Function at 0x501190
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56560c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdbc
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x654]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
je 0x5011e2
mov eax, dword [ebx + 0x420]
push edi
push edi
push eax
lea ecx, [ebx + 0x20]
call fcn.00509200
mov dword [ebx + 0x654], edi
cmp dword [ebx + 0x790], edi
je 0x5011f4
mov dword [ebx + 0x780], 0x7540
cmp dword [ebx + 0x780], 0x7573
jne 0x501227
push 3
mov ecx, ebx
call fcn.00502b50
lea ecx, [ebx + 0x444]
call fcn.004d1db0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
mov ecx, ebx
call fcn.00502b50
cmp dword [ebx + 0x790], edi
je 0x501279
mov ecx, dword [ebx + 0x420]
mov edx, dword [0x5c8160]
mov eax, dword [ebx + 0x780]
push 1
push ecx
push edx
push eax
lea ecx, [ebx + 0x20]
call fcn.00508060
push str.Cancel_by_user._n
lea ecx, [ebx + 0x444]
call fcn.004d1cc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x780]
cmp eax, 0x754b
jg 0x501808
cmp eax, 0x754a
jge 0x5017da
cmp eax, 0x274c
jg 0x501597
je 0x5016d9
cmp eax, 0x271d
jg 0x501494
je 0x50145f
cmp eax, 0xffffffff
jg 0x50135a
je 0x501335
cmp eax, 0x80090304
je case.0x50181e.30030
cmp eax, 0x8009030e
je case.0x50181e.30030
cmp eax, 0xfffffffc
je case.0x50181e.30030
mov edx, dword [0x5c83b8]
lea ecx, [ebx + 0x448]
push ecx
lea eax, [ebp - 0xdc8]
push edx
push eax
call fcn.00527718
add esp, 0xc
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x501318
push 0
push 0x13c7
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [ebx + 0x444]
test edi, edi
je 0x501e1c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x501e1e
mov eax, dword [0x5c83bc]
lea ecx, [ebx + 0x7b8]
lea edx, [ebx + 0x448]
push ecx
push edx
lea ecx, [ebp - 0xdc8]
push eax
push ecx
call fcn.00527718
add esp, 0x10
jmp 0x5012fe
cmp eax, 5
je 0x501431
cmp eax, 0x17
je 0x501403
cmp eax, 0x70
jne case.0x50181e.30046
mov edx, dword [0x5c2a74]
mov dword [ebp + 0xc], edx
push edi
lea eax, [ebp - 0x14]
push edi
push eax
push 0x400
push 0x70
push edi
push 0x1100
mov byte [ebp - 4], 0x16
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov ecx, dword [ebp - 0x14]
lea edx, [ebp + 0xc]
push ecx
push 0x5a3e24
push edx
call fcn.0053afda
mov eax, dword [ebp - 0x14]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebx + 0x444]
call fcn.004d1ef0
mov edi, dword [0x5c83b0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 4], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp + 0xc]
call fcn.005421be
jmp 0x5012fe
mov edi, dword [0x5c7898]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c7d0c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c83a4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 0x361], 1
jmp 0x5012fe
add eax, 0xffffd8d8
cmp eax, 0x1e
ja case.0x50181e.30046
xor ecx, ecx
mov cl, byte [eax + 0x50216c]
jmp dword [ecx*4 + 0x502150]
mov edi, dword [0x5c83a0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c839c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c838c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c8388]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c8384]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
cmp eax, 0x7533
jg 0x501707
cmp eax, 0x7532
jge 0x5016d9
cmp eax, 0x2af9
jg 0x501697
je 0x501662
sub eax, 0x274d
je 0x50162d
sub eax, 3
je 0x5015ff
dec eax
jne case.0x50181e.30046
mov edi, dword [0x5c8390]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c8398]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c83a8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 0x361], 1
jmp 0x5012fe
mov edi, dword [0x5c8394]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebx + 0x361], 1
jmp 0x5012fe
sub eax, 0x2afa
je case.0x50181e.30030
sub eax, 2
jne case.0x50181e.30046
mov ecx, dword [0x5c7c10]
mov edx, dword [0x5c8190]
push ecx
push edx
lea eax, [ebp - 0xdc8]
push str._s_r_n_r_n_s
push eax
call fcn.00527718
add esp, 0x10
mov byte [ebx + 0x361], 1
jmp 0x5012fe
mov edi, dword [0x5c8144]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
add eax, 0xffff8ac7
cmp eax, 0xf
ja case.0x50181e.30046
xor ecx, ecx
mov cl, byte [eax + 0x5021a4]
jmp dword [ecx*4 + 0x50218c]
push str.Cancel_by_user._n
lea ecx, [ebx + 0x444]
call fcn.004d1cc0
push 2
mov ecx, ebx
call fcn.00502b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [0x5c8380]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c83ac]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c83b4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c8318]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
add eax, 0xffff8ab4
cmp eax, 0x2c
ja case.0x50181e.30046
xor ecx, ecx
mov cl, byte [eax + 0x502200]
jmp dword [ecx*4 + 0x5021b4]
cmp dword [ebx + 8], edi
jne 0x501b0b
cmp dword [ebx + 4], edi
jne 0x501b0b
mov al, byte [ebp + 8]
test al, al
je 0x501b0b
mov eax, dword [ebx + 0x440]
cmp eax, edi
je 0x501862
mov edx, dword [eax + 0x1c]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x501862
mov esi, dword [ebx + 0x440]
jmp 0x501864
xor esi, esi
mov eax, dword [ebx + 0x44]
cmp eax, edi
jne 0x501872
mov eax, str.ftp:__
jmp 0x50188d
cmp eax, 1
jne 0x50187e
mov eax, str.http:__
jmp 0x50188d
cmp eax, 3
mov eax, str.mms:__
je 0x50188d
mov eax, str.https:__
push eax
lea ecx, [ebp - 0x14]
call fcn.0054222c
mov eax, dword [ebx + 0x224]
mov ecx, dword [ebp - 0x14]
lea edi, [ebx + 0x20]
push esi
push eax
mov byte [ebp - 4], 1
mov eax, dword [edi]
push eax
push ecx
lea ecx, [ebp - 0x18c]
call fcn.0048cf50
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 2
call fcn.0053e1a5
cmp eax, 1
jne 0x501a7b
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x5018e9
push 0
push 0x138a
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
push edx
push eax
mov ecx, ebx
mov dword [ebx + 0x14], 0
call fcn.00502e20
mov eax, dword [ebx + 0x420]
test eax, eax
je 0x501967
mov ecx, dword [ebx + 0x3e0]
test ecx, ecx
jne 0x50191b
push eax
mov ecx, edi
call fcn.0050a460
mov esi, dword [ebx + 0x3e0]
test esi, esi
je 0x501967
mov edx, dword [ebp - 0x40]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
push str.User
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call esi
mov edx, dword [ebp - 0x3c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [ebx + 0x3e0]
push edx
push 1
push eax
push str.Password
push ecx
call esi
mov edx, dword [0x5c2a74]
mov dword [ebp + 8], edx
mov eax, dword [ebx + 0x780]
mov ecx, dword [0x5c83c4]
push eax
push ecx
lea edx, [ebp + 8]
push str._r_n_s_r_ndownlResult___ldsetting_new_login_r_n
push edx
mov byte [ebp - 4], 3
call fcn.0053afda
mov eax, dword [ebp + 8]
add esp, 0x10
lea ecx, [ebx + 0x444]
push eax
call fcn.004d1cc0
mov al, byte [ebp + 0xc]
test al, al
je 0x5019cc
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x5019cc
mov ebx, dword [ebx + 0x420]
test ebx, ebx
je 0x5019cc
push ebx
push 0x1431
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.005421be
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xc
call fcn.005421be
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.005421be
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xa
call fcn.005421be
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 9
call fcn.005421be
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 8
call fcn.005421be
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 7
call fcn.00549f48
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 6
call fcn.00549fae
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 5
call fcn.0054a098
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 4
call fcn.00549f10
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 1
call fcn.0053dde6
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.005421be
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x15
call fcn.005421be
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x14
call fcn.005421be
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x13
call fcn.005421be
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x12
call fcn.005421be
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x11
call fcn.005421be
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x10
call fcn.00549f48
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0xf
call fcn.00549fae
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0xe
call fcn.0054a098
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0xd
call fcn.00549f10
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 1
call fcn.0053dde6
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.005421be
mov edi, dword [0x5c83c4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c83c0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c8178]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c8314]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c8310]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c83c8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c81ac]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c8158]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c80e8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c8150]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c8098]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c8148]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edx, dword [ebx + 0x434]
mov eax, dword [ebx + 0x430]
lea ecx, [ebp - 0x2c]
push ecx
push edx
push eax
mov ecx, ebx
call fcn.00505250
mov ecx, dword [ebx + 0x54]
mov edx, dword [ebx + 0x434]
mov eax, dword [ebx + 0x430]
push ecx
push edx
mov edx, dword [ebx + 0x28]
lea ecx, [ebp - 0x2c]
push eax
mov eax, dword [0x5c818c]
push ecx
push edx
lea ecx, [ebp - 0xdc8]
push eax
push ecx
call fcn.00527718
add esp, 0x1c
jmp 0x5012fe
mov edi, dword [0x5c82d8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c78f4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edi, dword [0x5c83b0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xdc8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x5012fe
mov edx, dword [0x5c7c04]
lea ecx, [ebx + 0x448]
push ecx
jmp 0x5012ee
xor ecx, ecx
add ecx, 0xb48
push ecx
call fcn.0054276d
mov edi, eax
mov eax, dword [ebx + 0x444]
add esp, 4
mov esi, eax
test eax, eax
jne 0x501e40
mov esi, 0x5c6ff0
test eax, eax
je 0x501e4b
mov eax, dword [0x5c7e24]
jmp 0x501e61
push 0x5c6ff0
lea ecx, [ebp + 0xc]
call fcn.0054222c
mov eax, dword [eax]
mov dword [ebp - 0x18], 1
push esi
lea ecx, [ebp - 0xdc8]
push eax
push ecx
push str._s_n_n_s_s
push edi
call fcn.00527718
mov al, byte [ebp - 0x18]
add esp, 0x14
test al, 1
je 0x501e87
lea ecx, [ebp + 0xc]
call fcn.005421be
mov edx, dword [ebx + 0x420]
mov eax, dword [ebx + 0x780]
push 0
push edx
push edi
push eax
lea ecx, [ebx + 0x20]
call fcn.00508060
lea esi, [ebx + 0x444]
push edi
mov ecx, esi
call fcn.004d1cc0
mov ecx, dword [ebx + 0x780]
lea edx, [ebp - 0x1cc]
push ecx
push str._r_ndownlResult___ld_r_n
push edx
call fcn.00527718
add esp, 0xc
lea eax, [ebp - 0x1cc]
mov ecx, esi
push eax
call fcn.004d1cc0
mov eax, dword [ebx + 8]
test eax, eax
jne 0x501f7d
mov eax, dword [ebx + 4]
test eax, eax
jne 0x501f7d
mov al, byte [ebp + 8]
test al, al
je 0x501f7d
mov eax, dword [ebx + 0x420]
test eax, eax
je 0x501f7d
mov eax, dword [ebx + 0x780]
cmp eax, 0x7553
jne 0x501f49
mov ecx, dword [ebx + 0x28]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x10024
push ecx
push edi
push 0
call esi
cmp eax, 6
jne 0x501f83
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x501f83
mov edx, dword [ebx + 0x420]
push edx
push 0x13bb
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x501f83
cmp eax, 0xffffffff
je 0x501f5a
cmp eax, 0x753b
mov eax, 0x30
jne 0x501f5f
mov eax, 0x10
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x501f69
mov ecx, dword [ebx + 0x28]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0x50000
push eax
push ecx
push edi
push 0
call esi
jmp 0x501f83
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebx + 4]
test eax, eax
je 0x502109
cmp eax, 3
jne 0x501fa3
cmp dword [ebx + 0x780], 0x756e
je 0x502028
mov cl, byte [ebp + 8]
test cl, cl
je 0x502028
mov eax, dword [ebx + 0x780]
cmp eax, 0xffffffff
jne 0x501fe9
mov eax, dword [0x5c815c]
push 0x50010
push str.Internet_Download_Manager
push eax
push 0
call esi
push edi
mov byte [ebp - 4], 0x1a
call fcn.00542796
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
sub eax, 0x753b
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x10
or eax, 0x50000
push eax
push str.Internet_Download_Manager
push edi
push 0
call esi
push edi
mov byte [ebp - 4], 0x1a
call fcn.00542796
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, 4
jne 0x502110
mov al, byte [ebx + 0x361]
test al, al
je 0x502110
lea ecx, [ebp - 0x18]
lea edx, [ebp + 0x10]
push ecx
push edx
mov byte [ebx + 0x361], 0
mov eax, dword [0x5c74b0]
push 0
push 0
push str.bHDIShwd
push eax
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x502110
mov edx, dword [0x5c74b0]
lea ecx, [ebp + 0x10]
push 4
push ecx
push 4
push 0
push str.bHDIShwd
push edx
mov dword [ebp + 0x10], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0053eac1
push eax
lea ecx, [ebp - 0x2a0]
call fcn.004b2540
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0x17
call fcn.0053e1a5
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0x19
call fcn.0048cb90
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 0x18
call fcn.00549f10
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 0
call fcn.0053dde6
push edi
mov byte [ebp - 4], 0x1a
call fcn.00542796
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov byte [ebx + 0x361], 0
push edi
mov byte [ebp - 4], 0x1a
call fcn.00542796
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc