Function at 0x5247f0
Capabilities:
Delete registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cbdf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0x30c4]
push esi
lea esi, [ebx + 0x30c4]
push edi
xor eax, eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
mov eax, dword [ebx]
push 0x1e
push ecx
mov ecx, ebx
mov dword [ebp - 0x30], ebx
call dword [eax + 0x14]
mov edi, eax
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x38]
test ecx, ecx
je 0x524863
lea ecx, [eax + 0x48]
call fcn.0050d7f0
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x5248e2
mov dword [ebp - 0x2c], 0
push edi
mov ecx, ebx
call fcn.0050f650
test eax, eax
jne 0x5248c9
mov eax, dword [ebp - 0x2c]
inc eax
cmp eax, 5
mov dword [ebp - 0x2c], eax
jg 0x5248c9
mov edx, dword [ebx]
push esi
mov ecx, ebx
call dword [edx + 0x10]
mov ecx, dword [esi]
mov eax, dword [ebx]
push 0x1e
push ecx
mov ecx, ebx
call dword [eax + 0x14]
mov edi, eax
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x38]
test ecx, ecx
je 0x52486e
lea ecx, [eax + 0x48]
call fcn.0050d7f0
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x5248e2
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x3108], 1
mov eax, dword [ebx + 0x84]
test eax, eax
je 0x5248fb
mov eax, dword [eax + 0x10]
jmp 0x524904
mov edx, dword [ebx + 0x80]
mov eax, dword [edx + 0x24]
cmp eax, 2
jne 0x5249d5
mov eax, dword [ebx + 0xb4]
cmp dword [eax], 0
je 0x524963
push 1
mov ecx, ebx
call fcn.00526820
test eax, eax
jne 0x525afe
cmp dword [ebx + 0x3114], 0xc8
je 0x52495c
mov ecx, dword [ebx + 0x30f8]
push ecx
mov ecx, dword [ebx + 0x6c]
call fcn.00513250
mov eax, 0x756d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x5c], 0x10
mov edx, dword [ebx + 0x323c]
lea esi, [ebx + 0x31e8]
push esi
push edx
mov ecx, ebx
call fcn.0056e7a0
test eax, eax
jne 0x525afe
mov eax, dword [ebx + 0x84]
test eax, eax
jne 0x524990
mov eax, dword [ebx + 0x80]
mov eax, dword [eax]
mov edx, dword [ebx + 0x30c4]
lea ecx, [ebx + 0x31f8]
lea edi, [ebx + 0x31f0]
push 1
push ecx
push edi
push eax
push esi
push edx
mov ecx, ebx
call fcn.0056ebe0
test eax, eax
je 0x5249cd
cmp eax, 0x757e
jne 0x525afe
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
jmp 0x525861
push edi
mov ecx, ebx
call fcn.0056f720
mov esi, dword [ebp + 8]
test esi, esi
je 0x5249e5
mov ecx, ebx
call fcn.00525e20
jmp 0x5249ee
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 0x1c]
test eax, eax
jne 0x525afe
push esi
mov ecx, ebx
call fcn.00525b20
mov esi, eax
test esi, esi
jne 0x524a9e
cmp dword [ebx + 0x3114], 0xce
jne 0x524a9e
mov edi, dword [ebx + 0x3120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x524a9e
mov eax, dword [ebx + 0x84]
test eax, eax
jne 0x524a49
mov eax, dword [ebx + 0x80]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x34]
call fcn.005a58bb
or dword [ebp - 0x18], 1
mov eax, dword [eax]
push str.sciencedirect.com
push eax
call fcn.00589520
mov edi, eax
mov al, byte [ebp - 0x18]
add esp, 8
test al, 1
je 0x524a6a
lea ecx, [ebp - 0x34]
call fcn.005a584d
test edi, edi
je 0x524a9e
cmp dword [ebx + 0x30c0], 2
je 0x524a9e
mov ecx, dword [ebx + 0x30cc]
test ecx, ecx
je 0x524a88
mov edx, dword [ecx]
push 2
call dword [edx + 0xc]
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebx + 0x30c0], 2
call dword [eax + 0x18]
jmp 0x525861
cmp dword [ebx + 0x3114], 0xc8
jne 0x524bb0
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
or ecx, eax
jne 0x524bb0
mov eax, dword [ebx + 0x24]
xor edi, edi
cmp eax, edi
jg 0x524bb2
jl 0x524ad4
cmp dword [ebx + 0x20], edi
ja 0x524bb2
mov al, byte [ebx + 0x30d1]
test al, al
jne 0x524bb2
mov eax, dword [ebx + 0x3140]
mov ecx, dword [ebx + 0x3144]
mov edx, eax
or edx, ecx
je 0x524bb2
mov edx, dword [ebx + 0x3130]
add eax, 1
