Function at 0x41c402
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x200
lea ebp, [esp - 4]
mov eax, dword [0x4d0620]
xor eax, ebp
mov dword [ebp + 0x200], eax
push 0x18
mov eax, 0x4a09f6
call fcn.00481d3a
mov eax, dword [ebp + 0x20c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x210]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push eax
push 1
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41c47c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.0047b9fe
add ebp, 0x204
leave
ret 8
push 0x1fe
lea eax, [ebp + 2]
push esi
push eax
mov word [ebp], si
call fcn.0047e7d0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp]
push eax
push esi
push esi
push str.ProxyServer
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
push dword [ebp - 0x1c]
je 0x41c4c0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41c455
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401640
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
jne 0x41c4ea
lea ecx, [eax - 0x10]
call fcn.00401325
jmp 0x41c455
lea edi, [ebp - 0x10]
call fcn.00406399
mov edi, 0x4b6fc0
push edi
xor ecx, ecx
lea esi, [ebp - 0x10]
mov dword [ebx], 2
call fcn.0040444f
mov esi, eax
cmp esi, 0xffffffff
je 0x41c549
push edi
call fcn.0047ba0d
pop ecx
add eax, esi
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.00404519
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004015ba
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
mov dword [ebx], 2
jmp 0x41c598
mov edi, str.socks
push edi
xor ecx, ecx
lea esi, [ebp - 0x10]
call fcn.0040444f
mov esi, eax
cmp esi, 0xffffffff
je 0x41c598
push edi
call fcn.0047ba0d
pop ecx
add eax, esi
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.00404519
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004015ba
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
mov dword [ebx], 1
push 0x4b6fdc
xor ecx, ecx
lea esi, [ebp - 0x10]
call fcn.0040444f
cmp eax, 0xffffffff
je 0x41c5d3
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0040453c
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.004015ba
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
push 0x4b6fe0
xor ecx, ecx
lea esi, [ebp - 0x10]
call fcn.0040444f
mov esi, eax
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040453c
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x18]
push eax
call fcn.004015ba
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401325
inc esi
push esi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.00404519
push dword [eax]
call fcn.0047eb2a
mov esi, dword [ebp - 0x20]
pop ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov dword [esi], eax
call fcn.00401325
cmp dword [esi], 0
jg 0x41c64c
xor esi, esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401325
mov eax, esi
jmp 0x41c457
xor esi, esi
inc esi
jmp 0x41c63a