Function at 0x40a590
Capabilities:
Delete registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x643168
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.004024f0
mov dword [esp + 0x28], 0
lea eax, [esp + 0x14]
push eax
push 0x45f
mov ecx, esi
call fcn.005fc629
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40a61c
inc eax
push eax
push ecx
mov ecx, dword [0x75dbe4]
push 1
push 0
push str.HttpsProxy
push ecx
call ebp
mov edx, dword [esp + 0x14]
push edx
lea edi, [esi + 0x370]
push 0x678ea8
push edi
call fcn.00402f60
add esp, 0xc
jmp 0x40a641
mov eax, dword [0x75dbe4]
push str.HttpsProxy
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0
lea edi, [esi + 0x370]
push 0x67997c
mov ecx, edi
call fcn.00402950
lea ecx, [esp + 0x14]
push ecx
push 0x461
mov ecx, esi
call fcn.005fc629
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x40a68d
mov edx, dword [0x75dbe4]
inc eax
push eax
push ecx
push 1
push 0
push str.HttpsPort
push edx
call ebp
mov eax, dword [esp + 0x14]
push eax
lea ebx, [esi + 0x374]
push 0x678ea8
push ebx
call fcn.00402f60
add esp, 0xc
jmp 0x40a6b3
mov ecx, dword [0x75dbe4]
push str.HttpsPort
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0
lea ebx, [esi + 0x374]
push 0x67997c
mov ecx, ebx
call fcn.00402950
push 0x45e
mov ecx, esi
call fcn.005f5a75
mov edx, dword [eax + 0x20]
push 0
push 0
push pe_nt_image_headers32
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [edi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a6e1
sub eax, edx
je 0x40a6fc
mov eax, dword [ebx]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a6f1
sub eax, edx
jne 0x40a704
mov dword [esp + 0x18], 0
mov ecx, dword [0x75dbe4]
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.UseHttpsProxy
push ecx
call ebp
cmp dword [esp + 0x18], 0
lea eax, [esp + 0x14]
push eax
setne dl
push 0x46a
mov ecx, esi
mov byte [esi + 0x432], dl
call fcn.00409e60
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x40a77d
inc eax
push eax
push ecx
mov ecx, dword [0x75dbe4]
push 1
push 0
push str.HttpsUserName
push ecx
call ebp
mov edx, dword [esp + 0x14]
push edx
lea eax, [esi + 0x388]
push 0x678ea8
push eax
call fcn.00402f60
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add esp, 0xc
jmp 0x40a7a3
mov ecx, dword [0x75dbe4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.HttpsUserName
push ecx
call ebx
push 0
lea ecx, [esi + 0x388]
push 0x67997c
call fcn.00402950
push 0
push 0x67997c
lea ecx, [esp + 0x1c]
call fcn.00402950
lea edx, [esp + 0x14]
push edx
push 0x46b
mov ecx, esi
call fcn.00409e60
mov eax, dword [esp + 0x14]
mov ecx, dword [0x75dbe4]
push 1
push eax
push str.HttpsEncPassword
push str.HttpsPasword
push ecx
call fcn.005ba700
mov edx, dword [esp + 0x28]
push edx
lea eax, [esi + 0x38c]
push 0x678ea8
push eax
call fcn.00402f60
add esp, 0x20
lea ecx, [esp + 0x14]
push ecx
push 0x44f
mov ecx, esi
call fcn.005fc629
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x40a846
mov edx, dword [0x75dbe4]
inc eax
push eax
push ecx
push 1
push 0
push str.HttpProxy
push edx
call ebp
mov eax, dword [esp + 0x14]
push eax
lea edi, [esi + 0x368]
push 0x678ea8
push edi
call fcn.00402f60
add esp, 0xc
jmp 0x40a868
mov ecx, dword [0x75dbe4]
push str.HttpProxy
push ecx
call ebx
push 0
lea edi, [esi + 0x368]
push 0x67997c
mov ecx, edi
call fcn.00402950
lea edx, [esp + 0x14]
push edx
push 0x450
mov ecx, esi
call fcn.005fc629
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x40a8b3
inc eax
push eax
mov eax, dword [0x75dbe4]
push ecx
push 1
push 0
push str.HttpPort
push eax
call ebp
mov ecx, dword [esp + 0x14]
push ecx
lea ebx, [esi + 0x36c]
push 0x678ea8
push ebx
call fcn.00402f60
add esp, 0xc
jmp 0x40a8d5
mov edx, dword [0x75dbe4]
push str.HttpPort
push edx
call ebx
push 0
lea ebx, [esi + 0x36c]
push 0x67997c
