Function at 0x447ba0
Capabilities:
Check if file exists
Get hostname
Get proxy
Get session user name
Query or enumerate registry value
Read file via mapping

Disassembly:
sub esp, 0x228
xor eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x234]
push esi
mov ebx, ecx
mov esi, 0x100
push edi
mov ecx, esi
mov edi, ebp
rep stosd dword es:[edi], eax
call fcn.004753b0
test eax, 0x10000
je 0x447d5d
mov eax, dword [str.AgentAdminUserInformation]
mov ecx, dword [str.Global]
push eax
push ecx
push 0x4df9ac
lea edx, [esp + 0x140]
push 0x103
push edx
call fcn.00466ca7
add esp, 0x14
lea eax, [esp + 0x134]
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
test edi, edi
mov dword [esp + 0x28], edi
jne 0x447c54
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x447cd3
call edi
cmp eax, 0x7b
je 0x447cd3
call edi
push eax
push 0x4e7660
lea ecx, [ebx + 0x55]
push 0xfff
push ecx
call fcn.00466ca7
mov edx, dword [ebx]
add esp, 0x10
push 0x890
jmp 0x447f8a
push 0
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x447cb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e763c
lea ecx, [ebx + 0x55]
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d29e4]
mov edx, dword [ebx]
add esp, 0x10
mov ecx, ebx
push 0x89a
push str.GetUserInfo__
push eax
call dword [edx + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 0x10
pop ebx
add esp, 0x228
ret 4
mov ecx, esi
mov esi, eax
mov edi, ebp
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x447f22
lea edi, [ebx + 0x55]
push 0x4e7600
push 0xfff
push edi
call fcn.00466ca7
mov eax, dword [0x4d29dc]
mov edx, dword [ebx]
add esp, 0xc
mov ecx, ebx
push 0x8a5
push str.GetUserInfo__
push eax
call dword [edx + 0x10]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], esi
lea esi, [ebp + 0x200]
lea ecx, [esp + 0x18]
push esi
push ecx
lea edx, [esp + 0x18]
push ebp
lea eax, [ebp + 0x100]
push edx
push eax
mov ecx, ebx
call fcn.00449ca0
cmp eax, 0x10
jb 0x447d53
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e75dc
push 0xfff
push edi
call fcn.00466ca7
mov edx, dword [ebx]
add esp, 0x10
push 0x8ac
jmp 0x447f8a
mov ecx, dword [str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings]
push ecx
push esi
jmp 0x447da0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], esi
push eax
push ebp
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x447f66
lea ecx, [esp + 0x10]
lea edx, [ebp + 0x100]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x447f66
mov eax, dword [str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings]
mov ecx, dword [str..DEFAULT]
push eax
push ecx
push 0x4df9ac
lea edx, [esp + 0x38]
push 0x104
push edx
call fcn.00466ca7
add esp, 0x14
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x2c]
push eax
push 1
push 0
push ecx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x447dfe
lea edx, [ebx + 0x1080]
push eax
push edx
push 0x4e75bc
lea eax, [ebx + 0x55]
push 0xfff
push eax
call fcn.00466ca7
mov edx, dword [ebx]
add esp, 0x14
push 0x8c3
jmp 0x447f8a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [str.ProxyEnable]
lea eax, [esp + 0x28]
push edx
mov edx, dword [esp + 0x24]
push eax
push 0
push ecx
push edx
mov dword [esp + 0x2c], 4
call esi
test eax, eax
je 0x447e75
push eax
mov eax, dword [str.ProxyEnable]
lea ecx, [ebx + 0x1080]
push eax
push ecx
push 0x4e7598
lea edx, [ebx + 0x55]
push 0xfff
push edx
call fcn.00466ca7
mov ecx, dword [0x4d29e4]
mov eax, dword [ebx]
add esp, 0x18
push 0x8cb
push str.GetUserInfo__
push ecx
mov ecx, ebx
call dword [eax + 0x10]
mov dword [esp + 0x20], 0
jmp 0x447e7d
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x447e92
mov edx, dword [str.disabled]
push 0x100
lea eax, [ebp + 0x300]
push edx
push eax
jmp 0x447f0f
mov eax, dword [str.ProxyServer]
lea ecx, [esp + 0x14]
lea edi, [ebp + 0x300]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edi
push edx
push 0
push eax
push ecx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x2c], 0x104
call esi
test eax, eax
je 0x447f17
mov edx, dword [str.ProxyEnable]
push eax
lea eax, [ebx + 0x1080]
push edx
push eax
push 0x4e7598
lea ecx, [ebx + 0x55]
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d29e4]
mov edx, dword [ebx]
add esp, 0x18
mov ecx, ebx
push 0x8db
push str.GetUserInfo__
push eax
call dword [edx + 0x10]
mov ecx, dword [str.disabled]
push 0x100
push ecx
push edi
call fcn.00466df0
add esp, 0xc
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x100]
lea ecx, [ebx + 0x55]
push eax
push ebp
push 0x4e757c
push 0xfff
push ecx
call fcn.00466ca7
mov eax, dword [0x4d29dc]
mov edx, dword [ebx]
add esp, 0x14
mov ecx, ebx
push 0x8e3
push str.GetUserInfo__
push eax
call dword [edx + 0x10]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x228
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e7554
lea ecx, [ebx + 0x55]
push 0xfff
push ecx
call fcn.00466ca7
mov edx, dword [ebx]
add esp, 0x10
push 0x8b9
mov eax, dword [0x4d29e4]
push str.GetUserInfo__
push eax
mov ecx, ebx
call dword [edx + 0x10]
pop edi
pop esi
pop ebp
mov eax, 0x10
pop ebx
add esp, 0x228
ret 4