Function at 0x18052801
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x181d100c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
lea eax, [edi + 4]
push eax
call fcn.1801558d
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x1819e70c
push eax
push ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], esi
push eax
mov ecx, ebx
mov dword [ebp - 0xc], 0x200
call fcn.1805bbde
pop ecx
push eax
mov ecx, edi
call fcn.18051a7e
mov esi, eax
test esi, esi
js 0x18052b1c
xor eax, eax
push eax
push eax
push eax
push eax
push str.ping_freshness
lfence
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x180528bf
mov esi, 0x1816fc9c
lea edi, [ebp - 0x38]
lea eax, [ebp - 0x38]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ole32.dll_CoCreateGuid]
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x18]
call fcn.1800d33d
push 1
lea ecx, [ebp - 0x14]
push dword [eax]
push str.ping_freshness
call fcn.1801a832
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov edi, dword [ebp - 0x44]
mov ecx, ebx
call fcn.1805bc91
mov ecx, ebx
lfence
test al, al
je 0x180528e3
lea eax, [ebp - 0x18]
push eax
call fcn.1805bbbe
mov cl, byte [edi]
mov edx, eax
call fcn.1802abf1
jmp 0x1805290f
lea eax, [ebp - 0x38]
push eax
call fcn.1805bbde
push eax
mov ecx, edi
call fcn.180514e2
test al, al
jne 0x18052924
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
lfence
call fcn.1805bbbe
mov cl, byte [edi]
mov edx, eax
call fcn.1802ab9d
mov ecx, dword [ebp - 0x18]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.18006f52
test esi, esi
js 0x18052b1c
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
lfence
call fcn.1805bc35
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.18006f52
test esi, esi
je 0x1805296d
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1805bc35
push 1
lea ecx, [ebp - 0x14]
push dword [eax]
push str.lang
call fcn.1801a832
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18006f52
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1805c7c4
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.18006f52
test esi, esi
jne 0x1805299b
push 0x181a82c0
lea ecx, [ebp - 0x14]
call fcn.18019e02
jmp 0x180529c2
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1805c7c4
push 1
lea ecx, [ebp - 0x14]
push dword [eax]
push 0x181a82c0
call fcn.1801a832
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18006f52
lea eax, [ebp - 0x24]
xor esi, esi
push eax
mov ecx, ebx
mov dword [ebp - 0x28], esi
call fcn.1805bbde
push eax
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.1805187d
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
lea esi, [ebx + 8]
mov eax, dword [esi]
xchg dword [esi], eax
add eax, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.1801558d
mov edi, dword [ebx + 0xfc]
lea ecx, [ebp - 0x1c]
call fcn.180155b8
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
mov eax, dword [esi]
xchg dword [esi], eax
add eax, 4
lea ecx, [ebp - 0x30]
push eax
call fcn.1801558d
mov ecx, dword [ebx + 0x88]
sub ecx, 0x10
call fcn.1800a0ba
add eax, 0x10
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], eax
call fcn.180155b8
lea eax, [ebp - 0x4c]
mov ecx, ebx
push eax
call fcn.1805be2a
mov esi, eax
mov ecx, ebx
lea eax, [ebp - 0x48]
push eax
call fcn.1805c258
push edi
lea ecx, [ebp - 0x18]
mov edx, eax
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.1802c4c2
mov ecx, dword [ebp - 0x48]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov edi, dword [ebp - 0x44]
mov cl, byte [edi]
call fcn.18026700
test al, al
je 0x18052aa7
push 1
push 0x181ad0e8
push 0x181add68
lea ecx, [ebp - 0x14]
call fcn.1801a832
mov ecx, ebx
call fcn.1805c1c2
test eax, eax
jne 0x18052ac1
push str.browser
lea ecx, [ebp - 0x14]
call fcn.18019e02
jmp 0x18052ad6
mov ecx, ebx
call fcn.1805c1c2
push eax
push str.browser
lea ecx, [ebp - 0x14]
call fcn.1801a7de
mov ecx, ebx
call fcn.1805c20d
cmp eax, 2
je 0x18052b0f
mov ecx, ebx
lfence
call fcn.1805c20d
mov esi, eax
mov ecx, ebx
lea eax, [ebp - 0x44]
push eax
call fcn.1805bbbe
mov cl, byte [edi]
mov edx, eax
push esi
call fcn.1802c0fc
pop ecx
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.18006f52
mov ecx, dword [ebp - 0x28]
xor esi, esi
lea ecx, [ecx - 0x10]
call fcn.18006f52
cmp dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x1819e70c
je 0x18052b3d
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x200
lea ecx, [ebp - 0x40]
call fcn.180155b8
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811c608
leave
ret 4