adc ecx, edi
cmp eax, edx
jne 0x524bb2
cmp ecx, dword [ebx + 0x3134]
jne 0x524bb2
mov esi, 0x7542
mov eax, dword [0x682f9c]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
push edi
push ecx
mov ecx, dword [ebx + 0x80]
mov byte [ebp - 4], 1
call fcn.00533220
mov edx, dword [ebp - 0x18]
push edx
call fcn.00473e50
add esp, 4
cmp esi, 0x7565
je 0x524b58
cmp esi, 0x7542
jne 0x524c8a
mov ecx, dword [ebx + 0x80]
mov dl, byte [ecx + 0x2c8]
test dl, dl
jne 0x524c16
test al, al
je 0x524c16
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x30c4]
push eax
mov ecx, ebx
call dword [edx + 0x10]
mov edi, eax
test edi, edi
je 0x524bdb
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005a584d
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor edi, edi
cmp esi, edi
je 0x524d95
cmp esi, 0x7563
jne 0x524b1c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x80]
mov ecx, dword [ebp + 8]
push ecx
mov byte [eax + 0x2c8], 1
mov ecx, ebx
call fcn.005247f0
mov esi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005a584d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x7542
jne 0x524c8a
cmp dword [ebp + 8], edi
jne 0x524c8a
cmp dword [ebx + 0x24], edi
jl 0x524c9e
jg 0x524c2f
cmp dword [ebx + 0x20], edi
jbe 0x524c8a
cmp dword [ecx + 0x2c0], edi
je 0x524c8a
mov edx, dword [ebx + 0x30cc]
mov eax, dword [edx + 0x70]
push eax
push edi
call fcn.00568af0
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x30c4]
push eax
mov ecx, ebx
call dword [edx + 0x10]
mov edi, eax
test edi, edi
je 0x524c83
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005a584d
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
jmp 0x524bec
cmp dword [ebx + 0x24], edi
jg 0x524d3e
jl 0x524c9e
cmp dword [ebx + 0x20], edi
ja 0x524d3e
mov al, byte [ebx + 0x30d1]
test al, al
jne 0x524d3e
cmp esi, 0x7565
je 0x524cd4
cmp esi, 0x7566
je 0x524cd4
cmp esi, 0x7542
je 0x524cd4
cmp esi, 0x756e
je 0x524cd4
cmp esi, 0x755e
jne 0x524d3e
mov eax, dword [ebx + 0x80]
mov byte [ebx + 0x30d0], 1
mov byte [ebx + 0x30d1], 1
mov cl, byte [eax + 0x2dc]
test cl, cl
je 0x524cf9
mov byte [eax + 0x2de], 1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x30c4]
push eax
mov ecx, ebx
call dword [edx + 0x10]
mov edi, eax
test edi, edi
je 0x524d35
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005a584d
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
jmp 0x524bec
mov ecx, dword [ebx + 0x30d8]
cmp ecx, edi
je 0x524bf5
call fcn.005484b0
test al, al
jne 0x524bf5
mov eax, dword [ebx + 0x80]
mov cl, byte [eax + 0x2dd]
test cl, cl
je 0x524bf5
mov cl, byte [eax + 0x2de]
test cl, cl
jne 0x524bf5
mov cl, byte [eax + 0x2df]
test cl, cl
jne 0x524bf5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005a584d
cmp dword [ebx + 0x30d8], edi
je 0x5254da
mov ecx, dword [ebx + 0x80]
mov eax, dword [ecx + 0xbc]
cmp eax, edi
jne 0x524dbd
cmp esi, edi
je 0x5254da
cmp eax, edi
je 0x524dd3
push str.text_html
push eax
call fcn.005929b0
add esp, 8
test eax, eax
sete byte [ebp - 0x11]
jmp 0x524dd7
mov byte [ebp - 0x11], 0
mov ecx, dword [ebx + 0x30d8]
call fcn.005484b0
test al, al
jne 0x5254da
mov eax, dword [ebx + 0x80]
mov cl, byte [eax + 0x2dd]
test cl, cl
je 0x5254da
mov cl, byte [eax + 0x2de]
test cl, cl
jne 0x5254da
mov cl, byte [eax + 0x2df]
test cl, cl
jne 0x5254da
mov al, byte [ebp - 0x11]
test al, al
jne 0x524e29
cmp esi, edi
je 0x5254da
mov eax, dword [0x682f9c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x40], edi
mov word [ebp - 0x44], di
lea edx, [ebp - 0x48]
lea eax, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x38]
push ecx
lea eax, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
push ecx
mov ecx, dword [ebx + 0x30d8]
lea eax, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 7
call fcn.005483d0
test al, al
je 0x525492
mov ecx, dword [ebx + 0x80]
mov byte [ecx + 0x2de], 1
mov edx, dword [ebx + 0x80]
mov byte [edx + 0x2dc], 1
mov eax, dword [ebx + 0x80]
mov byte [eax + 0x2df], 1
mov ecx, dword [ebx + 0x30d8]
call fcn.005483a0
mov eax, dword [ebx + 0x80]
mov ecx, dword [ebp - 0x38]
mov dword [eax + 0x24], ecx
mov eax, dword [ebx + 0x80]
mov edx, dword [ebp - 0x3c]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x28]
mov esi, dword [ebx + 0x80]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
test eax, eax
je 0x524ee3
push eax
call fcn.005a1c12
add esp, 4
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.005a1be9
mov edx, eax
add esp, 4
test edx, edx
mov dword [esi], edx
jne 0x524f6c
push str.URL::set_serverName__:_Not_enough_memory__n
mov ecx, esi
call fcn.00563390
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.005a584d
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.005a584d
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005a584d
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.005a584d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.005a584d
mov eax, 0x753b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x80]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 4]
test eax, eax
je 0x524fa8
push eax
call fcn.005a1c12
add esp, 4
xor edx, edx
cmp esi, edx
jne 0x524fb3
mov dword [edi + 4], edx
jmp 0x525012
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x524fc9
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], edx
jmp 0x525012
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.005a1be9
mov ecx, dword [ebp - 0x18]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 4], edx
jne 0x524ff3
push str.URL::set_serverPath__:_Not_enough_memory__n
jmp 0x524f07
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x80]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [eax + 8]
test eax, eax
je 0x52502e
push eax
call fcn.005a1c12
add esp, 4
mov cl, byte [0x6874e8]
test esi, esi
mov byte [ebp - 0x11], cl
jne 0x52503e
lea esi, [ebp - 0x11]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.005a1be9
mov ecx, dword [ebp - 0x34]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 8], edx
jne 0x525068
push str.URL::set_fileName__:_Not_enough_memory__n
jmp 0x524f07
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x80]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x5250a3
push eax
call fcn.005a1c12
add esp, 4
xor edx, edx
cmp esi, edx
jne 0x5250ae
mov dword [edi + 0x1c], edx
jmp 0x52510f
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x5250c4
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x1c], edx
jmp 0x52510f
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.005a1be9
mov ecx, dword [ebp - 0x18]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 0x1c], edx
jne 0x5250f0
push str.URL::set_Cookie__:_Not_enough_memory__n
call fcn.00563390
jmp 0x52510f
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x80]
push 0x6874e8
add ecx, 0xc4
call fcn.005a59d6
mov ecx, dword [ebx + 0x80]
mov byte [ecx + 0x2cd], 0
mov esi, dword [ebx + 0x80]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x525148
push eax
call fcn.005a1c12
add esp, 4
mov edx, 0x6874e8
test edx, edx
jne 0x525156
mov dword [esi + 0x18], edx
jmp 0x5251bc
mov edi, 0x6874e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x52516c
mov dword [esi + 0x18], eax
jmp 0x5251bc
mov edi, 0x6874e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.005a1be9
mov edx, eax
add esp, 4
test edx, edx
mov dword [esi + 0x18], edx
jne 0x52519a
push str.URL::set_Referer__:_Not_enough_memory__n
mov ecx, esi
call fcn.00563390
jmp 0x5251bc
mov edi, 0x6874e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x30cc]
test eax, eax
je 0x5251ff
