Function at 0x506e20
Capabilities:
Get graphical window text
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2dc]
sub esp, 0x2dc
push 0xffffffffffffffff
push 0x6585e3
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp + 0x2d8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x38], esi
call fcn.005f6b34
mov dword [esi + 0xf8], esi
mov dword [esi + 0xfc], 0x6d4
push 0x6d4
mov ecx, esi
call fcn.005f5a75
mov eax, dword [eax + 0x20]
mov dword [esi + 0xf4], eax
mov dword [esi + 0x108], esi
mov dword [esi + 0x10c], 0x698
push 0x698
mov ecx, esi
call fcn.005f5a75
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x104], ecx
mov dword [esi + 0x118], esi
mov dword [esi + 0x11c], 0x6b9
push 0x6b9
mov ecx, esi
call fcn.005f5a75
mov edx, dword [eax + 0x20]
mov dword [esi + 0x114], edx
mov dword [esi + 0x128], esi
mov dword [esi + 0x12c], 0x699
push 0x699
mov ecx, esi
call fcn.005f5a75
mov eax, dword [eax + 0x20]
mov dword [esi + 0x124], eax
lea edi, [esi + 0x130]
mov dword [edi + 8], esi
mov dword [edi + 0xc], 0x672
push 0x672
mov ecx, esi
call fcn.005f5a75
mov ecx, dword [eax + 0x20]
mov dword [edi + 4], ecx
mov dword [esi + 0x148], esi
mov dword [esi + 0x14c], 0x660
push 0x660
mov ecx, esi
call fcn.005f5a75
mov edx, dword [eax + 0x20]
mov dword [esi + 0x144], edx
mov dword [esi + 0x158], esi
mov dword [esi + 0x15c], 0x5f7
push 0x5f7
mov ecx, esi
call fcn.005f5a75
mov eax, dword [eax + 0x20]
mov dword [esi + 0x154], eax
mov dword [esi + 0x168], esi
mov dword [esi + 0x16c], 0x557
push 0x557
mov ecx, esi
call fcn.005f5a75
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x164], ecx
mov dword [esi + 0x178], esi
mov dword [esi + 0x17c], 0x565
push 0x565
mov ecx, esi
call fcn.005f5a75
mov edx, dword [eax + 0x20]
mov dword [esi + 0x174], edx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, esi
call fcn.00424390
cmp eax, ebx
je 0x50706a
lea ecx, [ebp + 0x210]
push ecx
mov ecx, eax
call fcn.004a5550
test eax, eax
je 0x50706a
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov edx, 0x3ff
and ax, dx
mov ecx, 4
cmp cx, ax
je 0x506ffc
mov dword [ebp + 0x220], 0x258
push 0x48
push 0x5a
mov ecx, esi
call fcn.004015c0
mov edx, dword [eax + 4]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 9
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
mov dword [ebp + 0x210], eax
mov eax, dword [0x678e3c]
mov dword [ebp + 0x22c], eax
mov cx, word [0x678e40]
mov word [ebp + 0x230], cx
mov dl, byte [0x678e42]
mov byte [ebp + 0x232], dl
lea eax, [ebp + 0x210]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
cmp eax, ebx
je 0x50706a
push 1
push eax
push 0x30
mov ecx, dword [esi + 0x154]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x75dd30], ebx
je 0x5070e0
push 0xe7
push esi
mov ecx, 0x75dcf0
call fcn.004e6a60
mov dword [ebp + 0x24c], ebx
mov dword [ebp + 0x254], ebx
xor edx, edx
mov word [ebp + 0x250], dx
mov byte [ebp - 4], 1
mov eax, dword [0x75dd28]
push eax
mov ecx, dword [0x75eda0]
push ecx
lea ecx, [ebp + 0x24c]
call fcn.00401970
mov eax, dword [ebp + 0x24c]
cmp eax, ebx
jne 0x5070c3
lea eax, [ebp + 0x250]
push eax
mov edx, dword [esi + 0x154]
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x24c]
call fcn.00401210
push 0x40
lea eax, [ebp + 0x258]
push eax
mov ecx, dword [esi + 0x104]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x50710e
lea edx, [ebp + 0x258]
push edx
mov eax, dword [esi + 0x114]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp dword [0x75dbc0], ebx
je 0x50712c
push ebx
mov ecx, edi
call fcn.00405450
push ebx
mov ecx, dword [esi + 0x134]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.004182f0
add esp, 0x14
mov ebx, 0x14a
