Function at 0x1403be8b0
Capabilities:
Delete file
Get common file path
Get proxy
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x8e0
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0x8d0], rax
mov rax, qword [rcx + 0x208]
xor r12d, r12d
mov dword [rsp + 0x34], 0xc8
mov dword [rsp + 0x30], r12d
mov byte [rax], r12b
cmp qword [rcx + reloc.mfc90u.dll_CDataSourceControl::CDataSourceControl], r12
mov rsi, rcx
mov byte [rsp + 0x48], r12b
je 0x1403be997
mov rcx, qword [rcx + 0x280]
lea ebx, [r12 + 0x26]
lea r9, [rsp + 0x30]
mov edx, ebx
xor r8d, r8d
call qword [rsi + COleDispatchException::~COleDispatchException]
mov ecx, dword [rsp + 0x30]
cmp ecx, r12d
je 0x1403be997
mov rdx, rcx
lea ecx, [rbx + 0x1a]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, qword [rsi + 0x280]
lea r9, [rsp + 0x30]
mov r8, rax
mov edx, ebx
mov rdi, rax
call qword [rsi + COleDispatchException::~COleDispatchException]
cmp eax, r12d
je 0x1403be98e
mov rcx, qword [rdi + 8]
cmp rcx, r12
je 0x1403be980
mov rdx, qword [rsi + 0x208]
lea ebx, [r12 + 1]
mov al, byte [rcx]
add rcx, rbx
mov byte [rdx], al
add rdx, rbx
cmp al, r12b
jne 0x1403be971
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1403bee54
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, r12d
jne 0x1403bea28
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + reloc.mfc90u.dll_CDHtmlControlSink::AddRef]
lea rdx, str.ProxyServer
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r12d
jne 0x1403bea28
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rsp + reloc.mfc90u.dll_CDHtmlControlSink::AddRef], r12b
je 0x1403bea28
mov rdx, qword [rsi + 0x208]
lea rcx, [rsp + reloc.mfc90u.dll_CDHtmlControlSink::AddRef]
mov ebx, 1
mov al, byte [rcx]
add rcx, rbx
mov byte [rdx], al
add rdx, rbx
cmp al, r12b
jne 0x1403bea14
jmp 0x1403bee54
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x4d0]
mov edx, reloc.mfc90u.dll_COleStreamFile::COleStreamFile
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
or r13, 0xffffffffffffffff
lea ebx, [rax + 1]
lea rdi, [rsp + 0x4d0]
mov rcx, r13
repne scasb al, byte [rdi]
mov eax, dword [str._temp_]
mov rcx, r12
sub rdi, rbx
mov dword [rdi], eax
movzx eax, word [0x14048c46c]
mov word [rdi + 4], ax
mov al, byte [0x14048c46e]
mov byte [rdi + 6], al
mov al, byte [rsp + rcx + 0x4d0]
mov byte [rsp + rcx + 0x6d0], al
add rcx, rbx
cmp al, r12b
jne 0x1403bea7e
xor eax, eax
lea rdi, [rsp + 0x6d0]
mov rcx, r13
repne scasb al, byte [rdi]
mov rax, qword [str.tmpZoso68.htm]
lea rdx, [0x14048c454]
sub rdi, rbx
lea rcx, [rsp + 0x6d0]
mov qword [rdi], rax
mov eax, dword [0x14048c460]
mov dword [rdi + 8], eax
movzx eax, word [0x14048c464]
mov word [rdi + 0xc], ax
call sub.MSVCR90.dll_fopen
lea r8, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
lea rdx, [rsp + 0x4d0]
lea rcx, str.tmpZoso68.htm
mov rdi, rax
call qword [sym.imp.SHELL32.dll_FindExecutableA]
mov rcx, rdi
call sub.MSVCR90.dll_fclose
lea rcx, [rsp + 0x6d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, str.NETSCP
lea rcx, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
call sub.MSVCR90.dll_strstr
cmp rax, r12
jne 0x1403beb4e
lea rdx, str.NETSCAPE
lea rcx, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
call sub.MSVCR90.dll_strstr
cmp rax, r12
jne 0x1403beb47
mov eax, ebx
jmp 0x1403bee56
mov ebp, 4
jmp 0x1403beb53
mov ebp, 6
mov rax, qword [str.NETSCAPE_DETECTED_ver]
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x130]
mov qword [rcx], rax
mov rax, qword [0x14048c430]
mov r8d, 0xa
mov qword [rcx + 8], rax
mov eax, dword [0x14048c438]
mov dword [rcx + 0x10], eax
movzx eax, word [0x14048c43c]
mov word [rcx + 0x14], ax
mov al, byte [0x14048c43e]
mov byte [rcx + 0x16], al
mov ecx, ebp
call sub.MSVCR90.dll__itoa
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, r13
lea rdx, [rsp + 0x130]
repne scasb al, byte [rdi]
sub rdi, rbx
xor ecx, ecx
mov al, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, rbx
test al, al
jne 0x1403bebb8
cmp ebp, 4
lea rcx, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
jne 0x1403bec45
lea rdx, str.COMMU
call sub.MSVCR90.dll_strstr
cmp rax, r12
je 0x1403beb40
movsxd rcx, eax
lea rax, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
lea rdi, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
cdqe
sub rcx, rax
xor eax, eax
mov byte [rsp + rcx + reloc.mfc90u.dll_COleStreamFile::COleStreamFile], r12b
mov rcx, r13
repne scasb al, byte [rdi]
mov rax, qword [str.Usersdefaultprefs.js]
sub rdi, rbx
mov qword [rdi], rax
mov rax, qword [0x14048c410]
mov qword [rdi + 8], rax
mov eax, dword [0x14048c418]
mov dword [rdi + 0x10], eax
movzx eax, word [0x14048c41c]
mov word [rdi + 0x14], ax
mov al, byte [0x14048c41e]
mov byte [rdi + 0x16], al
jmp 0x1403bec7d
mov edx, reloc.mfc90u.dll_COleStreamFile::COleStreamFile
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov byte [rsp + 0x203], r12b
lea rdi, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
mov rcx, r13
repne scasb al, byte [rdi]
mov eax, dword [str......]