mov eax, dword [eax + 0x70]
test eax, eax
je 0x5251ff
mov ecx, dword [ebx + 0x80]
mov edx, dword [ecx + 0x3c0]
test edx, edx
jne 0x5251e3
push eax
call fcn.005689c0
mov ecx, dword [ebx + 0x80]
mov eax, dword [ecx + 0x3c0]
test eax, eax
je 0x5251ff
push str.Referer
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x525209
lea eax, [ebp - 0x44]
push eax
call fcn.00589432
add esp, 4
test eax, eax
je 0x525271
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x525220
lea eax, [ebp - 0x44]
mov ecx, dword [ebx + 0x80]
push eax
call fcn.00567040
mov eax, dword [ebx + 0x30cc]
test eax, eax
je 0x525271
mov eax, dword [eax + 0x70]
test eax, eax
je 0x525249
mov ecx, dword [ebx + 0x80]
push eax
call fcn.00565450
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x525271
mov edx, dword [eax + 0x70]
mov eax, dword [ecx]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edx
push 0x13c9
push 0x111
push eax
call esi
jmp 0x525277
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebx + 0x80]
push 0x6874e8
mov byte [ecx + 0x176], 1
mov ecx, dword [ebx + 0x80]
add ecx, 0x160
call fcn.005a59d6
mov edx, dword [ebx + 0x80]
mov byte [edx + 0x15c], 0
mov eax, dword [ebx + 0x80]
mov byte [eax + 0x2d1], 0
mov ecx, dword [ebx + 0x80]
push ecx
mov byte [ebx + 0x94], 0
call fcn.004d2f00
add esp, 4
mov ecx, ebx
call fcn.00520510
mov eax, dword [ebx + 0x7c]
test eax, eax
jne 0x525353
mov edx, dword [ebx + 0x70]
mov eax, dword [edx]
mov eax, dword [eax]
test eax, eax
je 0x5252f2
push 0
push 0x1478
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x30cc]
test eax, eax
je 0x525353
mov eax, dword [eax + 0x70]
test eax, eax
je 0x525353
mov ecx, dword [ebx + 0x80]
push 0
push 0
push eax
call fcn.00564e50
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x525333
mov edx, dword [eax + 0x70]
mov eax, dword [ecx]
push edx
push 0x1395
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x525353
mov edx, dword [eax + 0x70]
mov eax, dword [ecx]
push edx
push 0x1395
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x310c]
mov byte [ebp - 4], 8
push eax
call fcn.005a1c12
add esp, 4
jmp 0x525371
mov ecx, dword [ebx + 0x80]
mov dword [ebp - 4], 7
mov dword [ebx + 0x310c], 0
call fcn.00567410
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov eax, dword [ebx]
lea ecx, [ebx + 0x30c4]
push ecx
mov ecx, ebx
call dword [eax + 0x10]
mov esi, eax
test esi, esi
jne 0x525435
mov edx, dword [ebp + 8]
mov ecx, ebx
push edx
call fcn.005247f0
mov esi, eax
test esi, esi
jne 0x525435
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 0xbc]
test eax, eax
je 0x525435
push str.text_html
push eax
call fcn.005929b0
add esp, 8
test eax, eax
je 0x525435
mov eax, dword [ebx + 0x30cc]
test eax, eax
je 0x525435
mov eax, dword [eax + 0x70]
test eax, eax
je 0x525435
mov ecx, dword [ebx + 0x80]
mov edx, dword [ecx + 0x3c0]
test edx, edx
jne 0x525406
push eax
call fcn.005689c0
mov ebx, dword [ebx + 0x80]
mov eax, dword [ebx + 0x3c0]
test eax, eax
je 0x525435
lea ecx, [ebp + 8]
push 4
push ecx
push 4
push 0
mov edx, eax
push str.noSyntRef
push edx
mov dword [ebp + 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.005a584d
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.005a584d
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005a584d
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.005a584d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.005a584d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.005a584d
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.005a584d
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005a584d
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.005a584d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.005a584d
mov esi, dword [ebx + 0x3114]