mov byte [ebp - 0x50], 0
mov edi, 0x60
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x50]
call fcn.004361d0
cmp eax, edi
je 0x507173
push ebx
lea ecx, [ebp - 0x50]
call fcn.0040d180
mov ebx, eax
lea edi, [esi + 0x98]
push 0x24
mov ecx, edi
call fcn.0040d0b0
push 0xffffffffffffffff
push ebx
push 0
push 0x67997c
push 0
mov ecx, edi
call fcn.00601481
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [esi + 0x94]
cmp ebx, dword [eax + 0x28]
jge 0x5073ae
cmp dword [0x75dbc0], 0
je 0x5071db
push ebx
lea ecx, [eax + 4]
call fcn.004ce870
add eax, 4
mov eax, dword [eax]
push str.IEXPLORE
push eax
call fcn.006226ae
add esp, 8
test eax, eax
je 0x5073a8
mov byte [ebp - 0x11], 0
push ebx
mov ecx, dword [esi + 0x94]
add ecx, 0x20
call fcn.0045ee00
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x20], eax
add eax, 0xfffffffc
cmp eax, 4
ja case.0x5071fe.6
jmp dword [eax*4 + 0x507464]
push str.Mozilla
mov ecx, dword [esi + 0x94]
add ecx, 4
call fcn.0040da50
test eax, eax
je 0x5073a8
mov byte [ebp - 0x11], 1
push ebx
mov ecx, dword [esi + 0x94]
add ecx, 0x20
call fcn.0045ee00
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [0x75f38c]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x507275
test dl, dl
je 0x50725c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x507275
add eax, 2
add ecx, 2
test dl, dl
jne 0x507240
xor eax, eax
jmp 0x50727a
push str.NETSCP
jmp 0x50720a
push str.MozillaFirebird
jmp 0x50720a
push str.NETSCAPE
jmp 0x50720a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5072b3
lea ebx, [esi + 0x98]
push 0x67997c
push edi
mov ecx, ebx
call fcn.0040d070
mov edi, eax
cmp edi, 0xffffffff
jle 0x5072d7
mov edx, dword [0x75f38c]
push edx
push edi
push 0
mov eax, dword [esi + 0xb8]
push eax
call fcn.0040d0d0
add esp, 0x10
jmp 0x5072d7
push ebx
mov ecx, dword [esi + 0x94]
add ecx, 0x20
call fcn.0045ee00
mov eax, dword [eax]
mov eax, dword [eax]
lea ebx, [esi + 0x98]
push eax
push edi
mov ecx, ebx
call fcn.0040d070
mov edi, eax
inc dword [ebp - 0x1c]
cmp edi, 0xffffffff
jle 0x5073a2
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [esi + 0x94]
add ecx, 0x20
call fcn.0045ee00
mov edx, dword [eax]
cmp dword [edx + 0xc], 0
je 0x507396
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [esi + 0x94]
add ecx, 0x20
call fcn.0045ee00
mov ecx, dword [eax]
cmp dword [ecx + 0x10], 0
je 0x507396
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x20]
cmp eax, 2
jne 0x507351
cmp dword [ebp - 0x30], 0
jne 0x507336
cmp dword [ebp - 0x2c], 0
je 0x50736e
cmp dword [ebp - 0x3c], 0
jne 0x50736e
cmp dword [ebp - 0x44], 0
jne 0x50736e
cmp dword [ebp - 0x28], 0
jne 0x50736e
mov dword [ebp - 0x24], 0
jmp 0x507399
cmp eax, 0xc
je 0x507365
cmp eax, 0xd
je 0x507365
cmp eax, 3
je 0x507365
cmp eax, 0x10
jne 0x50736e
mov dword [ebp - 0x24], 0
jmp 0x507399
mov dword [ebp - 0x74], 0xf000
mov dword [ebp - 0x78], 0x2000
lea edx, [ebp - 0x84]
push edx
push edi
push 0x102b
mov eax, dword [esi + 0xb8]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x20]
push eax
push edi
mov ecx, ebx
call fcn.0040d050
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
jmp 0x50719c
mov ecx, esi
call fcn.005069a0
mov dword [ebp - 0x34], 4
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x40]
push edx
push 0
push 0
push str.RunIEMonitor2
mov eax, dword [0x75dbe4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5073e3
mov ecx, dword [ebp - 0x40]
push ecx
jmp 0x5073e5
push 1
lea ecx, [esi + 0x130]
call fcn.00405450
mov dword [ebp - 4], 0xffffffff
jmp 0x507430
mov dword [esi + 0x180], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2d8]
xor ecx, ebp
call fcn.00620b8d
add ebp, 0x2dc
mov esp, ebp
pop ebp
ret