Function at 0x50b57e
Capabilities:
Check if file exists
Query or enumerate registry value
Set registry value

Disassembly:
push 0xb4
mov eax, 0x69d239
call fcn.0056e23b
mov esi, ecx
lea ecx, [ebp - 0x80]
call fcn.004173bc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc0]
call fcn.0041d3ed
mov byte [ebp - 4], 3
mov edi, 0x77b084
cmp dword [0x7960fc], 0
jle 0x50b5d0
push str._winInvalidEnvironmentPath__step_1
mov ecx, edi
call fcn.0042e683
push dword [esi + 0x94]
call fcn.004c1587
pop ecx
test eax, eax
je 0x50ba5a
cmp dword [0x7960fc], 0
jle 0x50b5f9
push str._winInvalidEnvironmentPath__step_2
mov ecx, edi
call fcn.0042e683
push 0x20019
push 0x6ee648
call fcn.00567b83
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x50ba40
cmp dword [0x7960fc], 0
jle 0x50b62c
push str._winInvalidEnvironmentPath__step_3
mov ecx, 0x77b084
call fcn.0042e683
and dword [ebp - 0xb8], 0
lea eax, [ebp - 0xb8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push 0
push 0
push 0
push 0x6ee730
push edi
call ebx
test eax, eax
jne 0x50b86f
cmp dword [0x7960fc], eax
jle 0x50b66d
push str._winInvalidEnvironmentPath__step_4
mov ecx, 0x77b084
call fcn.0042e683
push dword [ebp - 0xb8]
call fcn.0056e306
mov esi, eax
pop ecx
test esi, esi
je 0x50b86f
cmp dword [0x7960fc], 0
jle 0x50b69b
push str._winInvalidEnvironmentPath__step_5
mov ecx, 0x77b084
call fcn.0042e683
lea eax, [ebp - 0xb8]
push eax
push esi
push 0
push 0
push 0x6ee73c
push edi
call ebx
test eax, eax
jne 0x50b865
lea ecx, [ebp - 0x64]
call fcn.004173bc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
push esi
call fcn.0041d41a
mov byte [ebp - 4], 5
cmp dword [0x7960fc], 0
jle 0x50b6f7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str._winInvalidEnvironmentPath__step_6___path___s
push 0x77b084
call fcn.0042e634
add esp, 0xc
push 0x6ee838
call fcn.00647fd1
pop ecx
push eax
push 0
push 0x6ee838
lea ecx, [ebp - 0x28]
call fcn.00427f5c
mov ebx, eax
cmp ebx, 0xffffffff
je 0x50b7d6
cmp dword [0x7960fc], 0
jle 0x50b739
push ebx
push str._winInvalidEnvironmentPath__find___pos___u
push 0x77b084
call fcn.0042e634
add esp, 0xc
push ebx
push 0
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407b80
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x50b757
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x64]
call fcn.004179fb
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb4]
push 0
push 1
call fcn.00401d60
lea ecx, [ebp - 0x64]
call fcn.0041df2f
cmp dword [ebp - 0x50], 0
je 0x50b7c3
cmp dword [ebp - 0x4c], 8
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x9c]
cmovae eax, dword [ebp - 0x60]
push eax
call fcn.0041d41a
mov byte [ebp - 4], 7
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xc0]
call fcn.00423fa8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9c]
call fcn.0041786a
lea eax, [ebx + 1]
push eax
push 0
lea ecx, [ebp - 0x28]
call fcn.00401c10
jmp 0x50b6f7
lea ecx, [ebp - 0x2c]
call fcn.0041df2f
cmp dword [0x7960fc], 0
jle 0x50b805
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x6ee8b0
push 0x77b084
call fcn.0042e634
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x50b84d
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x9c]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0041d41a
mov byte [ebp - 4], 8
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 0xc0]
lea ecx, [ebp - 0xc0]
call fcn.00423fa8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9c]
call fcn.0041786a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
call fcn.0041786a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x64]
call fcn.0041786a
push 1
push esi
call fcn.0056df27
pop ecx
pop ecx
cmp dword [0x7960fc], 0
jle 0x50b887
push str._winInvalidEnvironmentPath__Error
mov ecx, 0x77b084
call fcn.0042e683
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call ebx
cmp dword [0x7960fc], 0
jle 0x50b8aa
push str._winInvalidEnvironmentPath__step_7
push 0x77b084
call fcn.0042e634
pop ecx
pop ecx
mov eax, dword [ebp - 0xc0]
mov esi, dword [eax]
cmp esi, eax
je 0x50b977
lea edi, [esi + 0xc]
cmp dword [edi + 0x14], 8
jb 0x50b8c7
mov eax, dword [edi]
jmp 0x50b8c9
mov eax, edi
lea ecx, [ebp - 0x44]
push ecx
push eax
push 0
call fcn.004552fa
add esp, 0xc
cmp dword [0x7960fc], 0
jle 0x50b8ff
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
push str._winInvalidEnvironmentPath__step_7_loop_ConvertEVPath___s
push 0x77b084
call fcn.0042e634
add esp, 0xc
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x50b94f
cmp dword [0x7960fc], 0
jle 0x50b92f
push str._winInvalidEnvironmentPath__step_7_loop_PathFileExists:_OK
push 0x77b084
call fcn.0042e634
pop ecx
pop ecx
cmp dword [edi + 0x14], 8
jb 0x50b937
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x80]
call fcn.00419c79
push 0x6ee954
lea ecx, [ebp - 0x80]
call fcn.00419c79
jmp 0x50b969
cmp dword [0x7960fc], 0
jle 0x50b969
push str._winInvalidEnvironmentPath__step_7_loop_PathFileExists:_Failed
push 0x77b084
call fcn.0042e634
pop ecx
pop ecx
mov esi, dword [esi]
cmp esi, dword [ebp - 0xc0]
jne 0x50b8ba
cmp dword [0x7960fc], 0
mov edi, 0x77b084
jle 0x50b992
push str._winInvalidEnvironmentPath__step_8
push edi
call fcn.0042e634
pop ecx
pop ecx
push 0x20006
push str.HKEY_LOCAL_MACHINESystemCurrentControlSetControlSession_ManagerEnvironment
call fcn.00567b83
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x50ba5a
cmp dword [0x7960fc], 0
jle 0x50b9c3
push str._winInvalidEnvironmentPath__step_9
push edi
call fcn.0042e634
pop ecx
pop ecx
cmp dword [ebp - 0x68], 8
lea ecx, [ebp - 0x7c]
mov eax, dword [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x7c]
add eax, eax
push eax
push ecx
push 2
push 0
push str.Path
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x50ba25
cmp dword [0x7960fc], eax
jle 0x50b9fe
push str._winInvalidEnvironmentPath__step_10
push edi
call fcn.0042e634
pop ecx
pop ecx
and dword [0x7e6f70], 0
push 0x7e6f70
push 0x1388
push 2
push str.Environment
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
cmp dword [0x7960fc], 0
jle 0x50ba3b
push str._winInvalidEnvironmentPath__step_11
push edi
call fcn.0042e634
pop ecx
pop ecx
push esi
call ebx
jmp 0x50ba5a
cmp dword [0x7960fc], 0
jle 0x50ba70
mov edi, 0x77b084
push 0x6ee958
mov ecx, edi
call fcn.0042e683
cmp dword [0x7960fc], 0
jle 0x50ba70
push str._winInvalidEnvironmentPath__End
push edi
call fcn.0042e634
pop ecx
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc0]
call fcn.004246c9
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0041786a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.0041786a
xor eax, eax
inc eax
call fcn.0056e1e5
ret