cmp esi, 0xc8
jne 0x525504
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
or eax, ecx
jne 0x525504
mov ecx, dword [ebx + 0x3130]
mov edx, dword [ebx + 0x3134]
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], edx
cmp esi, 0xce
jne 0x5255b6
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
or eax, ecx
jne 0x525552
mov eax, dword [ebx + 0x24]
test eax, eax
jg 0x525552
jl 0x52552a
mov eax, dword [ebx + 0x20]
test eax, eax
ja 0x525552
mov eax, dword [ebx + 0x3130]
mov ecx, dword [ebx + 0x3134]
mov edx, eax
or edx, ecx
je 0x525552
mov edx, dword [ebx + 0x3140]
mov edi, dword [ebx + 0x3144]
or edx, edi
jne 0x525552
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], ecx
cmp esi, 0xce
jne 0x5255b6
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
or eax, ecx
jne 0x5255b6
mov eax, dword [ebx + 0x24]
test eax, eax
jg 0x5255a4
jl 0x525574
mov eax, dword [ebx + 0x20]
test eax, eax
ja 0x5255a4
mov edi, dword [ebx + 0x3140]
mov ecx, dword [ebx + 0x3144]
mov edx, edi
or edx, ecx
je 0x5255a4
mov eax, dword [ebx + 0x3134]
mov edx, dword [ebx + 0x3130]
cmp ecx, eax
jg 0x5255a4
jl 0x52559c
cmp edi, edx
jae 0x5255a4
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], eax
jmp 0x5255b6
mov eax, dword [ebx + 0x3140]
mov ecx, dword [ebx + 0x3144]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], ecx
cmp esi, 0xc8
je 0x5255c6
cmp esi, 0xce
jne 0x5255ec
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
or edx, eax
jne 0x5255ec
mov eax, dword [ebx + 0x315c]
mov ecx, dword [ebx + 0x3158]
test eax, eax
jl 0x5255ec
jg 0x5255e6
test ecx, ecx
jbe 0x5255ec
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
mov ecx, edx
or ecx, eax
je 0x5256cf
mov edi, dword [ebx + 0x30cc]
mov eax, dword [edi + 0x88]
mov ecx, dword [edi + 0x8c]
mov esi, eax
or esi, ecx
je 0x5256cf
cmp eax, edx
jne 0x525625
cmp ecx, dword [ebx + 0x1c]
je 0x5256cf
mov edx, dword [edi + 0x80]
mov esi, dword [edi + 0x84]
or edx, esi
je 0x5256cf
mov dl, byte [ebx + 0x311c]
test dl, dl
jne 0x5256cf
cmp dword [ebx + 0x3114], 0xce
jne 0x525689
mov edx, dword [ebx + 0x3140]
mov esi, dword [ebx + 0x3144]
sub eax, 1
sbb ecx, 0
cmp edx, eax
jne 0x525689
cmp esi, ecx
jne 0x525689
mov eax, dword [ebx + 0x3148]
mov ecx, dword [ebx + 0x314c]
or eax, ecx
jne 0x525689
mov dword [ebx + 0x3148], edx
mov dword [ebx + 0x314c], esi
mov esi, dword [ebx + 0x3148]
mov eax, dword [ebx + 0x314c]
mov ecx, esi
or ecx, eax
je 0x5257d9
mov edx, dword [edi + 0x88]
mov edi, dword [edi + 0x8c]
mov eax, edx
mov ecx, edi
sub eax, 1
sbb ecx, 0
cmp esi, eax
jne 0x5257d9
cmp dword [ebx + 0x314c], ecx
jne 0x5257d9
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edi
mov al, byte [ebx + 0x311c]
test al, al
jne 0x52591c
mov eax, dword [ebx + 0x80]
xor esi, esi
mov edx, dword [eax + 0xbc]
cmp edx, esi
je 0x5258f4
mov eax, dword [eax + 0x100]
or ecx, 0xffffffff
mov dword [ebp - 0x18], eax
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5258f4
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5258f4
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x18]
not ecx
dec ecx
push ecx
push edx
push eax
call fcn.0058c890
add esp, 0xc
test eax, eax
je 0x5258f4
mov ecx, dword [ebx + 0x80]
push 9
push str.text_html
mov eax, dword [ecx + 0x100]
push eax
call fcn.0058b6b0
add esp, 0xc
test eax, eax
jne 0x525783
mov edx, dword [ebx + 0x80]
push 9
push str.text_html
mov eax, dword [edx + 0xbc]
push eax
call fcn.0058b6b0
add esp, 0xc
test eax, eax
jne 0x5258f4
mov ecx, dword [ebx + 0x30cc]
cmp dword [ecx + 0xf4], esi
je 0x525895
mov eax, dword [ebx + 0x80]
mov dl, byte [eax + 0x2e1]
test dl, dl
jne 0x5257b3
mov dl, byte [eax + 0x159]
test dl, dl
je 0x525895
mov edx, dword [ecx + 0x84]
lea eax, [ecx + 0x80]
mov ecx, dword [ecx + 0x80]
or ecx, edx
je 0x5258f4
mov byte [ebx + 0x311c], 1
jmp 0x5258f4
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0xf4]
test ecx, ecx
je 0x52580f
mov eax, dword [ebx + 0x80]
mov cl, byte [eax + 0x2e1]
test cl, cl
jne 0x525803
mov cl, byte [eax + 0x159]
test cl, cl
je 0x52580f
mov byte [ebx + 0x311c], 1
jmp 0x5256cf
mov eax, dword [ebx + 0x24]
test eax, eax
jg 0x5258d5
jl 0x525827
mov eax, dword [ebx + 0x20]
test eax, eax
ja 0x5258d5
mov al, byte [ebx + 0x30d1]
test al, al
jne 0x5258d5
mov eax, dword [ebx + 0x80]
mov byte [ebx + 0x30d0], 1
mov byte [ebx + 0x30d1], 1
mov cl, byte [eax + 0x2dc]
test cl, cl
je 0x52585a
mov byte [eax + 0x2de], 1
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x30c4]
push eax
mov ecx, ebx
call dword [edx + 0x10]
test eax, eax
jne 0x525afe
mov eax, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.005247f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebx + 0x80]
push 9
push str.text_html
mov eax, dword [edx + 0xbc]
push eax
call fcn.0058b6b0
add esp, 0xc
test eax, eax
je 0x5258d5
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
mov eax, ecx
or eax, edx
je 0x5258d5
mov eax, dword [ebx + 0x80]
add eax, 0x120
cmp ecx, dword [eax]
jne 0x5258d5
cmp edx, dword [eax + 4]
je 0x5258f4
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov eax, 0x757a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebx + 0x311c]
test al, al
jne 0x52591e
mov edx, dword [ebx + 0x30e4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x52591e
push edx
mov ecx, ebx
call fcn.0052bf90
jmp 0x52591e
xor esi, esi
push 0x6874e8
lea ecx, [ebx + 0x30e4]
call fcn.005a59d6
mov al, byte [ebx + 0x311c]
test al, al
je 0x525a91
lea ecx, [ebx + 0x10]
mov byte [ebx + 0x311c], 0
call fcn.005133b0
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x68]
cmp ecx, esi
lea ecx, [eax + 0x48]
setne byte [ebp - 0x11]
call fcn.00507f40
mov eax, dword [ebx + 0x30cc]
mov dword [eax + 0x80], esi
mov dword [eax + 0x84], esi
mov ecx, dword [ebx + 0x30cc]
mov dword [ecx + 0x88], esi
mov dword [ecx + 0x8c], esi
mov edx, dword [ebx + 0x30cc]
mov dword [edx + 0x158], esi
mov dword [edx + 0x15c], esi
mov eax, dword [ebx + 0x30cc]
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x3130], esi
mov dword [ebx + 0x3138], esi
mov dword [ebx + 0x3140], esi
mov dword [ebx + 0x3148], esi
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x3158], esi
cmp eax, esi
mov dword [ebx + 0x3118], esi
mov dword [ebx + 0x60], esi
mov dword [ebx + 0x24], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x3c], esi
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x3134], esi
mov dword [ebx + 0x313c], esi
mov dword [ebx + 0x3144], esi
mov dword [ebx + 0x314c], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x315c], esi
je 0x525a12
mov byte [eax + 0x7f1], 0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x30c4]
push eax
mov ecx, ebx
call dword [edx + 0x10]
cmp eax, esi
jne 0x525afe
mov eax, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.005247f0
mov edi, eax
cmp edi, esi
je 0x525a53
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebp - 0x11]
test al, al
je 0x525a75
mov ecx, dword [ebx + 0x80]
mov edx, dword [ecx + 0x30]
mov ecx, dword [ebx + 0x30cc]
push edx
push ebx
add ecx, 0x48
call fcn.00508080
mov edi, eax
mov ecx, ebx
call fcn.00510e00
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x5c], 6
mov dword [ebx + 0x78], esi
mov eax, dword [0x688b64]
push 1
push eax
mov ecx, ebx
call fcn.0050ee60
cmp dword [ebx + 0x7c], esi
jne 0x525ad3
mov ebx, dword [ebx + 0x30cc]
mov eax, dword [ebx + 0x18]
cmp eax, esi
je 0x525ad3
mov ecx, dword [ebx + 0x70]
mov edx, dword [eax]
push ecx
push 0x13f8
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4