Function at 0x506fb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x328
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x324], eax
push ebx
push ebp
mov ebp, dword [esp + 0x338]
push esi
push edi
mov edi, dword [esp + 0x33c]
xor ebx, ebx
push 0x103
lea eax, [esp + 0x131]
push ebx
push eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], ebp
mov byte [esp + 0x138], bl
call fcn.005dfd60
push 0x103
lea ecx, [esp + 0x241]
push ebx
push ecx
mov byte [esp + 0x248], bl
call fcn.005dfd60
push 0x103
lea edx, [esp + 0x45]
push ebx
push edx
mov byte [esp + 0x4c], bl
call fcn.005dfd60
add esp, 0x24
mov dword [esp + 0x14], ebx
call fcn.004d96c0
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x100
add esi, 0x20019
cmp edi, ebx
je 0x50704c
mov byte [edi], bl
cmp ebp, ebx
je 0x507053
mov byte [ebp], bl
push ebx
call fcn.00503120
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
jne 0x5071b4
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea eax, [esp + 0x2c]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
push esi
push ebx
lea edx, [esp + 0x34]
push edx
push connect
call fcn.004fadc0
test eax, eax
jne 0x5071b4
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push str.ProxyEnable
push edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], 4
call esi
cmp dword [esp + 0x20], ebx
je 0x5071b4
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push str.ProxyServer
push edx
mov byte [esp + 0x40], bl
mov dword [esp + 0x30], 0x104
call esi
test eax, eax
jne 0x5071b4
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x28]
push eax
call edi
cmp eax, 4
jl 0x5071b0
lea ecx, [esp + 0x28]
push 0x3d
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x507155
push ebx
lea edx, [esp + 0x2c]
push str.http
push edx
call fcn.004f5880
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x5071b0
lea eax, [esp + esi + 0x28]
push 0x3b
push eax
call fcn.005e0940
add esp, 8
cmp eax, ebx
je 0x507149
mov byte [eax], bl
lea ecx, [esp + esi + 0x2d]
push ecx
lea edx, [esp + 0x2c]
push edx
call ebp
lea eax, [esp + 0x28]
push 0x3b
push eax
call fcn.005e0940
add esp, 8
cmp eax, ebx
je 0x50716a
mov byte [eax], bl
lea ecx, [esp + 0x28]
push ecx
call edi
dec eax
cmp eax, ebx
jle 0x5071b0
mov cl, 0x3a
cmp byte [esp + eax + 0x28], cl
je 0x507185
dec eax
cmp eax, ebx
jg 0x507178
jmp 0x5071b0
cmp eax, ebx
lea esi, [esp + eax + 0x28]
jle 0x5071b0
cmp esi, ebx
je 0x5071b0
lea edx, [esi + 1]
push edx
lea eax, [esp + 0x234]
push eax
call ebp
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x130]
push edx
mov byte [esi], bl
call ebp
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x5071c7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebx
cmp byte [esp + 0x12c], bl
je 0x507202
cmp byte [esp + 0x230], bl
je 0x507202
cmp edi, ebx
je 0x5071e8
lea eax, [esp + 0x12c]
push eax
push edi
call ebp
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x5071fb
lea ecx, [esp + 0x230]
push ecx
push eax
call ebp
mov eax, 1
jmp 0x50727b
push ebx
call fcn.00503120
test eax, eax
je 0x507279
mov eax, 0x104
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x130]
push eax
push str.ProxyServer
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorRegMsg
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
cmp al, 1
jne 0x507279
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x234]
push edx
push str.ProxyPort
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorRegMsg
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
cmp al, 1
jne 0x507279
cmp byte [esp + 0x12c], bl
je 0x507279
cmp byte [esp + 0x230], bl
jne 0x5071d9
xor eax, eax
mov ecx, dword [esp + 0x334]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x328
ret 8