sub rdi, rbx
mov dword [rdi], eax
movzx eax, word [0x14048c404]
mov word [rdi + 4], ax
lea rdx, [0x14048c3fc]
lea rcx, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
call sub.MSVCR90.dll_fopen
cmp rax, r12
mov rbp, rax
je 0x1403beb40
mov rcx, rax
jmp 0x1403bedc9
lea rcx, [rsp + 0x60]
mov r8, rbp
mov edx, 0xc8
call sub.MSVCR90.dll_fgets
mov rcx, rbp
call sub.MSVCR90.dll_ferror
cmp eax, r12d
jne 0x1403bedf6
lea rdx, str.network.proxy.http_
lea rcx, [rsp + 0x60]
call sub.MSVCR90.dll_strstr
cmp rax, r12
mov rdx, rax
je 0x1403bed4b
lea rax, [rsp + 0x60]
sub edx, eax
add edx, 0x16
movsxd rcx, edx
cmp byte [rsp + rcx + 0x60], 0x22
je 0x1403bed1f
mov rax, rcx
lea rdi, [rsp + rcx + 0x60]
mov r9b, byte [rdi]
sub rax, rcx
lea r8, [rsp + rax + 0x130]
add rdi, rbx
mov byte [r8], r9b
add edx, ebx
mov r9b, byte [rdi]
add r8, rbx
cmp r9b, 0x22
jne 0x1403bed0b
movsxd rax, edx
mov rdx, qword [rsi + 0x208]
sub rax, rcx
lea rcx, [rsp + 0x130]
mov byte [rsp + rax + 0x130], r12b
mov al, byte [rcx]
add rcx, rbx
mov byte [rdx], al
add rdx, rbx
cmp al, r12b
jne 0x1403bed3c
lea rdx, str.network.proxy.http_port
lea rcx, [rsp + 0x60]
call sub.MSVCR90.dll_strstr
cmp rax, r12
mov rdx, rax
je 0x1403bedc6
lea rax, [rsp + 0x60]
sub edx, eax
add edx, 0x1a
movsxd rcx, edx
cmp byte [rsp + rcx + 0x60], 0x29
je 0x1403beda2
mov rax, rcx
lea rdi, [rsp + rcx + 0x60]
mov r9b, byte [rdi]
sub rax, rcx
lea r8, [rsp + rax + 0x130]
add rdi, rbx
mov byte [r8], r9b
add edx, ebx
mov r9b, byte [rdi]
add r8, rbx
cmp r9b, 0x29
jne 0x1403bed8e
movsxd rax, edx
sub rax, rcx
mov rcx, r12
mov byte [rsp + rax + 0x130], r12b
mov al, byte [rsp + rcx + 0x130]
mov byte [rsp + rcx + 0x48], al
add rcx, rbx
cmp al, r12b
jne 0x1403bedb3
mov rcx, rbp
call sub.MSVCR90.dll_feof
cmp eax, r12d
je 0x1403beca5
mov rdi, qword [rsi + 0x208]
cmp byte [rdi], r12b
je 0x1403beb40
cmp byte [rsp + 0x48], r12b
jne 0x1403bee03
mov byte [rdi], r12b
jmp 0x1403beb40
mov rcx, rbp
call sub.MSVCR90.dll_fclose
jmp 0x1403beb40
xor eax, eax
mov rcx, r13
lea rdx, [rsp + 0x48]
repne scasb al, byte [rdi]
movzx eax, word [0x14042c034]
mov rcx, r13
sub rdi, rbx
mov word [rdi], ax
mov rdi, qword [rsi + 0x208]
xor eax, eax
repne scasb al, byte [rdi]
sub rdi, rbx
xor ecx, ecx
mov al, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, rbx
test al, al
jne 0x1403bee2f
lea rcx, [rsp + 0x48]
call sub.MSVCR90.dll_atoi
mov rcx, rbp
mov dword [rsi + 0x210], eax
call sub.MSVCR90.dll_fclose
xor eax, eax
mov rcx, qword [rsp + 0x8d0]
xor rcx, rsp
call fcn.1403c2380
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret