Function at 0x10009934
Capabilities:
Get file size
Query or enumerate registry value

Disassembly:
mov eax, 0x1006782e
call fcn.100575f8
sub esp, 0x264
mov eax, dword [0x10084500]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push str.SuccConn:
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x250], ebx
call fcn.10001636
mov eax, dword [0x10085608]
or eax, dword [0x1008560c]
mov dword [ebp - 4], ebx
je 0x100099be
push 0x10085608
call fcn.10057ef0
cmp eax, ebx
pop ecx
je 0x100099b7
push 0x18
push eax
lea ecx, [ebp - 0x270]
call fcn.10006ae5
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.10002e80
push ebx
push 1
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], bl
call fcn.10001293
jmp 0x100099cb
push str.invalid_time
jmp 0x100099c3
push str.never
lea ecx, [ebp - 0x30]
call fcn.10003017
push str._Conn:
lea ecx, [ebp - 0x30]
call fcn.10003017
mov eax, dword [0x10085600]
or eax, dword [0x10085604]
je 0x10009a2c
push 0x10085600
call fcn.10057ef0
cmp eax, ebx
pop ecx
je 0x10009a25
push 0x18
push eax
lea ecx, [ebp - 0x270]
call fcn.10006ae5
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.10002e80
push ebx
push 1
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], bl
call fcn.10001293
jmp 0x10009a39
push str.invalid_value
jmp 0x10009a31
push str.never
lea ecx, [ebp - 0x30]
call fcn.10003017
push str._ConnNum:
lea ecx, [ebp - 0x30]
call fcn.10003017
push dword [0x10085610]
lea eax, [ebp - 0x44]
push 0x1006d0ac
push eax
call fcn.10057e98
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x30]
call fcn.10003017
mov edi, 0x1006ca8c
push edi
lea ecx, [ebp - 0x30]
call fcn.10003017
push str.File:
lea ecx, [ebp - 0x30]
call fcn.10003017
push 0x10085a50
lea ecx, [ebp - 0x30]
call fcn.10003017
push str._Ini_size:
lea ecx, [ebp - 0x30]
call fcn.10003017
mov eax, dword [0x10085fc8]
cmp dword [eax + 0x20], 0x10
jb 0x10009aae
mov eax, dword [eax + 0xc]
jmp 0x10009ab1
add eax, 0xc
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.10057da0
pop ecx
pop ecx
push ebx
push 0x80
push 3
push ebx
push 1
push 1
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, ebx
je 0x10009b18
cmp esi, 0xffffffff
je 0x10009b18
push 0xa
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x254]
push eax
push esi
mov dword [ebp - 0x254], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
call fcn.1005b43a
add esp, 0xc
push eax
lea ecx, [ebp - 0x30]
call fcn.10003017
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea ecx, [ebp - 0x30]
call fcn.10003017
lea eax, [ebp - 0x250]
push eax
push 0x20019
push ebx
push str.http_shellopencommand
push 0x80000000
mov dword [ebp - 0x250], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10009ba8
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x148]
push eax
push ebx
push ebx
push 0x1006cd39
push dword [ebp - 0x250]
mov dword [ebp - 0x254], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10009b9c
push str.DefBrowser:
lea ecx, [ebp - 0x30]
call fcn.10003017
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x30]
call fcn.10003017
push edi
lea ecx, [ebp - 0x30]
call fcn.10003017
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.1002ec40
pop ecx
jmp 0x10009bc0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], ebx
call fcn.100015f3
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.10001293
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.100568ae
pop edi
pop esi
pop ebx
leave
ret