Function at 0x409370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x118]
mov dword [0x41f028], 0x41a368
push eax
push 0x20019
push 0
push str.SoftwareHTTPNet
push 0x80000001
mov dword [0x41f02c], 0x41a370
mov dword [0x41f030], 0
mov byte [0x41f294], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409904
push 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x10c]
add esp, 0xc
mov dword [ebp - 0x10c], 0x104
mov dword [ebp - 0x110], 1
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.address
push dword [ebp - 0x118]
call edi
test eax, eax
jne 0x40943f
push ecx
lea eax, [ebp - 0x108]
mov edx, 0x104
push eax
push ecx
mov ecx, 0x41ef20
call fcn.00409060
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.path
push dword [ebp - 0x118]
call edi
mov edx, 0x104
push ecx
test eax, eax
jne 0x4096bb
lea eax, [ebp - 0x108]
push eax
push ecx
mov ecx, 0x41e8f0
call fcn.00409060
mov ecx, 0x104
mov eax, 0x41e8f0
cmp byte [eax], 0
je 0x4094ae
inc eax
sub ecx, 1
jne 0x4094a3
mov eax, 0x104
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x4094da
push ecx
push str._client_external_fncConfig
push ecx
mov edx, 0x104
lea ecx, [esi + 0x41e8f0]
sub edx, esi
call fcn.00409060
push ecx
lea eax, [ebp - 0x108]
mov edx, 0x104
push eax
push ecx
mov ecx, 0x41ec08
call fcn.00409060
mov ecx, 0x104
mov eax, 0x41ec08
nop dword [eax]
cmp byte [eax], 0
je 0x40950b
inc eax
sub ecx, 1
jne 0x409500
mov eax, 0x104
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x409537
push ecx
push str._client_external_fncBusiness
push ecx
mov edx, 0x104
lea ecx, [esi + 0x41ec08]
sub edx, esi
call fcn.00409060
push ecx
lea eax, [ebp - 0x108]
mov edx, 0x104
push eax
push ecx
mov ecx, 0x41ee18
call fcn.00409060
mov ecx, 0x104
mov eax, 0x41ee18
nop dword [eax]
cmp byte [eax], 0
je 0x40956b
inc eax
sub ecx, 1
jne 0x409560
mov eax, 0x104
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x409597
push ecx
push str._client_external_uninstallConfig
push ecx
mov edx, 0x104
lea ecx, [esi + 0x41ee18]
sub edx, esi
call fcn.00409060
push ecx
lea eax, [ebp - 0x108]
mov edx, 0x104
push eax
push ecx
mov ecx, 0x41ed10
call fcn.00409060
mov ecx, 0x104
mov eax, 0x41ed10
nop dword [eax]
cmp byte [eax], 0
je 0x4095cb
inc eax
sub ecx, 1
jne 0x4095c0
mov eax, 0x104
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x4095f7
push ecx
push str._client_external_uninstallBusiness
push ecx
mov edx, 0x104
lea ecx, [esi + 0x41ed10]
sub edx, esi
call fcn.00409060
push ecx
lea eax, [ebp - 0x108]
mov edx, 0x104
push eax
push ecx
mov ecx, 0x41e9f8
call fcn.00409060
mov ecx, 0x104
mov eax, 0x41e9f8
nop dword [eax]
cmp byte [eax], 0
je 0x40962b
inc eax
sub ecx, 1
jne 0x409620
mov eax, 0x104
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x409657
push ecx
push str._client_external_report
push ecx
mov edx, 0x104
lea ecx, [esi + 0x41e9f8]
sub edx, esi
call fcn.00409060
push ecx
lea eax, [ebp - 0x108]
mov edx, 0x104
push eax
push ecx
mov ecx, 0x41e5e8
call fcn.00409060
mov ecx, 0x104
mov eax, 0x41e5e8
nop dword [eax]
cmp byte [eax], 0
je 0x40968b
inc eax
sub ecx, 1
jne 0x409680
mov eax, 0x104
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x409739
push ecx
push str._client_external_initInterval
mov edx, 0x104
push ecx
sub edx, esi
lea ecx, [esi + 0x41e5e8]
jmp 0x409734
push str._client_external_fncConfig
push ecx
mov ecx, 0x41e8f0
call fcn.00409060
push ecx
push str._client_external_fncBusiness
push ecx
mov edx, 0x104
mov ecx, 0x41ec08
call fcn.00409060
push ecx
push str._client_external_uninstallConfig
push ecx
mov edx, 0x104
mov ecx, 0x41ee18
call fcn.00409060
push ecx
push str._client_external_uninstallBusiness
push ecx
mov edx, 0x104
mov ecx, 0x41ed10
call fcn.00409060
push ecx
push str._client_external_report
push ecx
mov edx, 0x104
mov ecx, 0x41e9f8
call fcn.00409060
push ecx
push str._client_external_initInterval
push ecx
mov edx, 0x104
mov ecx, 0x41e5e8
call fcn.00409060
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x110], 4
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x10c], 4
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], 0
push eax
push 0
push str.port
push dword [ebp - 0x118]
call edi
movzx edx, word [0x41f23c]
test eax, eax
movzx ecx, word [ebp - 0x114]
lea eax, [ebp - 0x108]
push 0x104
cmove edx, ecx
mov dword [ebp - 0x110], 1
push 0
push eax
mov word [0x41f23c], dx
mov dword [ebp - 0x10c], 0x104
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0x41a45c
push dword [ebp - 0x118]
call edi
push ecx
push str.Accept_Encoding:gzip__deflate__br_r_nContent_Type:application_json_r_nHost:
push ecx
mov esi, 0x200
mov ecx, 0x41e6f0
mov edx, esi
call fcn.00409060
mov ecx, esi
mov eax, 0x41e6f0
cmp byte [eax], 0
je 0x40980d
inc eax
sub ecx, 1
jne 0x409802
mov eax, esi
mov edi, ecx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x409833
push ecx
push 0x41ef20
push ecx
mov edx, esi
lea ecx, [edi + 0x41e6f0]
sub edx, edi
call fcn.00409060
mov ecx, esi
mov eax, 0x41e6f0
nop word [eax + eax]
cmp byte [eax], 0
je 0x40984b
inc eax
sub ecx, 1
jne 0x409840
mov eax, esi
mov edi, ecx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x409871
push ecx
push str._r_nConnection:keep___alive_r_nsourceId:294a5c34_ada0_11ed_96fa_0ea40d537b6e_r_npid:
push ecx
mov edx, esi
lea ecx, [edi + 0x41e6f0]
sub edx, edi
call fcn.00409060
mov ecx, esi
mov eax, 0x41e6f0
cmp byte [eax], 0
je 0x409883
inc eax
sub ecx, 1
jne 0x409878
mov eax, esi
mov edi, ecx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x4098ab
push ecx
lea eax, [ebp - 0x108]
mov edx, esi
push eax
push ecx
sub edx, edi
lea ecx, [edi + 0x41e6f0]
call fcn.00409060
mov ecx, esi
mov eax, 0x41e6f0
cmp byte [eax], 0
je 0x4098bd
inc eax
sub ecx, 1
jne 0x4098b2
mov eax, esi
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x4098e3
push ecx
push str._r_n_r_n
push ecx
sub esi, edx
lea ecx, [edx + 0x41e6f0]
mov edx, esi
call fcn.00409060
push 0x41ef20
push str.https:___s
push 0x104
push 0x41eb00
call fcn.00408fe0
add esp, 0x10
jmp 0x409a53
push ecx
push str.api.bc.00es.cn
push ecx
mov edx, 0x104
mov ecx, 0x41ef20
call fcn.00409060
push ecx
push str.Accept_Encoding:gzip__deflate__br_r_nContent_Type:application_json_r_nHost:
push ecx
mov esi, 0x200
mov ecx, 0x41e6f0
mov edx, esi
call fcn.00409060
mov ecx, esi
mov eax, 0x41e6f0
nop dword [eax]
cmp byte [eax], 0
je 0x40994b
inc eax
sub ecx, 1
jne 0x409940
mov eax, esi
mov edi, ecx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x409971
push ecx
push 0x41ef20
push ecx
mov edx, esi
lea ecx, [edi + 0x41e6f0]
sub edx, edi
call fcn.00409060
mov ecx, esi
mov eax, 0x41e6f0
cmp byte [eax], 0
je 0x409983
inc eax
sub ecx, 1
jne 0x409978
mov eax, esi
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x4099a9
push ecx
push str._r_nConnection:keep___alive_r_nsourceId:294a5c34_ada0_11ed_96fa_0ea40d537b6e_r_npid:6a9dce65_dc34_45c8_9c3d_1092edc1d623_r_n_r_n
push ecx
sub esi, edx
lea ecx, [edx + 0x41e6f0]
mov edx, esi
call fcn.00409060
push 0x41ef20
push str.https:___s
push 0x104
push 0x41eb00
call fcn.00408fe0
add esp, 0xc
mov edx, 0x104
push str._client_external_fncConfig
push ecx
mov ecx, 0x41e8f0
call fcn.00409060
push ecx
push str._client_external_fncBusiness
push ecx
mov edx, 0x104
mov ecx, 0x41ec08
call fcn.00409060
push ecx
push str._client_external_uninstallConfig
push ecx
mov edx, 0x104
mov ecx, 0x41ee18
call fcn.00409060
push ecx
push str._client_external_uninstallBusiness
push ecx
mov edx, 0x104
mov ecx, 0x41ed10
call fcn.00409060
push ecx
push str._client_external_report
push ecx
mov edx, 0x104
mov ecx, 0x41e9f8
call fcn.00409060
push ecx
push str._client_external_initInterval
push ecx
mov edx, 0x104
mov ecx, 0x41e5e8
call fcn.00409060
mov eax, 0x1bb
mov word [0x41f23c], ax
push ecx
push 0x41a598
push ecx
mov edx, 0x104
mov ecx, 0x41f034
call fcn.00409060
push ecx
push str.000000
push ecx
mov edx, 0x104
mov ecx, 0x41f138
call fcn.00409060
mov ecx, dword [ebp - 4]
mov eax, 0x41f028
pop edi
xor ecx, ebp
pop esi
call fcn.00413d41
mov esp, ebp
pop ebp
ret