Function at 0x1403aa440
Capabilities:
Delete file
Get common file path
Get proxy
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x8e0
mov rax, qword [0x1404e41f8]
xor rax, rsp
mov qword [rsp + 0x8d0], rax
mov rax, qword [rcx + 0x208]
xor r12d, r12d
mov dword [rsp + 0x34], 0xc8
mov dword [rsp + 0x30], r12d
mov byte [rax], r12b
cmp qword [rcx + reloc.mfc90u.dll_CDataSourceControl::CDataSourceControl], r12
mov rsi, rcx
mov byte [rsp + 0x48], r12b
je 0x1403aa527
mov rcx, qword [rcx + 0x280]
lea ebx, [r12 + 0x26]
lea r9, [rsp + 0x30]
mov edx, ebx
xor r8d, r8d
call qword [rsi + COleDispatchException::~COleDispatchException]
mov ecx, dword [rsp + 0x30]
cmp ecx, r12d
je 0x1403aa527
mov rdx, rcx
lea ecx, [rbx + 0x1a]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, qword [rsi + 0x280]
lea r9, [rsp + 0x30]
mov r8, rax
mov edx, ebx
mov rdi, rax
call qword [rsi + COleDispatchException::~COleDispatchException]
cmp eax, r12d
je 0x1403aa51e
mov rcx, qword [rdi + 8]
cmp rcx, r12
je 0x1403aa510
mov rdx, qword [rsi + 0x208]
lea ebx, [r12 + 1]
mov al, byte [rcx]
add rcx, rbx
mov byte [rdx], al
add rdx, rbx
cmp al, r12b
jne 0x1403aa501
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1403aa9e4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, r12d
jne 0x1403aa5b8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + reloc.mfc90u.dll_CDHtmlControlSink::AddRef]
lea rdx, str.ProxyServer
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r12d
jne 0x1403aa5b8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rsp + reloc.mfc90u.dll_CDHtmlControlSink::AddRef], r12b
je 0x1403aa5b8
mov rdx, qword [rsi + 0x208]
lea rcx, [rsp + reloc.mfc90u.dll_CDHtmlControlSink::AddRef]
mov ebx, 1
mov al, byte [rcx]
add rcx, rbx
mov byte [rdx], al
add rdx, rbx
cmp al, r12b
jne 0x1403aa5a4
jmp 0x1403aa9e4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x4d0]
mov edx, reloc.mfc90u.dll_COleStreamFile::COleStreamFile
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
or r13, 0xffffffffffffffff
lea ebx, [rax + 1]
lea rdi, [rsp + 0x4d0]
mov rcx, r13
repne scasb al, byte [rdi]
mov eax, dword [str._temp_]
mov rcx, r12
sub rdi, rbx
mov dword [rdi], eax
movzx eax, word [0x140479c4c]
mov word [rdi + 4], ax
mov al, byte [0x140479c4e]
mov byte [rdi + 6], al
mov al, byte [rsp + rcx + 0x4d0]
mov byte [rsp + rcx + 0x6d0], al
add rcx, rbx
cmp al, r12b
jne 0x1403aa60e
xor eax, eax
lea rdi, [rsp + 0x6d0]
mov rcx, r13
repne scasb al, byte [rdi]
mov rax, qword [str.tmpZoso68.htm]
lea rdx, [0x140479c34]
sub rdi, rbx
lea rcx, [rsp + 0x6d0]
mov qword [rdi], rax
mov eax, dword [0x140479c40]
mov dword [rdi + 8], eax
movzx eax, word [0x140479c44]
mov word [rdi + 0xc], ax
call sub.MSVCR90.dll_fopen
lea r8, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
lea rdx, [rsp + 0x4d0]
lea rcx, str.tmpZoso68.htm
mov rdi, rax
call qword [sym.imp.SHELL32.dll_FindExecutableA]
mov rcx, rdi
call sub.MSVCR90.dll_fclose
lea rcx, [rsp + 0x6d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, str.NETSCP
lea rcx, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
call sub.MSVCR90.dll_strstr
cmp rax, r12
jne 0x1403aa6de
lea rdx, str.NETSCAPE
lea rcx, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
call sub.MSVCR90.dll_strstr
cmp rax, r12
jne 0x1403aa6d7
mov eax, ebx
jmp 0x1403aa9e6
mov ebp, 4
jmp 0x1403aa6e3
mov ebp, 6
mov rax, qword [str.NETSCAPE_DETECTED_ver]
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x130]
mov qword [rcx], rax
mov rax, qword [0x140479c10]
mov r8d, 0xa
mov qword [rcx + 8], rax
mov eax, dword [0x140479c18]
mov dword [rcx + 0x10], eax
movzx eax, word [0x140479c1c]
mov word [rcx + 0x14], ax
mov al, byte [0x140479c1e]
mov byte [rcx + 0x16], al
mov ecx, ebp
call sub.MSVCR90.dll__itoa
xor eax, eax
lea rdi, [rsp + 0x60]
mov rcx, r13
lea rdx, [rsp + 0x130]
repne scasb al, byte [rdi]
sub rdi, rbx
xor ecx, ecx
mov al, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, rbx
test al, al
jne 0x1403aa748
cmp ebp, 4
lea rcx, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
jne 0x1403aa7d5
lea rdx, str.COMMU
call sub.MSVCR90.dll_strstr
cmp rax, r12
je 0x1403aa6d0
movsxd rcx, eax
lea rax, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
lea rdi, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
cdqe
sub rcx, rax
xor eax, eax
mov byte [rsp + rcx + reloc.mfc90u.dll_COleStreamFile::COleStreamFile], r12b
mov rcx, r13
repne scasb al, byte [rdi]
mov rax, qword [str.Usersdefaultprefs.js]
sub rdi, rbx
mov qword [rdi], rax
mov rax, qword [0x140479bf0]
mov qword [rdi + 8], rax
mov eax, dword [0x140479bf8]
mov dword [rdi + 0x10], eax
movzx eax, word [0x140479bfc]
mov word [rdi + 0x14], ax
mov al, byte [0x140479bfe]
mov byte [rdi + 0x16], al
jmp 0x1403aa80d
mov edx, reloc.mfc90u.dll_COleStreamFile::COleStreamFile
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov byte [rsp + 0x203], r12b
lea rdi, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
mov rcx, r13
repne scasb al, byte [rdi]
mov eax, dword [str......]
sub rdi, rbx
mov dword [rdi], eax
movzx eax, word [0x140479be4]
mov word [rdi + 4], ax
lea rdx, [0x140479bdc]
lea rcx, [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile]
call sub.MSVCR90.dll_fopen
cmp rax, r12
mov rbp, rax
je 0x1403aa6d0
mov rcx, rax
jmp 0x1403aa959
lea rcx, [rsp + 0x60]
mov r8, rbp
mov edx, 0xc8
call sub.MSVCR90.dll_fgets
mov rcx, rbp
call sub.MSVCR90.dll_ferror
cmp eax, r12d
jne 0x1403aa986
lea rdx, str.network.proxy.http_
lea rcx, [rsp + 0x60]
call sub.MSVCR90.dll_strstr
cmp rax, r12
mov rdx, rax
je 0x1403aa8db
lea rax, [rsp + 0x60]
sub edx, eax
add edx, 0x16
movsxd rcx, edx
cmp byte [rsp + rcx + 0x60], 0x22
je 0x1403aa8af
mov rax, rcx
lea rdi, [rsp + rcx + 0x60]
mov r9b, byte [rdi]
sub rax, rcx
lea r8, [rsp + rax + 0x130]
add rdi, rbx
mov byte [r8], r9b
add edx, ebx
mov r9b, byte [rdi]
add r8, rbx
cmp r9b, 0x22
jne 0x1403aa89b
movsxd rax, edx
mov rdx, qword [rsi + 0x208]
sub rax, rcx
lea rcx, [rsp + 0x130]
mov byte [rsp + rax + 0x130], r12b
mov al, byte [rcx]
add rcx, rbx
mov byte [rdx], al
add rdx, rbx
cmp al, r12b
jne 0x1403aa8cc
lea rdx, str.network.proxy.http_port
lea rcx, [rsp + 0x60]
call sub.MSVCR90.dll_strstr
cmp rax, r12
mov rdx, rax
je 0x1403aa956
lea rax, [rsp + 0x60]
sub edx, eax
add edx, 0x1a
movsxd rcx, edx
cmp byte [rsp + rcx + 0x60], 0x29
je 0x1403aa932
mov rax, rcx
lea rdi, [rsp + rcx + 0x60]
mov r9b, byte [rdi]
sub rax, rcx
lea r8, [rsp + rax + 0x130]
add rdi, rbx
mov byte [r8], r9b
add edx, ebx
mov r9b, byte [rdi]
add r8, rbx
cmp r9b, 0x29
jne 0x1403aa91e
movsxd rax, edx
sub rax, rcx
mov rcx, r12
mov byte [rsp + rax + 0x130], r12b
mov al, byte [rsp + rcx + 0x130]
mov byte [rsp + rcx + 0x48], al
add rcx, rbx
cmp al, r12b
jne 0x1403aa943
mov rcx, rbp
call sub.MSVCR90.dll_feof
cmp eax, r12d
je 0x1403aa835
mov rdi, qword [rsi + 0x208]
cmp byte [rdi], r12b
je 0x1403aa6d0
cmp byte [rsp + 0x48], r12b
jne 0x1403aa993
mov byte [rdi], r12b
jmp 0x1403aa6d0
mov rcx, rbp
call sub.MSVCR90.dll_fclose
jmp 0x1403aa6d0
xor eax, eax
mov rcx, r13
lea rdx, [rsp + 0x48]
repne scasb al, byte [rdi]
movzx eax, word [0x14041a058]
mov rcx, r13
sub rdi, rbx
mov word [rdi], ax
mov rdi, qword [rsi + 0x208]
xor eax, eax
repne scasb al, byte [rdi]
sub rdi, rbx
xor ecx, ecx
mov al, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, rbx
test al, al
jne 0x1403aa9bf
lea rcx, [rsp + 0x48]
call sub.MSVCR90.dll_atoi
mov rcx, rbp
mov dword [rsi + 0x210], eax
call sub.MSVCR90.dll_fclose
xor eax, eax
mov rcx, qword [rsp + 0x8d0]
xor rcx, rsp
call fcn.1403addc0
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret