Function at 0x100497a0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x43c
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x450]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x35]
push ebx
push eax
mov byte [esp + 0x3c], bl
call fcn.10116880
xor eax, eax
add esp, 0xc
mov dword [esp + 0x10], ebx
mov byte [esp + 0x28], bl
mov dword [esp + 0x29], eax
mov word [esp + 0x2d], ax
mov byte [esp + 0x2f], al
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 1
call fcn.1004f190
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x100
add esi, 0x20019
cmp edi, ebx
je 0x100498d2
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push 0x104
lea ecx, [esp + 0x38]
push ecx
push 0x1013fc40
push str.ConnectViaProxy
push str.Config
call ebp
cmp byte [esp + 0x30], 0x31
jne 0x1004984d
mov eax, 1
jmp 0x10049c19
push edi
push 0x104
lea edx, [esp + 0x38]
push edx
push 0x1013fc40
push str.DownloadFromAnotherServer
push str.Config
call ebp
cmp byte [esp + 0x30], 0x31
jne 0x100498d2
push edi
push 0x104
lea eax, [esp + 0x38]
push eax
push 0x1013f817
push str.httphost
push str.Config
call ebp
push str.mwti.
lea ecx, [esp + 0x34]
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x100498d2
push str.escanav.
lea ecx, [esp + 0x34]
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x100498d2
push str.microworldsystems.
lea ecx, [esp + 0x34]
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10049843
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x10]
push edx
push esi
lea eax, [esp + 0x38]
push eax
push closesocket
call fcn.10062150
mov ebp, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
jne 0x10049aef
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push ebx
push str.ProxyEnable
push eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], 4
call esi
cmp dword [esp + 0x20], ebx
je 0x10049aef
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push edx
push ebx
push ebx
push str.ProxyServer
push eax
mov byte [esp + 0x48], bl
mov dword [esp + 0x2c], 0x104
call esi
test eax, eax
jne 0x10049aef
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jl 0x10049aef
lea edx, [esp + 0x30]
push 0x3d
push edx
call fcn.1010d780
add esp, 8
test eax, eax
je 0x100499cd
push str.http
lea ecx, [esp + 0x34]
call fcn.10047020
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x10049aef
lea eax, [esp + esi + 0x30]
push 0x3b
push eax
call fcn.1010d780
add esp, 8
cmp eax, ebx
je 0x100499bd
mov byte [eax], bl
lea ecx, [esp + esi + 0x35]
push ecx
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x30]
push 0x3b
push eax
call fcn.1010d780
add esp, 8
cmp eax, ebx
je 0x100499e2
mov byte [eax], bl
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
cmp eax, ebx
jle 0x10049aef
mov cl, 0x3a
cmp byte [esp + eax + 0x30], cl
je 0x10049a08
dec eax
cmp eax, ebx
jg 0x100499f8
jmp 0x10049aef
cmp eax, ebx
lea esi, [esp + eax + 0x30]
jle 0x10049aef
cmp esi, ebx
je 0x10049aef
cmp edi, ebx
je 0x10049a45
push edi
lea edx, [esi + 1]
push edx
push str.HTTPProxyPort
push str.HTTP
call ebp
push edi
lea eax, [esp + 0x34]
push eax
push str.HTTPProxyServer
push str.HTTP
mov byte [esi], bl
call ebp
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x2c]
push eax
push ebx
push str.ProxyEnable
push ecx
mov dword [esp + 0x2c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [esp + 0x28], 1
jne 0x10049ae5
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 1
cmp edi, ebx
je 0x10049aef
push edi
push 0x105
lea edx, [esp + 0x13c]
push edx
push 0x1013f817
push str.SourceUNCPath
push str.Config
mov byte [esp + 0x14c], bl
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x134], bl
jne 0x10049ae5
push edi
push 0x1013ffd0
push str.ConnectViaProxy
push str.Config
call ebp
push edi
push 0x10152c54
push str.DownloadType
push str.Config
call ebp
cmp edi, ebx
je 0x10049aef
push edi
push ebx
push ebx
push ebx
call ebp
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x10049b02
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x18], ebx
je 0x10049c15
push 0x103
lea eax, [esp + 0x139]
push ebx
push eax
mov byte [esp + 0x140], bl
call fcn.10116880
push 0x103
lea ecx, [esp + 0x24d]
push ebx
push ecx
mov byte [esp + 0x254], bl
call fcn.10116880
add esp, 0x18
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x240]
lea esi, [esp + 0x138]
mov dword [esp + 0x1c], ebx
call fcn.100343d0
cmp dword [esp + 0x18], ebx
je 0x10049c15
cmp byte [esp + 0x134], bl
je 0x10049c15
cmp byte [esp + 0x23c], bl
je 0x10049c15
mov dword [esp + 0x1c], 1
cmp edi, ebx
je 0x10049c15
push edi
lea eax, [esp + 0x240]
push eax
push str.HTTPProxyPort
push str.HTTP
call ebp
push edi
mov ecx, esi
push ecx
push str.HTTPProxyServer
push str.HTTP
call ebp
push edi
push 0x105
lea edx, [esp + 0x348]
push edx
push 0x1013f817
push str.SourceUNCPath
push str.Config
mov byte [esp + 0x358], bl
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [esp + 0x340], bl
jne 0x10049c0f
push edi
push 0x1013ffd0
push str.ConnectViaProxy
push str.Config
call ebp
push edi
push 0x10152c54
push str.DownloadType
push str.Config
call ebp
push edi
push ebx
push ebx
push ebx
call ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x448]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x43c
ret 4