Function at 0x4fbfd0
Capabilities:
Delete registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58dfb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0x3084]
push esi
mov eax, dword [ebx]
lea esi, [ebx + 0x3084]
push edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x10], esp
push 0x1e
push ecx
mov ecx, ebx
mov dword [ebp - 4], 0
call dword [eax + 0x14]
mov edi, eax
mov eax, dword [ebx + 0x308c]
mov ecx, dword [eax + 0x38]
test ecx, ecx
je 0x4fc042
lea ecx, [eax + 0x48]
call fcn.004e8970
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x4fc0b0
mov dword [ebp - 0x2c], 0
push edi
mov ecx, ebx
call fcn.004ea530
test eax, eax
jne 0x4fc0a8
mov eax, dword [ebp - 0x2c]
inc eax
cmp eax, 5
mov dword [ebp - 0x2c], eax
jg 0x4fc0a8
mov edx, dword [ebx]
push esi
mov ecx, ebx
call dword [edx + 0x10]
mov ecx, dword [esi]
mov eax, dword [ebx]
push 0x1e
push ecx
mov ecx, ebx
call dword [eax + 0x14]
mov edi, eax
mov eax, dword [ebx + 0x308c]
mov ecx, dword [eax + 0x38]
test ecx, ecx
je 0x4fc04d
lea ecx, [eax + 0x48]
call fcn.004e8970
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
jne 0x4fc45a
mov dword [ebx + 0x30c0], 1
mov edx, dword [ebx + 0x80]
mov esi, 2
cmp dword [edx + 0x24], esi
jne 0x4fc17e
mov eax, dword [ebx + 0xa4]
cmp dword [eax], 0
je 0x4fc124
push 1
mov ecx, ebx
call fcn.004fdb20
test eax, eax
jne 0x4fd1b4
cmp dword [ebx + 0x30cc], 0xc8
je 0x4fc11d
mov ecx, dword [ebx + 0x30b0]
push ecx
mov ecx, dword [ebx + 0x6c]
call fcn.004ec300
mov eax, 0x756d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x5c], 0x10
mov edx, dword [ebx + 0x31a0]
lea esi, [ebx + 0x3184]
push esi
push edx
mov ecx, ebx
call fcn.00534860
test eax, eax
jne 0x4fd1b4
mov ecx, dword [ebx + 0x80]
lea eax, [ebx + 0x3194]
lea edi, [ebx + 0x318c]
push 1
mov edx, dword [ecx]
push eax
mov eax, dword [ebx + 0x3084]
push edi
push edx
push esi
push eax
mov ecx, ebx
call fcn.00534c10
test eax, eax
jne 0x4fd1b4
push edi
mov ecx, ebx
call fcn.005354e0
mov esi, 2
mov edi, dword [ebp + 8]
test edi, edi
je 0x4fc18e
mov ecx, ebx
call fcn.004fd4d0
jmp 0x4fc197
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 0x1c]
test eax, eax
jne 0x4fd1b4
push edi
mov ecx, ebx
call fcn.004fd1d0
test eax, eax
mov dword [ebp - 0x2c], eax
jne 0x4fc210
cmp dword [ebx + 0x30cc], 0xce
jne 0x4fc210
mov edi, dword [ebx + 0x30d8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4fc210
mov eax, dword [ebx + 0x80]
push str.sciencedirect.com
mov ecx, dword [eax]
push ecx
call fcn.0054e0f0
add esp, 8
test eax, eax
je 0x4fc210
cmp dword [ebx + 0x3080], esi
je 0x4fc210
mov ecx, dword [ebx + 0x308c]
test ecx, ecx
je 0x4fc1fe
mov edx, dword [ecx]
push esi
call dword [edx + 0xc]
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebx + 0x3080], esi
call dword [eax + 0x18]
jmp 0x4fcf74
cmp dword [ebx + 0x30cc], 0xc8
jne 0x4fc340
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
or ecx, eax
jne 0x4fc340
mov eax, dword [ebx + 0x24]
xor edi, edi
cmp eax, edi
jg 0x4fc342
jl 0x4fc246
cmp dword [ebx + 0x20], edi
ja 0x4fc342
mov al, byte [ebx + 0x3091]
test al, al
jne 0x4fc342
mov eax, dword [ebx + 0x30f0]
mov ecx, dword [ebx + 0x30f4]
mov edx, eax
or edx, ecx
je 0x4fc342
mov edx, dword [ebx + 0x30e0]
add eax, 1
adc ecx, edi
cmp eax, edx
jne 0x4fc342
cmp ecx, dword [ebx + 0x30e4]
jne 0x4fc342
mov esi, 0x7542
mov eax, dword [0x639ad4]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
push edi
push ecx
mov ecx, dword [ebx + 0x80]
mov byte [ebp - 4], 1
call fcn.005080e0
mov edx, dword [ebp - 0x18]
push edx
call fcn.0045f9c0
add esp, 4
cmp esi, 0x7565
je 0x4fc2ca
cmp esi, 0x7542
jne 0x4fc3c4
mov ecx, dword [ebx + 0x80]
mov dl, byte [ecx + 0x29c]
test dl, dl
jne 0x4fc36e
test al, al
je 0x4fc36e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x3084]
push eax
mov ecx, ebx
call dword [edx + 0x10]
mov edi, eax
test edi, edi
jne 0x4fc44e
mov eax, dword [ebx + 0x80]
mov ecx, dword [ebp + 8]
push ecx
mov byte [eax + 0x29c], 1
mov ecx, ebx
call fcn.004fbfd0
mov esi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.0056a100
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor edi, edi
mov esi, dword [ebp - 0x2c]
cmp esi, edi
je 0x4fc4cf
cmp esi, 0x7563
jne 0x4fc28e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x7542
jne 0x4fc3c4
cmp dword [ebp + 8], edi
jne 0x4fc3c4
cmp dword [ebx + 0x24], edi
jl 0x4fc3d8
jg 0x4fc387
cmp dword [ebx + 0x20], edi
jbe 0x4fc3c4
cmp dword [ecx + 0x294], edi
je 0x4fc3c4
mov edx, dword [ebx + 0x308c]
mov eax, dword [edx + 0x64]
push eax
push edi
call fcn.0052e9f0
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x3084]
push eax
mov ecx, ebx
call dword [edx + 0x10]
mov edi, eax
test edi, edi
jne 0x4fc44e
push eax
jmp 0x4fc316
cmp dword [ebx + 0x24], edi
jg 0x4fc478
jl 0x4fc3d8
cmp dword [ebx + 0x20], edi
ja 0x4fc478
mov al, byte [ebx + 0x3091]
test al, al
jne 0x4fc478
cmp esi, 0x7565
je 0x4fc40e
cmp esi, 0x7566
je 0x4fc40e
cmp esi, 0x7542
je 0x4fc40e
cmp esi, 0x756e
je 0x4fc40e
cmp esi, 0x755e
jne 0x4fc478
mov eax, dword [ebx + 0x80]
mov byte [ebx + 0x3090], 1
mov byte [ebx + 0x3091], 1
mov cl, byte [eax + 0x2ab]
test cl, cl
je 0x4fc433
mov byte [eax + 0x2ad], 1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x3084]
push eax
mov ecx, ebx
call dword [edx + 0x10]
mov edi, eax
test edi, edi
je 0x4fc46f
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.0056a100
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
jmp 0x4fc316
mov ecx, dword [ebx + 0x3094]
cmp ecx, edi
je 0x4fc31f
call fcn.0051ba40
test al, al
jne 0x4fc31f
mov eax, dword [ebx + 0x80]
mov cl, byte [eax + 0x2ac]
test cl, cl
je 0x4fc31f
mov cl, byte [eax + 0x2ad]
test cl, cl
jne 0x4fc31f
mov cl, byte [eax + 0x2ae]
test cl, cl
jne 0x4fc31f
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.0056a100
cmp dword [ebx + 0x3094], edi
je 0x4fcc14
mov ecx, dword [ebx + 0x80]
mov eax, dword [ecx + 0xbc]
cmp eax, edi
jne 0x4fc4f7
cmp esi, edi
je 0x4fcc14
cmp eax, edi
je 0x4fc50d
push str.text_html
push eax
call fcn.00556b60
add esp, 8
test eax, eax
sete byte [ebp - 0x11]
jmp 0x4fc511
mov byte [ebp - 0x11], 0
mov ecx, dword [ebx + 0x3094]
call fcn.0051ba40
test al, al
jne 0x4fcc14
mov eax, dword [ebx + 0x80]
mov cl, byte [eax + 0x2ac]
test cl, cl
je 0x4fcc14
mov cl, byte [eax + 0x2ad]
test cl, cl
jne 0x4fcc14
mov cl, byte [eax + 0x2ae]
test cl, cl
jne 0x4fcc14
mov al, byte [ebp - 0x11]
test al, al
jne 0x4fc563
cmp esi, edi
je 0x4fcc14
mov eax, dword [0x639ad4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x3c], edi
mov word [ebp - 0x40], di
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x34]
push ecx
lea eax, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
push ecx
mov ecx, dword [ebx + 0x3094]
lea eax, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 7
call fcn.0051b960
test al, al
je 0x4fcbcc
mov ecx, dword [ebx + 0x80]
mov byte [ecx + 0x2ad], 1
mov edx, dword [ebx + 0x80]
mov byte [edx + 0x2ab], 1
mov eax, dword [ebx + 0x80]
mov byte [eax + 0x2ae], 1
mov ecx, dword [ebx + 0x3094]
call fcn.0051b930
mov eax, dword [ebx + 0x80]
mov ecx, dword [ebp - 0x34]
mov dword [eax + 0x24], ecx
mov eax, dword [ebx + 0x80]
mov edx, dword [ebp - 0x38]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x28]
mov esi, dword [ebx + 0x80]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
test eax, eax
je 0x4fc61d
push eax
call fcn.005664c5
add esp, 4
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0056649c
mov edx, eax
add esp, 4
test edx, edx
mov dword [esi], edx
jne 0x4fc6a6
push str.URL::set_serverName__:_Not_enough_memory__n
mov ecx, esi
call fcn.0052a8b0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.0056a100
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.0056a100
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.0056a100
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0056a100
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0056a100
mov eax, 0x753b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x80]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 4]
test eax, eax
je 0x4fc6e2
push eax
call fcn.005664c5
add esp, 4
xor edx, edx
cmp esi, edx
jne 0x4fc6ed
mov dword [edi + 4], edx
jmp 0x4fc74c
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4fc703
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], edx
jmp 0x4fc74c
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0056649c
mov ecx, dword [ebp - 0x18]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 4], edx
jne 0x4fc72d
push str.URL::set_serverPath__:_Not_enough_memory__n
jmp 0x4fc641
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x80]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [eax + 8]
test eax, eax
je 0x4fc768
push eax
call fcn.005664c5
add esp, 4
mov cl, byte [0x63e040]
test esi, esi
mov byte [ebp - 0x11], cl
jne 0x4fc778
lea esi, [ebp - 0x11]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0056649c
mov ecx, dword [ebp - 0x18]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 8], edx
jne 0x4fc7a2
push str.URL::set_fileName__:_Not_enough_memory__n
jmp 0x4fc641
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x80]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x4fc7dd
push eax
call fcn.005664c5
add esp, 4
xor edx, edx
cmp esi, edx
jne 0x4fc7e8
mov dword [edi + 0x1c], edx
jmp 0x4fc849
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4fc7fe
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x1c], edx
jmp 0x4fc849
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0056649c
mov ecx, dword [ebp - 0x18]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 0x1c], edx
jne 0x4fc82a
push str.URL::set_Cookie__:_Not_enough_memory__n
call fcn.0052a8b0
jmp 0x4fc849
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x80]
push 0x63e040
add ecx, 0xc4
call fcn.0056a289
mov ecx, dword [ebx + 0x80]
mov byte [ecx + 0x2a1], 0
mov esi, dword [ebx + 0x80]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x4fc882
push eax
call fcn.005664c5
add esp, 4
mov edx, 0x63e040
test edx, edx
jne 0x4fc890
mov dword [esi + 0x18], edx
jmp 0x4fc8f6
mov edi, 0x63e040
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4fc8a6
mov dword [esi + 0x18], eax
jmp 0x4fc8f6
mov edi, 0x63e040
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0056649c
mov edx, eax
add esp, 4
test edx, edx
mov dword [esi + 0x18], edx
jne 0x4fc8d4
push str.URL::set_Referer__:_Not_enough_memory__n
mov ecx, esi
call fcn.0052a8b0
jmp 0x4fc8f6
mov edi, 0x63e040
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x308c]
test eax, eax
je 0x4fc939
mov eax, dword [eax + 0x64]
test eax, eax
je 0x4fc939
mov ecx, dword [ebx + 0x80]
mov edx, dword [ecx + 0x330]
test edx, edx
jne 0x4fc91d
push eax
call fcn.0052e8c0
mov ecx, dword [ebx + 0x80]
mov eax, dword [ecx + 0x330]
test eax, eax
je 0x4fc939
push str.Referer
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x4fc943
lea eax, [ebp - 0x40]
push eax
call fcn.0054e46e
add esp, 4
test eax, eax
je 0x4fc9ab
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x4fc95a
lea eax, [ebp - 0x40]
mov ecx, dword [ebx + 0x80]
push eax
call fcn.0052d510
mov eax, dword [ebx + 0x308c]
test eax, eax
je 0x4fc9ab
mov eax, dword [eax + 0x64]
test eax, eax
je 0x4fc983
mov ecx, dword [ebx + 0x80]
push eax
call fcn.0052ba60
mov eax, dword [ebx + 0x308c]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4fc9ab
mov edx, dword [eax + 0x64]
mov eax, dword [ecx]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edx
push 0x13c9
push 0x111
push eax
call esi
jmp 0x4fc9b1
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebx + 0x80]
push 0x63e040
mov byte [ecx + 0x167], 1
mov ecx, dword [ebx + 0x80]
add ecx, 0x154
call fcn.0056a289
mov edx, dword [ebx + 0x80]
mov byte [edx + 0x150], 0
mov eax, dword [ebx + 0x80]
mov byte [eax + 0x2a3], 0
mov ecx, dword [ebx + 0x80]
push ecx
mov byte [ebx + 0x90], 0
call fcn.004b4d10
add esp, 4
mov ecx, ebx
call fcn.004f8b10
mov eax, dword [ebx + 0x7c]
test eax, eax
jne 0x4fca8d
mov edx, dword [ebx + 0x70]
mov eax, dword [edx]
mov eax, dword [eax]
test eax, eax
je 0x4fca2c
push 0
push 0x1390
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x308c]
test eax, eax
je 0x4fca8d
mov eax, dword [eax + 0x64]
test eax, eax
je 0x4fca8d
mov ecx, dword [ebx + 0x80]
push 0
push 0
push eax
call fcn.0052b680
mov eax, dword [ebx + 0x308c]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4fca6d
mov edx, dword [eax + 0x64]
mov eax, dword [ecx]
push edx
push 0x1395
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x308c]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x4fca8d
mov edx, dword [eax + 0x64]
mov eax, dword [ecx]
push edx
push 0x1395
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x30c4]
mov byte [ebp - 4], 8
push eax
call fcn.005664c5
add esp, 4
jmp 0x4fcaab
mov ecx, dword [ebx + 0x80]
mov dword [ebp - 4], 7
mov dword [ebx + 0x30c4], 0
call fcn.0052d8f0
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov eax, dword [ebx]
lea ecx, [ebx + 0x3084]
push ecx
mov ecx, ebx
call dword [eax + 0x10]
mov esi, eax
test esi, esi
jne 0x4fcb6f
mov edx, dword [ebp + 8]
mov ecx, ebx
push edx
call fcn.004fbfd0
mov esi, eax
test esi, esi
jne 0x4fcb6f
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 0xbc]
test eax, eax
je 0x4fcb6f
push str.text_html
push eax
call fcn.00556b60
add esp, 8
test eax, eax
je 0x4fcb6f
mov eax, dword [ebx + 0x308c]
test eax, eax
je 0x4fcb6f
mov eax, dword [eax + 0x64]
test eax, eax
je 0x4fcb6f
mov ecx, dword [ebx + 0x80]
mov edx, dword [ecx + 0x330]
test edx, edx
jne 0x4fcb40
push eax
call fcn.0052e8c0
mov ebx, dword [ebx + 0x80]
mov eax, dword [ebx + 0x330]
test eax, eax
je 0x4fcb6f
lea ecx, [ebp + 8]
push 4
push ecx
push 4
push 0
mov edx, eax
push str.noSyntRef
push edx
mov dword [ebp + 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.0056a100
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.0056a100
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.0056a100
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0056a100
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0056a100
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 6
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.0056a100
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.0056a100
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.0056a100
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0056a100
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.0056a100
mov esi, dword [ebx + 0x30cc]
cmp esi, 0xc8
jne 0x4fcc3e
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
or eax, ecx
jne 0x4fcc3e
mov ecx, dword [ebx + 0x30e0]
mov edx, dword [ebx + 0x30e4]
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], edx
cmp esi, 0xce
jne 0x4fccf0
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
or eax, ecx
jne 0x4fcc8c
mov eax, dword [ebx + 0x24]
test eax, eax
jg 0x4fcc8c
jl 0x4fcc64
mov eax, dword [ebx + 0x20]
test eax, eax
ja 0x4fcc8c
mov eax, dword [ebx + 0x30e0]
mov ecx, dword [ebx + 0x30e4]
mov edx, eax
or edx, ecx
je 0x4fcc8c
mov edx, dword [ebx + 0x30f0]
mov edi, dword [ebx + 0x30f4]
or edx, edi
jne 0x4fcc8c
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], ecx
cmp esi, 0xce
jne 0x4fccf0
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
or eax, ecx
jne 0x4fccf0
mov eax, dword [ebx + 0x24]
test eax, eax
jg 0x4fccde
jl 0x4fccae
mov eax, dword [ebx + 0x20]
test eax, eax
ja 0x4fccde
mov edi, dword [ebx + 0x30f0]
mov ecx, dword [ebx + 0x30f4]
mov edx, edi
or edx, ecx
je 0x4fccde
mov eax, dword [ebx + 0x30e4]
mov edx, dword [ebx + 0x30e0]
cmp ecx, eax
jg 0x4fccde
jl 0x4fccd6
cmp edi, edx
jae 0x4fccde
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], eax
jmp 0x4fccf0
mov eax, dword [ebx + 0x30f0]
mov ecx, dword [ebx + 0x30f4]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], ecx
cmp esi, 0xc8
je 0x4fcd00
cmp esi, 0xce
jne 0x4fcd26
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
or edx, eax
jne 0x4fcd26
mov eax, dword [ebx + 0x310c]
mov ecx, dword [ebx + 0x3108]
test eax, eax
jl 0x4fcd26
jg 0x4fcd20
test ecx, ecx
jbe 0x4fcd26
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
mov ecx, edx
or ecx, eax
je 0x4fcdf7
mov edi, dword [ebx + 0x308c]
mov eax, dword [edi + 0x78]
mov ecx, dword [edi + 0x7c]
mov esi, eax
or esi, ecx
je 0x4fcdf7
cmp eax, edx
jne 0x4fcd59
cmp ecx, dword [ebx + 0x1c]
je 0x4fcdf7
mov edx, dword [edi + 0x70]
mov esi, dword [edi + 0x74]
or edx, esi
je 0x4fcdf7
mov dl, byte [ebx + 0x30d4]
test dl, dl
jne 0x4fcdf7
cmp dword [ebx + 0x30cc], 0xce
jne 0x4fcdb7
mov edx, dword [ebx + 0x30f0]
mov esi, dword [ebx + 0x30f4]
sub eax, 1
sbb ecx, 0
cmp edx, eax
jne 0x4fcdb7
cmp esi, ecx
jne 0x4fcdb7
mov eax, dword [ebx + 0x30f8]
mov ecx, dword [ebx + 0x30fc]
or eax, ecx
jne 0x4fcdb7
mov dword [ebx + 0x30f8], edx
mov dword [ebx + 0x30fc], esi
mov esi, dword [ebx + 0x30f8]
mov eax, dword [ebx + 0x30fc]
mov ecx, esi
or ecx, eax
je 0x4fcef8
mov edx, dword [edi + 0x78]
mov edi, dword [edi + 0x7c]
mov eax, edx
mov ecx, edi
sub eax, 1
sbb ecx, 0
cmp esi, eax
jne 0x4fcef8
cmp dword [ebx + 0x30fc], ecx
jne 0x4fcef8
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edi
mov al, byte [ebx + 0x30d4]
test al, al
jne 0x4fcfef
mov eax, dword [ebx + 0x80]
xor esi, esi
mov edx, dword [eax + 0xbc]
cmp edx, esi
je 0x4fcfc7
mov eax, dword [eax + 0xfc]
or ecx, 0xffffffff
mov dword [ebp - 0x18], eax
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4fcfc7
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4fcfc7
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x18]
not ecx
dec ecx
push ecx
push edx
push eax
call fcn.0055e640
add esp, 0xc
test eax, eax
je 0x4fcfc7
mov ecx, dword [ebx + 0x80]
push 9
push str.text_html
mov eax, dword [ecx + 0xfc]
push eax
call fcn.005501e0
add esp, 0xc
test eax, eax
jne 0x4fceab
mov edx, dword [ebx + 0x80]
push 9
push str.text_html
mov eax, dword [edx + 0xbc]
push eax
call fcn.005501e0
add esp, 0xc
test eax, eax
jne 0x4fcfc7
mov ecx, dword [ebx + 0x308c]
cmp dword [ecx + 0xd4], esi
je 0x4fcfa8
mov eax, dword [ebx + 0x80]
mov dl, byte [eax + 0x2b0]
test dl, dl
jne 0x4fcedb
mov dl, byte [eax + 0x14d]
test dl, dl
je 0x4fcfa8
mov edx, dword [ecx + 0x74]
lea eax, [ecx + 0x70]
mov ecx, dword [ecx + 0x70]
or ecx, edx
je 0x4fcfc7
mov byte [ebx + 0x30d4], 1
jmp 0x4fcfc7
mov eax, dword [ebx + 0x308c]
mov ecx, dword [eax + 0xd4]
test ecx, ecx
je 0x4fcf2e
mov eax, dword [ebx + 0x80]
mov cl, byte [eax + 0x2b0]
test cl, cl
jne 0x4fcf22
mov cl, byte [eax + 0x14d]
test cl, cl
je 0x4fcf2e
mov byte [ebx + 0x30d4], 1
jmp 0x4fcdf7
mov eax, dword [ebx + 0x24]
test eax, eax
jg 0x4fcfa8
jl 0x4fcf3e
mov eax, dword [ebx + 0x20]
test eax, eax
ja 0x4fcfa8
mov al, byte [ebx + 0x3091]
test al, al
jne 0x4fcfa8
mov eax, dword [ebx + 0x80]
mov byte [ebx + 0x3090], 1
mov byte [ebx + 0x3091], 1
mov cl, byte [eax + 0x2ab]
test cl, cl
je 0x4fcf6d
mov byte [eax + 0x2ad], 1
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x3084]
push eax
mov ecx, ebx
call dword [edx + 0x10]
test eax, eax
jne 0x4fd1b4
mov eax, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.004fbfd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov eax, 0x757a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebx + 0x30d4]
test al, al
jne 0x4fcff1
mov edx, dword [ebx + 0x30a0]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4fcff1
push edx
mov ecx, ebx
call fcn.00501ee0
jmp 0x4fcff1
xor esi, esi
push 0x63e040
lea ecx, [ebx + 0x30a0]
call fcn.0056a289
mov al, byte [ebx + 0x30d4]
test al, al
je 0x4fd147
lea ecx, [ebx + 0x10]
mov byte [ebx + 0x30d4], 0
call fcn.004ec460
mov eax, dword [ebx + 0x308c]
mov ecx, dword [eax + 0x5c]
cmp ecx, esi
lea ecx, [eax + 0x48]
setne byte [ebp - 0x11]
call fcn.004e50b0
mov eax, dword [ebx + 0x308c]
mov dword [eax + 0x70], esi
mov dword [eax + 0x74], esi
mov ecx, dword [ebx + 0x308c]
mov dword [ecx + 0x78], esi
mov dword [ecx + 0x7c], esi
mov edx, dword [ebx + 0x308c]
mov ecx, ebx
mov dword [edx + 0x120], esi
mov dword [edx + 0x124], esi
mov eax, dword [ebx]
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x30e0], esi
mov dword [ebx + 0x30e8], esi
mov dword [ebx + 0x30f0], esi
mov dword [ebx + 0x30f8], esi
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x3108], esi
mov dword [ebx + 0x30d0], esi
mov dword [ebx + 0x60], esi
mov dword [ebx + 0x24], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x3c], esi
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x30e4], esi
mov dword [ebx + 0x30ec], esi
mov dword [ebx + 0x30f4], esi
mov dword [ebx + 0x30fc], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x310c], esi
call dword [eax + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x3084]
push eax
mov ecx, ebx
call dword [edx + 0x10]
cmp eax, esi
jne 0x4fd1b4
mov eax, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.004fbfd0
mov edi, eax
cmp edi, esi
je 0x4fd109
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebp - 0x11]
test al, al
je 0x4fd12b
mov ecx, dword [ebx + 0x80]
mov edx, dword [ecx + 0x30]
mov ecx, dword [ebx + 0x308c]
push edx
push ebx
add ecx, 0x48
call fcn.004e51b0
mov edi, eax
mov ecx, ebx
call fcn.004ebbc0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x5c], 6
mov dword [ebx + 0x78], esi
mov eax, dword [0x63f3e8]
push 1
push eax
mov ecx, ebx
call fcn.004e9db0
cmp dword [ebx + 0x7c], esi
jne 0x4fd189
mov ebx, dword [ebx + 0x308c]
mov eax, dword [ebx + 0x18]
cmp eax, esi
je 0x4fd189
mov ecx, dword [ebx + 0x64]
mov edx, dword [eax]
push ecx
push 0x13f8
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4