Function at 0x50bc40
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61f86d
push eax
mov dword fs:[0], esp
sub esp, 0xda8
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call fcn.0050d040
mov ecx, ebx
call fcn.0050d000
mov ecx, ebx
call fcn.0050c4e0
mov ecx, dword [ebx + 4]
xor edi, edi
cmp ecx, edi
mov ebp, 1
je 0x50bce7
push ebp
call fcn.004371e0
test eax, eax
jne 0x50bce7
cmp dword [ebx + 8], edi
jne 0x50bc9b
mov eax, 4
jmp 0x50c4ba
mov eax, dword [ebx + 4]
cmp dword [eax + 0x30], edi
je 0x50bce7
lea ecx, [esp + 0x14]
call fcn.004e55e0
mov ecx, dword [ebx + 4]
mov dword [esp + 0xdc0], edi
push ecx
lea ecx, [esp + 0x18]
call fcn.004e5620
cmp eax, edi
mov dword [esp + 0xdc0], 0xffffffff
lea ecx, [esp + 0x14]
je 0x50bce2
call fcn.004e5610
mov eax, 4
jmp 0x50c4ba
call fcn.004e5610
mov eax, dword [0x6e7b6c]
mov dword [esp + 0x24], eax
mov dword [esp + 0xdc0], ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov esi, dword [esp + 0xdd0]
mov byte [esp + 0xdc0], 5
cmp esi, edi
je 0x50bd3d
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
call fcn.00517c30
add esp, 0x14
jmp 0x50bd9b
push 0x6beba4
lea ecx, [esp + 0x28]
call fcn.005fa9e2
push 0x6d67c4
lea ecx, [esp + 0x1c]
call fcn.005fa9e2
push 0x6d67c0
push 0x6d67bc
push 0x6d67b8
push 0x6d67ac
lea ecx, [esp + 0x30]
push 0x6d67a0
push ecx
call fcn.005f368b
add esp, 0x18
lea ecx, [esp + 0x1c]
push 0x6bf004
call fcn.005fa9e2
push 0x6d6794
lea ecx, [esp + 0x2c]
call fcn.005fa9e2
lea ecx, [esp + 0x130]
call fcn.005a1c40
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push edx
xor edx, edx
cmp esi, edi
push eax
setne dl
inc edx
push ecx
push edx
lea ecx, [esp + 0x144]
mov byte [esp + 0xdd4], 6
call fcn.005a8f80
lea eax, [ebx + 0xc]
push 0x400
push eax
lea ecx, [esp + 0x158]
call fcn.005bdbb0
cmp dword [ebx + 0x514], edi
je 0x50be20
lea ecx, [esp + 0x130]
push ecx
call fcn.0049dc70
mov eax, dword [esp + 0xa08]
add esp, 4
cmp eax, edi
jne 0x50be18
mov al, byte [esp + 0xb54]
test al, al
je 0x50be26
mov dword [ebx + 0x518], ebp
jmp 0x50be26
mov dword [ebx + 0x518], edi
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x138]
call fcn.005a91a0
mov eax, dword [ebx + 8]
cmp eax, edi
je 0x50be54
mov ecx, dword [ebx + 0x51c]
mov dword [esp + 0x134], ebp
cmp ecx, edi
je 0x50be5f
mov dword [esp + 0x134], 4
cmp eax, edi
je 0x50be77
cmp dword [ebx + 0x51c], edi
jne 0x50be77
mov ecx, dword [ebx + 4]
mov dword [esp + 0x130], ecx
jmp 0x50be7e
mov dword [esp + 0x130], edi
mov eax, dword [ebx + 0x51c]
mov byte [esp + 0xb68], 1
cmp eax, edi
mov byte [esp + 0x2a7], 0
mov byte [esp + 0x461], 1
mov byte [esp + 0x462], 1
je 0x50beb0
mov byte [esp + 0x2d9], 1
push ebp
lea ecx, [esp + 0x134]
call fcn.005a9420
mov eax, dword [esp + 0x9fc]
cmp eax, 3
je 0x50beea
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, edi
je 0x50bf9b
push 0xc8
call esi
mov eax, dword [esp + 0x9fc]
cmp eax, 3
jne 0x50becf
mov edx, dword [esp + 0x180]
push 0x6c2ff4
push edx
call fcn.005df7bf
mov ebp, eax
add esp, 8
cmp ebp, edi
jne 0x50c040
mov eax, dword [esp + 0x180]
push eax
call fcn.005dfbfe
add esp, 4
lea ecx, [esp + 0x130]
call fcn.005ab960
mov byte [esp + 0xdc0], 5
lea ecx, [esp + 0x130]
call fcn.005a1de0
lea ecx, [esp + 0x28]
mov byte [esp + 0xdc0], 4
call fcn.005fa859
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdc0], 3
call fcn.005fa859
lea ecx, [esp + 0x20]
mov byte [esp + 0xdc0], 2
call fcn.005fa859
lea ecx, [esp + 0x18]
mov byte [esp + 0xdc0], 1
call fcn.005fa859
lea ecx, [esp + 0x24]
mov dword [esp + 0xdc0], 0xffffffff
call fcn.005fa859
mov eax, 4
jmp 0x50c4ba
mov eax, dword [esp + 0x180]
cmp eax, edi
je 0x50bfaf
push eax
call fcn.005dfbfe
add esp, 4
lea ecx, [esp + 0x130]
call fcn.005ab960
mov al, byte [esp + 0x2d9]
mov byte [esp + 0xdc0], 5
test al, al
lea ecx, [esp + 0x130]
jne 0x50bf34
call fcn.005a1de0
lea ecx, [esp + 0x28]
mov byte [esp + 0xdc0], 4
call fcn.005fa859
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdc0], 3
call fcn.005fa859
lea ecx, [esp + 0x20]
mov byte [esp + 0xdc0], 2
call fcn.005fa859
lea ecx, [esp + 0x18]
mov byte [esp + 0xdc0], 1
call fcn.005fa859
lea ecx, [esp + 0x24]
mov dword [esp + 0xdc0], 0xffffffff
call fcn.005fa859
mov eax, 8
jmp 0x50c4ba
push ebp
call fcn.005f2fca
push eax
call fcn.005e0b45
mov esi, eax
lea edi, [esi + 1]
push edi
call fcn.005f6c5c
mov edx, eax
mov ecx, edi
mov dword [esp + 0x20], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
push 1
push eax
call fcn.005e0a2e
push ebp
mov dword [esp + 0x30], eax
call fcn.005df5d8
mov ecx, dword [esp + 0x1a0]
push ecx
call fcn.005dfbfe
add esp, 0x24
lea ecx, [esp + 0x130]
call fcn.005ab960
mov edx, dword [esp + 0x14]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x30]
mov byte [edx + esi], 0
mov edx, 0x100
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
cmp eax, edx
jae 0x50c0c9
mov edx, eax
mov eax, dword [esp + 0x14]
mov ecx, edx
mov ebp, ecx
mov esi, eax
lea edi, [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0xdc8]
mov ecx, edx
mov esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [0x6edae0]
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
lea ecx, [esp + 0x38]
push edx
push ecx
lea ecx, [ebx + 0x508]
call fcn.0044b2e0
lea ebp, [ebx + 0x43e]
lea esi, [esp + 0x30]
mov edi, ebp
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x50c155
test al, al
je 0x50c151
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x50c155
add esi, 2
add edi, 2
test al, al
jne 0x50c12d
xor eax, eax
jmp 0x50c15a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50c24b
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, dword [sym.imp.USER32.dll_PostMessageA]
mov dword [esp + 0x10], eax
mov al, byte [esp + ecx + 0x32]
lea esi, [esp + ecx + 0x32]
test al, al
je 0x50c20a
lea edi, [ebx + 0x50c]
push edi
push 0x6c269c
push esi
call fcn.005de570
mov eax, dword [edi]
add esp, 0xc
test eax, eax
jle 0x50c1e0
mov ecx, dword [0x6ec8e4]
test ecx, ecx
je 0x50c1bb
push eax
push 0x14a7
push 0x111
push ecx
call ebp
jmp 0x50c1e0
mov ecx, dword [0x6ec7a0]
test ecx, ecx
je 0x50c1e0
lea edx, [esp + 0x2c]
push 4
push edx
push 4
push 0
push 0x6bbf88
push ecx
mov dword [esp + 0x44], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
add esi, ecx
cmp byte [esi], 0
je 0x50c21f
add ebx, 0x510
push ebx
push 0x6c269c
push esi
call fcn.005de570
add esp, 0xc
jmp 0x50c21f
mov eax, dword [0x6ec7a0]
test eax, eax
je 0x50c21f
push 0x6bbf88
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [0x6ec8e4]
test eax, eax
je 0x50c23c
push 1
push 0x149d
push 0x111
push eax
call ebp
jmp 0x50c43d
mov dword [0x6ec8b4], 2
jmp 0x50c43d
mov esi, dword [0x6ececc]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50c27d
test cl, cl
je 0x50c279
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50c27d
add eax, 2
add esi, 2
test cl, cl
jne 0x50c255
xor eax, eax
jmp 0x50c282
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50c293
mov dword [esp + 0x10], 1
jmp 0x50c43d
mov esi, dword [0x6ecec8]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50c2c5
test cl, cl
je 0x50c2c1
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50c2c5
add eax, 2
add esi, 2
test cl, cl
jne 0x50c29d
xor eax, eax
jmp 0x50c2ca
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50c2db
mov dword [esp + 0x10], 2
jmp 0x50c43d
mov esi, dword [0x6ecec0]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50c30d
test cl, cl
je 0x50c309
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50c30d
add eax, 2
add esi, 2
test cl, cl
jne 0x50c2e5
xor eax, eax
jmp 0x50c312
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50c323
mov dword [esp + 0x10], 7
jmp 0x50c43d
mov esi, dword [0x6ecea8]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50c355
test cl, cl
je 0x50c351
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50c355
add eax, 2
add esi, 2
test cl, cl
jne 0x50c32d
xor eax, eax
jmp 0x50c35a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50c36b
mov dword [esp + 0x10], 0xa
jmp 0x50c43d
mov esi, dword [0x6ecea4]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50c39d
test cl, cl
je 0x50c399
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50c39d
add eax, 2
add esi, 2
test cl, cl
jne 0x50c375
xor eax, eax
jmp 0x50c3a2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50c3b3
mov dword [esp + 0x10], 0xb
jmp 0x50c43d
mov esi, dword [0x6ecea0]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50c3e5
test cl, cl
je 0x50c3e1
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50c3e5
add eax, 2
add esi, 2
test cl, cl
jne 0x50c3bd
xor eax, eax
jmp 0x50c3ea
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x50c3f8
mov dword [esp + 0x10], 0xc
jmp 0x50c43d
mov esi, dword [0x6ecec4]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x50c42a
test cl, cl
je 0x50c426
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x50c42a
add eax, 2
add esi, 2
test cl, cl
jne 0x50c402
xor eax, eax
jmp 0x50c42f
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
xor eax, eax
setne cl
add ecx, 0
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x14]
push edx
call fcn.005f6c85
add esp, 4
lea ecx, [esp + 0x130]
mov byte [esp + 0xdc0], 5
call fcn.005a1de0
lea ecx, [esp + 0x28]
mov byte [esp + 0xdc0], 4
call fcn.005fa859
lea ecx, [esp + 0x1c]
mov byte [esp + 0xdc0], 3
call fcn.005fa859
lea ecx, [esp + 0x20]
mov byte [esp + 0xdc0], 2
call fcn.005fa859
lea ecx, [esp + 0x18]
mov byte [esp + 0xdc0], 1
call fcn.005fa859
lea ecx, [esp + 0x24]
mov dword [esp + 0xdc0], 0xffffffff
call fcn.005fa859
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xdb8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xdb4
ret 0xc