mov ecx, ebx
call fcn.00402950
push 0x44e
mov ecx, esi
call fcn.005f5a75
mov eax, dword [eax + 0x20]
push 0
push 0
push pe_nt_image_headers32
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [edi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a903
sub eax, edx
je 0x40a91e
mov eax, dword [ebx]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a913
sub eax, edx
jne 0x40a926
mov dword [esp + 0x18], 0
mov edx, dword [0x75dbe4]
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push 0
push str.UseHttpProxy
push edx
call ebp
cmp dword [esp + 0x18], 0
lea ecx, [esp + 0x14]
push ecx
setne al
push 0x451
mov ecx, esi
mov byte [esi + 0x430], al
call fcn.00409e60
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
mov edx, dword [0x75dbe4]
test eax, eax
je 0x40a99f
inc eax
push eax
push ecx
push 1
push 0
push str.HttpUserName
push edx
call ebp
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esi + 0x380]
push 0x678ea8
push ecx
call fcn.00402f60
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add esp, 0xc
jmp 0x40a9bf
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.HttpUserName
push edx
call ebx
push 0
lea ecx, [esi + 0x380]
push 0x67997c
call fcn.00402950
push 0
push 0x67997c
lea ecx, [esp + 0x1c]
call fcn.00402950
lea eax, [esp + 0x14]
push eax
push 0x452
mov ecx, esi
call fcn.00409e60
mov ecx, dword [esp + 0x14]
mov edx, dword [0x75dbe4]
push 1
push ecx
push str.HttpEncPassword
push str.HttpPasword
push edx
call fcn.005ba700
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esi + 0x384]
push 0x678ea8
push ecx
call fcn.00402f60
add esp, 0x20
lea edx, [esp + 0x14]
push edx
push 0x455
mov ecx, esi
call fcn.005fc629
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x40aa61
inc eax
push eax
mov eax, dword [0x75dbe4]
push ecx
push 1
push 0
push str.FtpProxy
push eax
call ebp
mov ecx, dword [esp + 0x14]
push ecx
lea edi, [esi + 0x378]
push 0x678ea8
push edi
call fcn.00402f60
add esp, 0xc
jmp 0x40aa83
mov edx, dword [0x75dbe4]
push str.FtpProxy
push edx
call ebx
push 0
lea edi, [esi + 0x378]
push 0x67997c
mov ecx, edi
call fcn.00402950
lea eax, [esp + 0x14]
push eax
push 0x456
mov ecx, esi
call fcn.005fc629
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x40aacf
inc eax
push eax
push ecx
mov ecx, dword [0x75dbe4]
push 1
push 0
push str.FtpPort
push ecx
call ebp
mov edx, dword [esp + 0x14]
push edx
lea ebx, [esi + 0x37c]
push 0x678ea8
push ebx
call fcn.00402f60
add esp, 0xc
jmp 0x40aaf0
mov eax, dword [0x75dbe4]
push str.FtpPort
push eax
call ebx
push 0
lea ebx, [esi + 0x37c]
push 0x67997c
mov ecx, ebx
call fcn.00402950
push 0x454
mov ecx, esi
call fcn.005f5a75
mov ecx, dword [eax + 0x20]
push 0
push 0
push pe_nt_image_headers32
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [edi]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ab20
sub eax, edx
je 0x40ab3b
mov eax, dword [ebx]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ab30
sub eax, edx
jne 0x40ab43
mov dword [esp + 0x18], 0
mov eax, dword [0x75dbe4]
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push 0
push str.UseFtpProxy
push eax
call ebp
cmp dword [esp + 0x18], 0
lea edx, [esp + 0x14]
setne cl
push edx
mov byte [esi + 0x431], cl
push 0x457
mov ecx, esi
call fcn.00409e60
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x40abba
inc eax
push eax
mov eax, dword [0x75dbe4]
push ecx
push 1
push 0
push str.FtpUserName
push eax
call ebp
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esi + 0x390]
push 0x678ea8
push edx
call fcn.00402f60
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add esp, 0xc
jmp 0x40abdf
mov eax, dword [0x75dbe4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.FtpUserName
push eax
call edi
push 0
lea ecx, [esi + 0x390]
push 0x67997c
call fcn.00402950
push 0
push 0x67997c
lea ecx, [esp + 0x1c]
call fcn.00402950
lea ecx, [esp + 0x14]
push ecx
push 0x458
mov ecx, esi
call fcn.00409e60
mov edx, dword [esp + 0x14]
mov eax, dword [0x75dbe4]
push 1
push edx
push str.FtpEncPassword
push str.FtpPasword
push eax
call fcn.005ba700
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esi + 0x394]
push 0x678ea8
push edx
call fcn.00402f60
add esp, 0x20
lea eax, [esp + 0x14]
push eax
push 0x70b
mov ecx, esi
call fcn.005fc629
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x40ac83
push eax
lea ebx, [esi + 0x398]
push 0x678ea8
push ebx
call fcn.00402f60
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 0xc]
add esp, 0xc
inc ecx
push ecx
mov ecx, dword [0x75dbe4]
push eax
push 1
push 0
push str.SocksHost
push ecx
call ebp
jmp 0x40ac9e
mov edx, dword [0x75dbe4]
push str.SocksHost
push edx
call edi
lea ebx, [esi + 0x398]
mov ecx, ebx
call fcn.00402050
lea eax, [esp + 0x14]
push eax
push 0x70c
mov ecx, esi
call fcn.005fc629
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x40acec
push eax
lea edi, [esi + 0x39c]
push 0x678ea8
push edi
call fcn.00402f60
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 0xc]
add esp, 0xc
inc ecx
push ecx
mov ecx, dword [0x75dbe4]
push eax
push 1
push 0
push str.SocksPort
push ecx
call ebp
jmp 0x40ad07
mov edx, dword [0x75dbe4]
push str.SocksPort
push edx
call edi
lea edi, [esi + 0x39c]
mov ecx, edi
call fcn.00402050
mov eax, dword [esi + 0x3ac]
push 0
push 0
push pe_nt_image_headers32
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x40ad31
mov dword [esp + 0x18], 1
mov eax, dword [ebx]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ad36
sub eax, edx
je 0x40ad51
mov eax, dword [edi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ad46
sub eax, edx
jne 0x40ad59
mov dword [esp + 0x18], 0
mov edx, dword [0x75dbe4]
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push 0
push str.bUseSocks
push edx
call ebp
cmp dword [esp + 0x18], 0
lea ecx, [esp + 0x14]
push ecx
setne al
push 0x70d
mov ecx, esi
mov byte [esi + 0x433], al
call fcn.00409e60
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
mov edx, dword [0x75dbe4]
test eax, eax
je 0x40adcc
inc eax
push eax
push ecx
push 1
push 0
push str.SocksUser
push edx
call ebp
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esi + 0x3a0]
push 0x678ea8
push ecx
call fcn.00402f60
add esp, 0xc
jmp 0x40ade3
push str.SocksUser
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esi + 0x3a0]
call fcn.00402050
lea eax, [esp + 0x14]
push eax
push 0x70e
mov ecx, esi
call fcn.00409e60
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x40ae2a
push eax
lea ecx, [esi + 0x3a4]
push 0x678ea8
push ecx
call fcn.00402f60
mov edx, dword [esp + 0x20]
mov eax, dword [0x75dbe4]
push edx
push str.SocksPass
push eax
call fcn.005ba800
add esp, 0x18
jmp 0x40ae47
mov ecx, dword [0x75dbe4]
push str.SocksPass
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esi + 0x3a4]
call fcn.00402050
lea edi, [esi + 0x428]
push 0x6f4
mov ecx, esi
mov dword [edi], 5
call fcn.005f5a75
mov edx, dword [eax + 0x20]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push pe_nt_image_headers32
push edx
call ebx
cmp eax, 1
jne 0x40ae7f
mov dword [edi], 4
mov eax, dword [0x75dbe4]
push 4
push edi
push 4
push 0
push str.SocksType
push eax
call ebp
mov ecx, dword [esi + 0x94]
push 0
push 0
push pe_nt_image_headers32
push ecx
call ebx
xor edx, edx
push 4
mov dword [esi + 0x42c], eax
mov ecx, dword [0x75dbe4]
test eax, eax
lea eax, [esp + 0x1c]
push eax
push 4
setne dl
push 0
push str.Socks5ProxyDNS
push ecx
mov dword [esp + 0x30], edx
call ebp
mov ecx, 0x75e770
mov dword [0x75e774], 0x10
call fcn.005462c0
mov ecx, esi
call fcn.005f67d9
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00402560
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret