, dword [ebp + 8]
add esp, 0x10
lea ecx, [ebx + 0x42c]
push eax
call fcn.004c96f0
mov al, byte [ebp + 0xc]
test al, al
je 0x4f7f77
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4f7f77
mov ebx, dword [ebx + 0x408]
test ebx, ebx
je 0x4f7f77
push ebx
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00537b04
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xc
call fcn.00537b04
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.00537b04
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xa
call fcn.00537b04
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 9
call fcn.00537b04
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 8
call fcn.00537b04
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 7
call fcn.0053f876
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 6
call fcn.0053f8dc
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 5
call fcn.0053f9c6
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 4
call fcn.0053f83e
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 1
call fcn.00533726
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00537b04
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x15
call fcn.00537b04
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x14
call fcn.00537b04
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x13
call fcn.00537b04
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x12
call fcn.00537b04
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x11
call fcn.00537b04
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x10
call fcn.0053f876
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0xf
call fcn.0053f8dc
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0xe
call fcn.0053f9c6
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0xd
call fcn.0053f83e
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 1
call fcn.00533726
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00537b04
mov edi, dword [0x5bb76c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb768]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb520]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb6bc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb6b8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb770]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb554]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb500]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb490]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb4f8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb440]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb4f0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edx, dword [ebx + 0x41c]
mov eax, dword [ebx + 0x418]
lea ecx, [ebp - 0x2c]
push ecx
push edx
push eax
mov ecx, ebx
call fcn.004fb4a0
mov ecx, dword [ebx + 0x54]
mov edx, dword [ebx + 0x41c]
mov eax, dword [ebx + 0x418]
push ecx
push edx
mov edx, dword [ebx + 0x28]
lea ecx, [ebp - 0x2c]
push eax
mov eax, dword [0x5bb534]
push ecx
push edx
lea ecx, [ebp - 0xdc8]
push eax
push ecx
call fcn.0051d0e8
add esp, 0x1c
jmp 0x4f78f7
mov edi, dword [0x5bac9c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edi, dword [0x5bb758]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4f78f7
mov edx, dword [0x5bafac]
lea ecx, [ebx + 0x430]
push ecx
jmp 0x4f78e7
xor ecx, ecx
add ecx, 0xb2b
push ecx
call fcn.005380a1
mov esi, eax
mov eax, dword [ebx + 0x42c]
add esp, 4
mov edi, eax
test eax, eax
jne 0x4f83bd
mov edi, 0x5ba440
test eax, eax
je 0x4f83c8
mov eax, dword [0x5bb1cc]
jmp 0x4f83de
push 0x5ba440
lea ecx, [ebp + 0xc]
call fcn.00537b72
mov eax, dword [eax]
mov dword [ebp - 0x18], 1
push edi
lea ecx, [ebp - 0xdc8]
push eax
push ecx
push str._s_n_n_s_s
push esi
call fcn.0051d0e8
mov al, byte [ebp - 0x18]
add esp, 0x14
test al, 1
je 0x4f8404
lea ecx, [ebp + 0xc]
call fcn.00537b04
mov edx, dword [ebx + 0x408]
mov eax, dword [ebx + 0x768]
push 0
push edx
push esi
push eax
lea ecx, [ebx + 0x20]
call fcn.004fdd80
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4f84c3
mov eax, dword [ebx + 4]
test eax, eax
jne 0x4f84c3
mov al, byte [ebp + 8]
test al, al
je 0x4f84c3
mov eax, dword [ebx + 0x408]
test eax, eax
je 0x4f84c3
mov eax, dword [ebx + 0x768]
cmp eax, 0x7553
jne 0x4f848f
mov ecx, dword [ebx + 0x28]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x10024
push ecx
push esi
push 0
call edi
cmp eax, 6
jne 0x4f84c9
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4f84c9
mov edx, dword [ebx + 0x408]
push edx
push 0x13bb
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4f84c9
cmp eax, 0xffffffff
je 0x4f84a0
cmp eax, 0x753b
mov eax, 0x30
jne 0x4f84a5
mov eax, 0x10
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x4f84af
mov ecx, dword [ebx + 0x28]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0x50000
push eax
push ecx
push esi
push 0
call edi
jmp 0x4f84c9
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebx + 4]
test eax, eax
je 0x4f85ea
cmp eax, 3
jne 0x4f84e5
cmp dword [ebx + 0x768], 0x756e
je 0x4f8534
mov cl, byte [ebp + 8]
test cl, cl
je 0x4f8534
mov eax, dword [ebx + 0x768]
cmp eax, 0xffffffff
jne 0x4f8510
mov eax, dword [0x5bb504]
push 0x50010
push 0x597f08
push eax
push 0
call edi
jmp 0x4f85ea
sub eax, 0x753b
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x10
or eax, 0x50000
push eax
push 0x597f08
push esi
push 0
call edi
jmp 0x4f85ea
cmp eax, 4
jne 0x4f85ea
mov al, byte [ebx + 0x348]
test al, al
je 0x4f85ea
mov eax, dword [0x5ba8bc]
lea ecx, [ebp - 0x18]
lea edx, [ebp + 0x10]
push ecx
push edx
push 0
push 0
push str.bHDIShwd
push eax
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4f85ea
mov edx, dword [0x5ba8bc]
lea ecx, [ebp + 0x10]
push 4
push ecx
push 4
push 0
push str.bHDIShwd
push edx
mov dword [ebp + 0x10], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.00534401
push eax
lea ecx, [ebp - 0x2a0]
call fcn.004ab160
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0x17
call fcn.00533ae5
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x19
call fcn.00486480
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 0x18
call fcn.0053f83e
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0
call fcn.00533726
lea edi, [ebx + 0x42c]
push esi
mov ecx, edi
mov byte [ebx + 0x348], 0
call fcn.004c96f0
mov eax, dword [ebx + 0x768]
lea ecx, [ebp - 0x1cc]
push eax
push str._r_ndownlResult___ld_r_n
push ecx
call fcn.0051d0e8
add esp, 0xc
lea edx, [ebp - 0x1cc]
mov ecx, edi
push edx
call fcn.004c96f0
push esi
mov byte [ebp - 4], 0x1a
call fcn.005380ca
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc