Function at 0x5b1fa0
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6148dd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x69c
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0xff
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
mov ecx, 0xe4d8bf28
push ecx
lea ecx, [ebp - 0x631]
call fcn.005be580
mov dword [ebp - 0x68c], eax
mov edx, dword [ebp - 0x68c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x631]
call fcn.005b4000
cmp dword [ebp - 0x120], 0
jne 0x5b2272
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, 0xe0444a10
push eax
lea ecx, [ebp - 0x63c]
call fcn.005be600
mov dword [ebp - 0x690], eax
mov ecx, dword [ebp - 0x690]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x63c]
call fcn.005b3ee0
cmp dword [ebp - 0x120], 0
jne 0x5b2272
mov eax, 0xe1d3c7a2
push eax
lea ecx, [ebp - 0x65e]
call fcn.005be680
mov dword [ebp - 0x694], eax
mov ecx, dword [ebp - 0x694]
mov dword [ebp - 0x698], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x698]
push edx
lea ecx, [ebp - 0x174]
call fcn.00416410
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x65e]
call fcn.005c6bc0
push 0x718da960
lea ecx, [ebp - 0x669]
call fcn.005be700
mov dword [ebp - 0x69c], eax
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x6a0], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x6a0]
push ecx
lea edx, [ebp - 0x174]
push edx
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x688]
push ecx
call fcn.00423920
add esp, 0xc
mov dword [ebp - 0x6a4], eax
mov edx, dword [ebp - 0x6a4]
mov dword [ebp - 0x6a8], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x6a8]
push eax
lea ecx, [ebp - 0x13c]
push ecx
call fcn.00596ec0
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x688]
call fcn.00416470
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x669]
call fcn.005b3ee0
lea edx, [ebp - 0x174]
push edx
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x158]
push ecx
call fcn.00423920
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x13c]
call fcn.00416460
test eax, eax
je 0x5b2242
push 1
lea ecx, [ebp - 0x204]
call fcn.00421da0
mov byte [ebp - 4], 9
push 0x40
push 1
lea ecx, [ebp - 0x13c]
call fcn.00416460
push eax
lea ecx, [ebp - 0x204]
call fcn.00421f40
lea ecx, [ebp - 0x204]
call fcn.005b4030
movzx edx, al
test edx, edx
je 0x5b2233
mov eax, dword [ebp - 0x204]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x204]
call fcn.005b2290
movzx edx, al
test edx, edx
jne 0x5b2228
lea eax, [ebp - 0x604]
push eax
lea ecx, [ebp - 0x204]
push ecx
call fcn.005be780
add esp, 8
lea edx, [ebp - 0x604]
push edx
call sub.MSVCR90.dll_remove
add esp, 4
lea ecx, [ebp - 0x13c]
call fcn.00416460
push eax
call sub.MSVCR90.dll_remove
add esp, 4
lea ecx, [ebp - 0x204]
call fcn.00421f90
jmp 0x5b21c6
push 0x21a
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x204]
call fcn.004208f0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x158]
call fcn.00416470
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x13c]
call fcn.00416470
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.00416470
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret