Function at 0x50199c71
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x4d0
push esi
xor esi, esi
cmp dword [ecx + 0x2c], esi
mov dword [ebp + 0x54], ecx
je 0x50199c8e
xor eax, eax
jmp 0x5019a005
push ebx
push edi
lea ecx, [ebp - 0x458]
mov dword [ebp + 0x70], esi
mov dword [ebp + 0x74], esi
call fcn.500a74f7
push 0x7f02
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp + 0x50], eax
lea eax, [ebp + 0x70]
push eax
mov edi, 0x5001c89c
push edi
mov esi, SysAllocStringLen
push esi
call ebx
test eax, eax
lea eax, [ebp + 0x70]
push eax
push edi
push esi
jg 0x50199cdf
call ebx
mov edi, eax
jmp 0x50199cef
call ebx
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jl 0x50199fcf
and dword [ebp + 0x58], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x27
lea eax, [ebp + 4]
push eax
push 0
jmp 0x50199f89
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 4]
push eax
push dword [ebp + 0x70]
call ebx
test eax, eax
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 4]
push eax
push dword [ebp + 0x70]
jg 0x50199d30
call ebx
mov edi, eax
jmp 0x50199d40
call ebx
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jl 0x50199fcf
push 9
pop ecx
xor eax, eax
and dword [ebp + 0x5c], eax
lea edi, [ebp + 0x2c]
rep stosd dword es:[edi], eax
push 0xa
lea eax, [ebp + 0x60]
push eax
push 0
jmp 0x50199f63
push 0x5001c8a4
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp - 0x38]
push 0x50006ac4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
add esp, 0x10
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x74]
mov dword [ebp + 0x6c], 0x14
call edi
test eax, eax
jne 0x50199db7
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR70.dll_atoi]
test al, 5
pop ecx
mov dword [ebp + 0x44], eax
jne 0x50199f57
jmp 0x50199dbb
and dword [ebp + 0x44], 0
push 0
push 0x104
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x74]
call fcn.50272bbe
test eax, eax
jne 0x50199f57
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x458]
call fcn.500a74ff
lea ecx, [ebp - 0x458]
call fcn.50272bbe
test eax, eax
je 0x50199e1b
lea ecx, [ebp - 0x458]
call fcn.500a6d39
push eax
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x50199f57
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x74]
mov dword [ebp + 0x6c], 0x104
call edi
test eax, eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x74]
jg 0x50199e68
call edi
mov edi, eax
jmp 0x50199e78
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jl 0x50199fcf
cmp byte [ebp - 0x13c], 0
jne 0x50199eae
push 0x104
lea ecx, [ebp - 0x458]
call fcn.50272bbe
lea edi, [ebp - 0x13c]
call fcn.50272bbe
mov edi, eax
test edi, edi
jl 0x50199fcf
cmp byte [ebp + 0x60], 0
lea eax, [ebp + 0x60]
je 0x50199f57
cmp byte [eax], 0x2e
je 0x50199ec6
inc eax
cmp byte [eax], 0
jne 0x50199ebb
cmp byte [eax], 0
je 0x50199f57
and byte [eax], 0
inc eax
push eax
call fcn.501992a7
mov word [ebp + 0x3e], ax
lea eax, [ebp + 0x60]
push eax
call fcn.501992a7
mov word [ebp + 0x3c], ax
lea eax, [ebp - 0x240]
push eax
call fcn.5003ed1e
test eax, eax
mov dword [ebp + 0x4c], eax
je 0x5019a00b
lea eax, [ebp - 0x13c]
push eax
call fcn.5003ed1e
test eax, eax
mov dword [ebp + 0x48], eax
je 0x5019a00b
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 4]
push eax
call fcn.50272bbe
mov edi, eax
test edi, edi
jl 0x50199fcf
mov ecx, dword [ebp + 0x54]
push 0
push 4
lea eax, [ebp + 0x2c]
push eax
call fcn.50272bbe
mov edi, eax
test edi, edi
je 0x50199f57
lea esi, [ebp + 0x2c]
call fcn.50199357
test edi, edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
jl 0x50199fcf
inc dword [ebp + 0x5c]
push 0xa
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x74]
call esi
test eax, eax
je 0x50199d62
push dword [ebp + 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp + 0x74], 0
inc dword [ebp + 0x58]
push 0x27
lea eax, [ebp + 4]
push eax
push dword [ebp + 0x58]
push dword [ebp + 0x70]
call esi
test eax, eax
je 0x50199d0e
mov ecx, dword [ebp + 0x54]
mov eax, dword [ecx + 0x2c]
and dword [ecx + 0x24], 0
dec eax
js 0x50199fcd
mov edx, eax
imul edx, edx, 0x34
lea esi, [eax + 1]
mov eax, dword [ecx + 0x28]
mov edi, dword [ecx + 0x24]
add eax, edx
mov dword [eax + 0x2c], edi
mov edi, dword [ecx + 0x24]
test edi, edi
je 0x50199fc0
mov dword [edi + 0x30], eax
and dword [eax + 0x30], 0
sub edx, 0x34
dec esi
mov dword [ecx + 0x24], eax
jne 0x50199fab
xor edi, edi
cmp dword [ebp + 0x74], 0
je 0x50199fde
push dword [ebp + 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x70], 0
je 0x50199fed
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x50]
call dword [sym.imp.USER32.dll_SetCursor]
lea ecx, [ebp - 0x458]
call fcn.501b7afc
mov eax, edi
pop edi
pop ebx
pop esi
add ebp, 0x78
leave
ret
mov edi, 0x8007000e
jmp 0x50199fcf