Function at 0x425fe0
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a96f1
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x4c8630]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c8630]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xe4]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], reloc.WS2_32.dll_accept
mov byte [esp + 0x1c], bl
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
mov dword [esp + 0xf0], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
sete al
cmp al, bl
mov eax, dword [esp + 0x14]
je 0x4260ef
mov dword [esp + 0x20], ebx
cmp eax, ebx
je 0x426237
mov ecx, 4
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push ecx
push ebx
push str.ProxyEnable
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x4260eb
cmp dword [esp + 0x20], ebx
je 0x4260eb
lea edx, [esp + 0x2c]
push edx
call fcn.0041ff40
lea eax, [esp + 0x2c]
push eax
push str.ProxyServer
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0xe8], 1
call fcn.004223f0
test al, al
jne 0x426103
cmp byte [esp + 0x56], bl
jne 0x4260eb
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x30]
cmp eax, edx
je 0x4260eb
push eax
call fcn.0048a268
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x426237
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x426237
push 0x3f
lea eax, [esp + 0x91]
push ebx
push eax
mov byte [esp + 0x98], bl
call fcn.0048aa40
mov edx, dword [esp + 0x38]
add esp, 0xc
cmp edx, ebx
jbe 0x426153
lea ecx, [esp + 0x30]
cmp byte [esp + 0x56], bl
jne 0x426133
mov ecx, dword [esp + 0x50]
xor eax, eax
mov esi, 0x3d
lea ebx, [ebx]
cmp word [ecx + eax*2 + 4], si
je 0x42614e
inc eax
cmp eax, edx
jb 0x426140
jmp 0x426153
cmp eax, 0xffffffff
jne 0x426175
mov ecx, 0x40
lea esi, [esp + 0x8c]
lea eax, [esp + 0x2c]
call fcn.00420870
test al, al
jne 0x426203
jmp 0x426225
mov edi, 0x4ba030
lea eax, [esp + 0x2c]
call fcn.00420650
mov edi, eax
cmp edi, 0xffffffff
je 0x426225
add edi, 5
mov eax, edi
mov esi, 0x3b
lea ecx, [esp + 0x2c]
call fcn.00420580
mov esi, eax
cmp esi, 0xffffffff
jne 0x4261ac
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x5c]
push ecx
call fcn.0041ff40
lea edx, [esp + 0x2c]
mov eax, esi
push edx
sub eax, edi
mov edx, edi
lea ecx, [esp + 0x60]
mov byte [esp + 0xe0], 2
call fcn.00420500
mov ecx, 0x40
lea esi, [esp + 0x8c]
lea eax, [esp + 0x5c]
call fcn.00420870
test al, al
lea eax, [esp + 0x5c]
jne 0x4261f6
call fcn.00402420
jmp 0x426225
mov byte [esp + 0xdc], 1
call fcn.00402420
lea eax, [esp + 0x8c]
push eax
push 0x2714
push ebp
call sym.SGWPNote.exe_curl_easy_setopt
add esp, 0xc
push ebx
push 0x65
push ebp
call sym.SGWPNote.exe_curl_easy_setopt
add esp, 0xc
lea eax, [esp + 0x2c]
call fcn.00402420
lea esi, [esp + 0x14]
call fcn.004223d0
mov ecx, dword [esp + 0xd4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.00488f53
add esp, 0xcc
ret