Function at 0x10004a97
Capabilities:
Get proxy
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5fc
mov eax, dword [0x1001c050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
mov dword [ebp - 0x5ec], eax
lea eax, [ebp - 0x1db]
push ebx
push eax
mov dword [ebp - 0x5e4], ebx
mov byte [ebp - 0x1dc], bl
call fcn.1000f670
push 0x3ff
lea eax, [ebp - 0x5db]
push ebx
push eax
mov byte [ebp - 0x5dc], bl
call fcn.1000f670
add esp, 0x18
mov eax, dword [str.Classes]
push 0xf
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea edi, [ebp - 0xd8]
rep movsd dword es:[edi], dword [esi]
mov esi, str.Connections
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0xd
pop ecx
push 6
mov esi, str.DefaultConnectionSettings
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 7
mov esi, str.ProxyServer
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
mov eax, dword [0x10019bc4]
pop ecx
mov esi, str.ProxyOverride
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x5ec]
push 7
pop ecx
mov esi, str.AutoConfigURL
lea edi, [ebp - 0x68]
mov dword [ebp - 0x5f8], ebx
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x5dd], bl
cmp eax, ebx
je 0x10004d74
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [ebp - 0x5f4]
push eax
push ebx
push ebx
push ebx
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 0x5f4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x10004d74
cmp dword [ebp - 0x5f4], ebx
je 0x10004d74
mov dword [ebp - 0x5f0], ebx
jbe 0x10004d74
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5fc]
push eax
lea eax, [ebp - 0x1dc]
push eax
push dword [ebp - 0x5f0]
mov dword [ebp - 0x5fc], 0x104
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10004d5c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1dc]
push eax
push str._s__s
mov ecx, 0x400
lea edi, [ebp - 0x5dc]
call fcn.1000248d
add esp, 0xc
lea eax, [ebp - 0x5e8]
push eax
push 1
push ebx
mov eax, edi
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004d5c
push dword [ebp - 0x5e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x1dc]
push eax
push str._s_s_s
mov ecx, 0x400
call fcn.1000248d
add esp, 0x10
lea eax, [ebp - 0x5e8]
push eax
push 1
push ebx
mov eax, edi
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004d5c
lea eax, [ebp - 0x5e4]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 0x5e8]
mov dword [ebp - 0x5e4], ebx
call esi
test eax, eax
jne 0x10004cdc
push dword [ebp - 0x5e4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0x5e4]
push eax
push edi
push ebx
push ebx
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 0x5e8]
mov dword [ebp - 0x5f8], edi
call esi
jmp 0x10004ce2
mov edi, dword [ebp - 0x5f8]
push dword [ebp - 0x5e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x10004d11
cmp dword [ebp - 0x5e4], 9
jb 0x10004d04
mov al, byte [edi + 8]
mov byte [ebp - 0x5dd], al
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x5f8], ebx
cmp byte [ebp - 0x5dd], 1
je 0x10004d5c
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x1dc]
push eax
push 0x10019c6c
mov ecx, 0x400
lea edi, [ebp - 0x5dc]
call fcn.1000248d
add esp, 0xc
lea eax, [ebp - 0x5e8]
push eax
push 1
push ebx
mov eax, edi
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10004d85
inc dword [ebp - 0x5f0]
mov eax, dword [ebp - 0x5f0]
cmp eax, dword [ebp - 0x5f4]
jb 0x10004bc0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10008f62
leave
ret
test byte [ebp - 0x5dd], 2
je 0x10004e30
lea eax, [ebp - 0x5e4]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x5e8]
mov dword [ebp - 0x5e4], ebx
call esi
test eax, eax
jne 0x10004de1
push dword [ebp - 0x5e4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, dword [ebp - 0x5ec]
lea ecx, [ebp - 0x5e4]
push ecx
push eax
push ebx
mov dword [edi + 8], eax
push ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x5e8]
call esi
jmp 0x10004de7
mov edi, dword [ebp - 0x5ec]
lea eax, [ebp - 0x5e4]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x5e8]
mov dword [ebp - 0x5e4], ebx
call esi
test eax, eax
jne 0x10004e36
push dword [ebp - 0x5e4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 0x5e4]
push ecx
push eax
push ebx
mov dword [edi + 0xc], eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x5e8]
call esi
jmp 0x10004e36
mov edi, dword [ebp - 0x5ec]
test byte [ebp - 0x5dd], 4
je 0x10004e86
lea eax, [ebp - 0x5e4]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x5e8]
mov dword [ebp - 0x5e4], ebx
call esi
test eax, eax
jne 0x10004e86
push dword [ebp - 0x5e4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 0x5e4]
push ecx
push eax
push ebx
mov dword [edi + 4], eax
push ebx
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x5e8]
call esi
movzx eax, byte [ebp - 0x5dd]
push dword [ebp - 0x5e8]
shr eax, 3
and eax, 1
mov dword [edi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x10004d76