Function at 0x522880
Capabilities:
Delete registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c7108
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0x30c4]
push esi
lea esi, [ebx + 0x30c4]
push edi
xor eax, eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
mov eax, dword [ebx]
push 0x1e
push ecx
mov ecx, ebx
mov dword [ebp - 0x30], ebx
call dword [eax + 0x14]
mov edi, eax
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x38]
test ecx, ecx
je 0x5228f3
lea ecx, [eax + 0x48]
call fcn.0050c900
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x522972
mov dword [ebp - 0x2c], 0
push edi
mov ecx, ebx
call fcn.0050e760
test eax, eax
jne 0x522959
mov eax, dword [ebp - 0x2c]
inc eax
cmp eax, 5
mov dword [ebp - 0x2c], eax
jg 0x522959
mov edx, dword [ebx]
push esi
mov ecx, ebx
call dword [edx + 0x10]
mov ecx, dword [esi]
mov eax, dword [ebx]
push 0x1e
push ecx
mov ecx, ebx
call dword [eax + 0x14]
mov edi, eax
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x38]
test ecx, ecx
je 0x5228fe
lea ecx, [eax + 0x48]
call fcn.0050c900
mov eax, 0x7540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x522972
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x3108], 1
mov eax, dword [ebx + 0x84]
test eax, eax
je 0x52298b
mov eax, dword [eax + 0x10]
jmp 0x522994
mov edx, dword [ebx + 0x80]
mov eax, dword [edx + 0x24]
cmp eax, 2
jne 0x522a65
mov eax, dword [ebx + 0xb0]
cmp dword [eax], 0
je 0x5229f3
push 1
mov ecx, ebx
call fcn.00524600
test eax, eax
jne 0x523b8e
cmp dword [ebx + 0x3114], 0xc8
je 0x5229ec
mov ecx, dword [ebx + 0x30f8]
push ecx
mov ecx, dword [ebx + 0x6c]
call fcn.005113f0
mov eax, 0x756d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x5c], 0x10
mov edx, dword [ebx + 0x3238]
lea esi, [ebx + 0x31e4]
push esi
push edx
mov ecx, ebx
call fcn.00569bc0
test eax, eax
jne 0x523b8e
mov eax, dword [ebx + 0x84]
test eax, eax
jne 0x522a20
mov eax, dword [ebx + 0x80]
mov eax, dword [eax]
mov edx, dword [ebx + 0x30c4]
lea ecx, [ebx + 0x31f4]
lea edi, [ebx + 0x31ec]
push 1
push ecx
push edi
push eax
push esi
push edx
mov ecx, ebx
call fcn.0056a000
test eax, eax
je 0x522a5d
cmp eax, 0x757e
jne 0x523b8e
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
jmp 0x5238f1
push edi
mov ecx, ebx
call fcn.0056ab40
mov esi, dword [ebp + 8]
test esi, esi
je 0x522a75
mov ecx, ebx
call fcn.00523eb0
jmp 0x522a7e
mov edx, dword [ebx]
push 0
mov ecx, ebx
call dword [edx + 0x1c]
test eax, eax
jne 0x523b8e
push esi
mov ecx, ebx
call fcn.00523bb0
mov esi, eax
test esi, esi
jne 0x522b2e
cmp dword [ebx + 0x3114], 0xce
jne 0x522b2e
mov edi, dword [ebx + 0x3120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x522b2e
mov eax, dword [ebx + 0x84]
test eax, eax
jne 0x522ad9
mov eax, dword [ebx + 0x80]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x34]
call fcn.005a0ccb
or dword [ebp - 0x18], 1
mov eax, dword [eax]
push str.sciencedirect.com
push eax
call fcn.00584910
mov edi, eax
mov al, byte [ebp - 0x18]
add esp, 8
test al, 1
je 0x522afa
lea ecx, [ebp - 0x34]
call fcn.005a0c5d
test edi, edi
je 0x522b2e
cmp dword [ebx + 0x30c0], 2
je 0x522b2e
mov ecx, dword [ebx + 0x30cc]
test ecx, ecx
je 0x522b18
mov edx, dword [ecx]
push 2
call dword [edx + 0xc]
mov eax, dword [ebx]
mov ecx, ebx
mov dword [ebx + 0x30c0], 2
call dword [eax + 0x18]
jmp 0x5238f1
cmp dword [ebx + 0x3114], 0xc8
jne 0x522c40
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
or ecx, eax
jne 0x522c40
mov eax, dword [ebx + 0x24]
xor edi, edi
cmp eax, edi
jg 0x522c42
jl 0x522b64
cmp dword [ebx + 0x20], edi
ja 0x522c42
mov al, byte [ebx + 0x30d1]
test al, al
jne 0x522c42
mov eax, dword [ebx + 0x3140]
mov ecx, dword [ebx + 0x3144]
mov edx, eax
or edx, ecx
je 0x522c42
mov edx, dword [ebx + 0x3130]
add eax, 1
adc ecx, edi
cmp eax, edx
jne 0x522c42
cmp ecx, dword [ebx + 0x3134]
jne 0x522c42
mov esi, 0x7542
mov eax, dword [0x67da2c]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x18]
push edi
push ecx
mov ecx, dword [ebx + 0x80]
mov byte [ebp - 4], 1
call fcn.005305f0
mov edx, dword [ebp - 0x18]
push edx
call fcn.00473300
add esp, 4
cmp esi, 0x7565
je 0x522be8
cmp esi, 0x7542
jne 0x522d1a
mov ecx, dword [ebx + 0x80]
mov dl, byte [ecx + 0x2a8]
test dl, dl
jne 0x522ca6
test al, al
je 0x522ca6
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x30c4]
push eax
mov ecx, ebx
call dword [edx + 0x10]
mov edi, eax
test edi, edi
je 0x522c6b
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005a0c5d
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor edi, edi
cmp esi, edi
je 0x522e25
cmp esi, 0x7563
jne 0x522bac
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x80]
mov ecx, dword [ebp + 8]
push ecx
mov byte [eax + 0x2a8], 1
mov ecx, ebx
call fcn.00522880
mov esi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005a0c5d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp esi, 0x7542
jne 0x522d1a
cmp dword [ebp + 8], edi
jne 0x522d1a
cmp dword [ebx + 0x24], edi
jl 0x522d2e
jg 0x522cbf
cmp dword [ebx + 0x20], edi
jbe 0x522d1a
cmp dword [ecx + 0x2a0], edi
je 0x522d1a
mov edx, dword [ebx + 0x30cc]
mov eax, dword [edx + 0x70]
push eax
push edi
call fcn.00563f10
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x30c4]
push eax
mov ecx, ebx
call dword [edx + 0x10]
mov edi, eax
test edi, edi
je 0x522d13
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005a0c5d
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
jmp 0x522c7c
cmp dword [ebx + 0x24], edi
jg 0x522dce
jl 0x522d2e
cmp dword [ebx + 0x20], edi
ja 0x522dce
mov al, byte [ebx + 0x30d1]
test al, al
jne 0x522dce
cmp esi, 0x7565
je 0x522d64
cmp esi, 0x7566
je 0x522d64
cmp esi, 0x7542
je 0x522d64
cmp esi, 0x756e
je 0x522d64
cmp esi, 0x755e
jne 0x522dce
mov eax, dword [ebx + 0x80]
mov byte [ebx + 0x30d0], 1
mov byte [ebx + 0x30d1], 1
mov cl, byte [eax + 0x2bc]
test cl, cl
je 0x522d89
mov byte [eax + 0x2be], 1
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x30c4]
push eax
mov ecx, ebx
call dword [edx + 0x10]
mov edi, eax
test edi, edi
je 0x522dc5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005a0c5d
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push eax
jmp 0x522c7c
mov ecx, dword [ebx + 0x30d8]
cmp ecx, edi
je 0x522c85
call fcn.00544d90
test al, al
jne 0x522c85
mov eax, dword [ebx + 0x80]
mov cl, byte [eax + 0x2bd]
test cl, cl
je 0x522c85
mov cl, byte [eax + 0x2be]
test cl, cl
jne 0x522c85
mov cl, byte [eax + 0x2bf]
test cl, cl
jne 0x522c85
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005a0c5d
cmp dword [ebx + 0x30d8], edi
je 0x52356a
mov ecx, dword [ebx + 0x80]
mov eax, dword [ecx + 0xbc]
cmp eax, edi
jne 0x522e4d
cmp esi, edi
je 0x52356a
cmp eax, edi
je 0x522e63
push str.text_html
push eax
call fcn.0058dd90
add esp, 8
test eax, eax
sete byte [ebp - 0x11]
jmp 0x522e67
mov byte [ebp - 0x11], 0
mov ecx, dword [ebx + 0x30d8]
call fcn.00544d90
test al, al
jne 0x52356a
mov eax, dword [ebx + 0x80]
mov cl, byte [eax + 0x2bd]
test cl, cl
je 0x52356a
mov cl, byte [eax + 0x2be]
test cl, cl
jne 0x52356a
mov cl, byte [eax + 0x2bf]
test cl, cl
jne 0x52356a
mov al, byte [ebp - 0x11]
test al, al
jne 0x522eb9
cmp esi, edi
je 0x52356a
mov eax, dword [0x67da2c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x40], edi
mov word [ebp - 0x44], di
lea edx, [ebp - 0x48]
lea eax, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x38]
push ecx
lea eax, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
push ecx
mov ecx, dword [ebx + 0x30d8]
lea eax, [ebp - 0x28]
push edx
push eax
mov byte [ebp - 4], 7
call fcn.00544cb0
test al, al
je 0x523522
mov ecx, dword [ebx + 0x80]
mov byte [ecx + 0x2be], 1
mov edx, dword [ebx + 0x80]
mov byte [edx + 0x2bc], 1
mov eax, dword [ebx + 0x80]
mov byte [eax + 0x2bf], 1
mov ecx, dword [ebx + 0x30d8]
call fcn.00544c80
mov eax, dword [ebx + 0x80]
mov ecx, dword [ebp - 0x38]
mov dword [eax + 0x24], ecx
mov eax, dword [ebx + 0x80]
mov edx, dword [ebp - 0x3c]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x28]
mov esi, dword [ebx + 0x80]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
test eax, eax
je 0x522f73
push eax
call fcn.0059d022
add esp, 4
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0059cff9
mov edx, eax
add esp, 4
test edx, edx
mov dword [esi], edx
jne 0x522ffc
push str.URL::set_serverName__:_Not_enough_memory__n
mov ecx, esi
call fcn.0055e850
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.005a0c5d
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.005a0c5d
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005a0c5d
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.005a0c5d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.005a0c5d
mov eax, 0x753b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x80]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 4]
test eax, eax
je 0x523038
push eax
call fcn.0059d022
add esp, 4
xor edx, edx
cmp esi, edx
jne 0x523043
mov dword [edi + 4], edx
jmp 0x5230a2
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x523059
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], edx
jmp 0x5230a2
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0059cff9
mov ecx, dword [ebp - 0x18]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 4], edx
jne 0x523083
push str.URL::set_serverPath__:_Not_enough_memory__n
jmp 0x522f97
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x80]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [eax + 8]
test eax, eax
je 0x5230be
push eax
call fcn.0059d022
add esp, 4
mov cl, byte [0x681f78]
test esi, esi
mov byte [ebp - 0x11], cl
jne 0x5230ce
lea esi, [ebp - 0x11]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0059cff9
mov ecx, dword [ebp - 0x34]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 8], edx
jne 0x5230f8
push str.URL::set_fileName__:_Not_enough_memory__n
jmp 0x522f97
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x80]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edi
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x523133
push eax
call fcn.0059d022
add esp, 4
xor edx, edx
cmp esi, edx
jne 0x52313e
mov dword [edi + 0x1c], edx
jmp 0x52319f
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x523154
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x1c], edx
jmp 0x52319f
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0059cff9
mov ecx, dword [ebp - 0x18]
mov edx, eax
add esp, 4
test edx, edx
mov dword [ecx + 0x1c], edx
jne 0x523180
push str.URL::set_Cookie__:_Not_enough_memory__n
call fcn.0055e850
jmp 0x52319f
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x80]
push 0x681f78
add ecx, 0xc4
call fcn.005a0de6
mov ecx, dword [ebx + 0x80]
mov byte [ecx + 0x2ad], 0
mov esi, dword [ebx + 0x80]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x5231d8
push eax
call fcn.0059d022
add esp, 4
mov edx, 0x681f78
test edx, edx
jne 0x5231e6
mov dword [esi + 0x18], edx
jmp 0x52324c
mov edi, 0x681f78
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x5231fc
mov dword [esi + 0x18], eax
jmp 0x52324c
mov edi, 0x681f78
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0059cff9
mov edx, eax
add esp, 4
test edx, edx
mov dword [esi + 0x18], edx
jne 0x52322a
push str.URL::set_Referer__:_Not_enough_memory__n
mov ecx, esi
call fcn.0055e850
jmp 0x52324c
mov edi, 0x681f78
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x30cc]
test eax, eax
je 0x52328f
mov eax, dword [eax + 0x70]
test eax, eax
je 0x52328f
mov ecx, dword [ebx + 0x80]
mov edx, dword [ecx + 0x3a0]
test edx, edx
jne 0x523273
push eax
call fcn.00563de0
mov ecx, dword [ebx + 0x80]
mov eax, dword [ecx + 0x3a0]
test eax, eax
je 0x52328f
push str.Referer
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x523299
lea eax, [ebp - 0x44]
push eax
call fcn.00584816
add esp, 4
test eax, eax
je 0x523301
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x5232b0
lea eax, [ebp - 0x44]
mov ecx, dword [ebx + 0x80]
push eax
call fcn.00562480
mov eax, dword [ebx + 0x30cc]
test eax, eax
je 0x523301
mov eax, dword [eax + 0x70]
test eax, eax
je 0x5232d9
mov ecx, dword [ebx + 0x80]
push eax
call fcn.00560910
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x523301
mov edx, dword [eax + 0x70]
mov eax, dword [ecx]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edx
push 0x13c9
push 0x111
push eax
call esi
jmp 0x523307
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebx + 0x80]
push 0x681f78
mov byte [ecx + 0x172], 1
mov ecx, dword [ebx + 0x80]
add ecx, 0x15c
call fcn.005a0de6
mov edx, dword [ebx + 0x80]
mov byte [edx + 0x15b], 0
mov eax, dword [ebx + 0x80]
mov byte [eax + 0x2b1], 0
mov ecx, dword [ebx + 0x80]
push ecx
mov byte [ebx + 0x94], 0
call fcn.004d2400
add esp, 4
mov ecx, ebx
call fcn.0051e680
mov eax, dword [ebx + 0x7c]
test eax, eax
jne 0x5233e3
mov edx, dword [ebx + 0x70]
mov eax, dword [edx]
mov eax, dword [eax]
test eax, eax
je 0x523382
push 0
push 0x1478
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x30cc]
test eax, eax
je 0x5233e3
mov eax, dword [eax + 0x70]
test eax, eax
je 0x5233e3
mov ecx, dword [ebx + 0x80]
push 0
push 0
push eax
call fcn.00560310
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x5233c3
mov edx, dword [eax + 0x70]
mov eax, dword [ecx]
push edx
push 0x1395
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x5233e3
mov edx, dword [eax + 0x70]
mov eax, dword [ecx]
push edx
push 0x1395
push 0x111
push eax
call esi
mov eax, dword [ebx + 0x310c]
mov byte [ebp - 4], 8
push eax
call fcn.0059d022
add esp, 4
jmp 0x523401
mov ecx, dword [ebx + 0x80]
mov dword [ebp - 4], 7
mov dword [ebx + 0x310c], 0
call fcn.00562850
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov eax, dword [ebx]
lea ecx, [ebx + 0x30c4]
push ecx
mov ecx, ebx
call dword [eax + 0x10]
mov esi, eax
test esi, esi
jne 0x5234c5
mov edx, dword [ebp + 8]
mov ecx, ebx
push edx
call fcn.00522880
mov esi, eax
test esi, esi
jne 0x5234c5
mov eax, dword [ebx + 0x80]
mov eax, dword [eax + 0xbc]
test eax, eax
je 0x5234c5
push str.text_html
push eax
call fcn.0058dd90
add esp, 8
test eax, eax
je 0x5234c5
mov eax, dword [ebx + 0x30cc]
test eax, eax
je 0x5234c5
mov eax, dword [eax + 0x70]
test eax, eax
je 0x5234c5
mov ecx, dword [ebx + 0x80]
mov edx, dword [ecx + 0x3a0]
test edx, edx
jne 0x523496
push eax
call fcn.00563de0
mov ebx, dword [ebx + 0x80]
mov eax, dword [ebx + 0x3a0]
test eax, eax
je 0x5234c5
lea ecx, [ebp + 8]
push 4
push ecx
push 4
push 0
mov edx, eax
push str.noSyntRef
push edx
mov dword [ebp + 8], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.005a0c5d
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.005a0c5d
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005a0c5d
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.005a0c5d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.005a0c5d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.005a0c5d
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.005a0c5d
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005a0c5d
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.005a0c5d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.005a0c5d
mov esi, dword [ebx + 0x3114]
cmp esi, 0xc8
jne 0x523594
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
or eax, ecx
jne 0x523594
mov ecx, dword [ebx + 0x3130]
mov edx, dword [ebx + 0x3134]
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], edx
cmp esi, 0xce
jne 0x523646
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
or eax, ecx
jne 0x5235e2
mov eax, dword [ebx + 0x24]
test eax, eax
jg 0x5235e2
jl 0x5235ba
mov eax, dword [ebx + 0x20]
test eax, eax
ja 0x5235e2
mov eax, dword [ebx + 0x3130]
mov ecx, dword [ebx + 0x3134]
mov edx, eax
or edx, ecx
je 0x5235e2
mov edx, dword [ebx + 0x3140]
mov edi, dword [ebx + 0x3144]
or edx, edi
jne 0x5235e2
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], ecx
cmp esi, 0xce
jne 0x523646
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
or eax, ecx
jne 0x523646
mov eax, dword [ebx + 0x24]
test eax, eax
jg 0x523634
jl 0x523604
mov eax, dword [ebx + 0x20]
test eax, eax
ja 0x523634
mov edi, dword [ebx + 0x3140]
mov ecx, dword [ebx + 0x3144]
mov edx, edi
or edx, ecx
je 0x523634
mov eax, dword [ebx + 0x3134]
mov edx, dword [ebx + 0x3130]
cmp ecx, eax
jg 0x523634
jl 0x52362c
cmp edi, edx
jae 0x523634
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], eax
jmp 0x523646
mov eax, dword [ebx + 0x3140]
mov ecx, dword [ebx + 0x3144]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], ecx
cmp esi, 0xc8
je 0x523656
cmp esi, 0xce
jne 0x52367c
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
or edx, eax
jne 0x52367c
mov eax, dword [ebx + 0x315c]
mov ecx, dword [ebx + 0x3158]
test eax, eax
jl 0x52367c
jg 0x523676
test ecx, ecx
jbe 0x52367c
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
mov ecx, edx
or ecx, eax
je 0x52375f
mov edi, dword [ebx + 0x30cc]
mov eax, dword [edi + 0x88]
mov ecx, dword [edi + 0x8c]
mov esi, eax
or esi, ecx
je 0x52375f
cmp eax, edx
jne 0x5236b5
cmp ecx, dword [ebx + 0x1c]
je 0x52375f
mov edx, dword [edi + 0x80]
mov esi, dword [edi + 0x84]
or edx, esi
je 0x52375f
mov dl, byte [ebx + 0x311c]
test dl, dl
jne 0x52375f
cmp dword [ebx + 0x3114], 0xce
jne 0x523719
mov edx, dword [ebx + 0x3140]
mov esi, dword [ebx + 0x3144]
sub eax, 1
sbb ecx, 0
cmp edx, eax
jne 0x523719
cmp esi, ecx
jne 0x523719
mov eax, dword [ebx + 0x3148]
mov ecx, dword [ebx + 0x314c]
or eax, ecx
jne 0x523719
mov dword [ebx + 0x3148], edx
mov dword [ebx + 0x314c], esi
mov esi, dword [ebx + 0x3148]
mov eax, dword [ebx + 0x314c]
mov ecx, esi
or ecx, eax
je 0x523869
mov edx, dword [edi + 0x88]
mov edi, dword [edi + 0x8c]
mov eax, edx
mov ecx, edi
sub eax, 1
sbb ecx, 0
cmp esi, eax
jne 0x523869
cmp dword [ebx + 0x314c], ecx
jne 0x523869
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edi
mov al, byte [ebx + 0x311c]
test al, al
jne 0x5239ac
mov eax, dword [ebx + 0x80]
xor esi, esi
mov edx, dword [eax + 0xbc]
cmp edx, esi
je 0x523984
mov eax, dword [eax + 0x100]
or ecx, 0xffffffff
mov dword [ebp - 0x18], eax
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x523984
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x523984
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 0x18]
not ecx
dec ecx
push ecx
push edx
push eax
call fcn.00587c80
add esp, 0xc
test eax, eax
je 0x523984
mov ecx, dword [ebx + 0x80]
push 9
push str.text_html
mov eax, dword [ecx + 0x100]
push eax
call fcn.00586aa0
add esp, 0xc
test eax, eax
jne 0x523813
mov edx, dword [ebx + 0x80]
push 9
push str.text_html
mov eax, dword [edx + 0xbc]
push eax
call fcn.00586aa0
add esp, 0xc
test eax, eax
jne 0x523984
mov ecx, dword [ebx + 0x30cc]
cmp dword [ecx + 0xf4], esi
je 0x523925
mov eax, dword [ebx + 0x80]
mov dl, byte [eax + 0x2c1]
test dl, dl
jne 0x523843
mov dl, byte [eax + 0x158]
test dl, dl
je 0x523925
mov edx, dword [ecx + 0x84]
lea eax, [ecx + 0x80]
mov ecx, dword [ecx + 0x80]
or ecx, edx
je 0x523984
mov byte [ebx + 0x311c], 1
jmp 0x523984
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0xf4]
test ecx, ecx
je 0x52389f
mov eax, dword [ebx + 0x80]
mov cl, byte [eax + 0x2c1]
test cl, cl
jne 0x523893
mov cl, byte [eax + 0x158]
test cl, cl
je 0x52389f
mov byte [ebx + 0x311c], 1
jmp 0x52375f
mov eax, dword [ebx + 0x24]
test eax, eax
jg 0x523965
jl 0x5238b7
mov eax, dword [ebx + 0x20]
test eax, eax
ja 0x523965
mov al, byte [ebx + 0x30d1]
test al, al
jne 0x523965
mov eax, dword [ebx + 0x80]
mov byte [ebx + 0x30d0], 1
mov byte [ebx + 0x30d1], 1
mov cl, byte [eax + 0x2bc]
test cl, cl
je 0x5238ea
mov byte [eax + 0x2be], 1
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x30c4]
push eax
mov ecx, ebx
call dword [edx + 0x10]
test eax, eax
jne 0x523b8e
mov eax, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.00522880
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebx + 0x80]
push 9
push str.text_html
mov eax, dword [edx + 0xbc]
push eax
call fcn.00586aa0
add esp, 0xc
test eax, eax
je 0x523965
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
mov eax, ecx
or eax, edx
je 0x523965
mov eax, dword [ebx + 0x80]
add eax, 0x120
cmp ecx, dword [eax]
jne 0x523965
cmp edx, dword [eax + 4]
je 0x523984
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x18]
mov eax, 0x757a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebx + 0x311c]
test al, al
jne 0x5239ae
mov edx, dword [ebx + 0x30e4]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5239ae
push edx
mov ecx, ebx
call fcn.005293b0
jmp 0x5239ae
xor esi, esi
push 0x681f78
lea ecx, [ebx + 0x30e4]
call fcn.005a0de6
mov al, byte [ebx + 0x311c]
test al, al
je 0x523b21
lea ecx, [ebx + 0x10]
mov byte [ebx + 0x311c], 0
call fcn.00511550
mov eax, dword [ebx + 0x30cc]
mov ecx, dword [eax + 0x68]
cmp ecx, esi
lea ecx, [eax + 0x48]
setne byte [ebp - 0x11]
call fcn.005070b0
mov eax, dword [ebx + 0x30cc]
mov dword [eax + 0x80], esi
mov dword [eax + 0x84], esi
mov ecx, dword [ebx + 0x30cc]
mov dword [ecx + 0x88], esi
mov dword [ecx + 0x8c], esi
mov edx, dword [ebx + 0x30cc]
mov dword [edx + 0x158], esi
mov dword [edx + 0x15c], esi
mov eax, dword [ebx + 0x30cc]
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x40], esi
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x3130], esi
mov dword [ebx + 0x3138], esi
mov dword [ebx + 0x3140], esi
mov dword [ebx + 0x3148], esi
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x3158], esi
cmp eax, esi
mov dword [ebx + 0x3118], esi
mov dword [ebx + 0x60], esi
mov dword [ebx + 0x24], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x3c], esi
mov dword [ebx + 0x44], esi
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x3134], esi
mov dword [ebx + 0x313c], esi
mov dword [ebx + 0x3144], esi
mov dword [ebx + 0x314c], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x315c], esi
je 0x523aa2
mov byte [eax + 0x7f1], 0
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [ebx]
lea eax, [ebx + 0x30c4]
push eax
mov ecx, ebx
call dword [edx + 0x10]
cmp eax, esi
jne 0x523b8e
mov eax, dword [ebp + 8]
mov ecx, ebx
push eax
call fcn.00522880
mov edi, eax
cmp edi, esi
je 0x523ae3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [ebp - 0x11]
test al, al
je 0x523b05
mov ecx, dword [ebx + 0x80]
mov edx, dword [ecx + 0x30]
mov ecx, dword [ebx + 0x30cc]
push edx
push ebx
add ecx, 0x48
call fcn.005071f0
mov edi, eax
mov ecx, ebx
call fcn.0050ff10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x5c], 6
mov dword [ebx + 0x78], esi
mov eax, dword [0x6835dc]
push 1
push eax
mov ecx, ebx
call fcn.0050df70
cmp dword [ebx + 0x7c], esi
jne 0x523b63
mov ebx, dword [ebx + 0x30cc]
mov eax, dword [ebx + 0x18]
cmp eax, esi
je 0x523b63
mov ecx, dword [ebx + 0x70]
mov edx, dword [eax]
push ecx
push 0x13f8
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4