Function at 0x1803a616
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x1820f00c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x3c], edi
lea eax, [edi + 4]
push eax
call fcn.18012e1c
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x48], 0x181dc620
push eax
mov ecx, ebx
mov dword [ebp - 0x40], 0x200
call fcn.18040a11
push eax
mov ecx, edi
call fcn.18039ace
mov esi, eax
test esi, esi
js 0x1803a9e1
xor esi, esi
push esi
push esi
push esi
push esi
push str.ping_freshness
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1803a6cd
mov esi, 0x181b524c
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x18]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ole32.dll_CoCreateGuid]
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x2c]
call fcn.1800c465
push 1
lea ecx, [ebp - 0x48]
push dword [eax]
push str.ping_freshness
call fcn.18016a96
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.1800687d
mov edi, dword [ebp - 0x3c]
xor esi, esi
mov ecx, ebx
call fcn.18040a85
mov ecx, ebx
test al, al
je 0x1803a6f3
lea eax, [ebp - 0x2c]
push eax
call fcn.180409da
mov cl, byte [edi]
mov edx, eax
call fcn.1802192c
mov ecx, dword [ebp - 0x2c]
mov esi, eax
jmp 0x1803a748
lea eax, [ebp - 0x18]
push eax
call fcn.18040a11
push eax
mov ecx, edi
call fcn.18039732
test al, al
jne 0x1803a758
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.180409da
mov dl, byte [edi]
lea ecx, [ebp - 0x4c]
push eax
call fcn.180217fe
pop ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
push ecx
mov ecx, dword [eax]
mov edx, str.eulaaccepted
push 4
call fcn.180164c4
mov ecx, dword [ebp - 0x4c]
add esp, 0xc
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.1800687d
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.1800687d
test esi, esi
js 0x1803a9e1
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.18040a48
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.1800687d
test esi, esi
je 0x1803a79e
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.18040a48
push 1
lea ecx, [ebp - 0x48]
push dword [eax]
push str.lang
call fcn.18016a96
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.1800687d
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.18041188
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.1800687d
test esi, esi
jne 0x1803a7cc
push 0x181e0630
lea ecx, [ebp - 0x48]
call fcn.18016236
jmp 0x1803a7f3
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.18041188
push 1
lea ecx, [ebp - 0x48]
push dword [eax]
push 0x181e0630
call fcn.18016a96
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.1800687d
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.18040a11
push eax
lea eax, [ebp - 0x60]
mov ecx, edi
push eax
call fcn.18039a1f
lea esi, [ebx + 8]
mov eax, dword [esi]
xchg dword [esi], eax
add eax, 4
lea ecx, [ebp - 0x34]
push eax
call fcn.18012e1c
mov ecx, dword [ebp - 0x34]
mov ebx, dword [ebx + 0xbc]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [esi]
xchg dword [esi], eax
add eax, 4
lea ecx, [ebp - 0x10]
push eax
call fcn.18012e1c
mov esi, dword [ebp - 0x38]
mov ecx, dword [esi + 0x88]
sub ecx, 0x10
call fcn.18009e91
mov ecx, dword [ebp - 0x10]
lea edi, [eax + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x30], edi
call dword [eax + 8]
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.18040b88
mov ecx, dword [ebp - 0x38]
mov esi, eax
lea eax, [ebp - 0x4c]
push eax
call fcn.18040f04
push ebx
lea ecx, [ebp - 0x30]
mov edx, eax
push ecx
push esi
lea ecx, [ebp - 0x60]
call fcn.18021fae
mov ecx, dword [ebp - 0x4c]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.1800687d
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.1800687d
lea ecx, [edi - 0x10]
call fcn.1800687d
mov edi, dword [ebp - 0x3c]
mov cl, byte [edi]
call fcn.1801ef85
test al, al
je 0x1803a8c6
push 1
push 0x181e310c
push str.oeminstall
lea ecx, [ebp - 0x48]
call fcn.18016a96
mov ebx, dword [ebp - 0x38]
mov ecx, ebx
call fcn.18040ea8
test eax, eax
jne 0x1803a8e3
push str.browser
lea ecx, [ebp - 0x48]
call fcn.18016236
jmp 0x1803a8f8
mov ecx, ebx
call fcn.18040ea8
push eax
push str.browser
lea ecx, [ebp - 0x48]
call fcn.18016a44
mov ecx, ebx
call fcn.18040ed6
cmp eax, 2
je 0x1803a92e
mov ecx, ebx
call fcn.18040ed6
mov esi, eax
mov ecx, ebx
lea eax, [ebp - 0x38]
push eax
call fcn.180409da
mov cl, byte [edi]
mov edx, eax
push esi
call fcn.18021c57
pop ecx
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.1800687d
lea eax, [ebp - 0x64]
mov ecx, ebx
push eax
call fcn.180409da
push eax
xor dl, dl
lea ecx, [ebp - 0x5c]
call fcn.180217fe
pop ecx
mov ecx, dword [ebp - 0x64]
add ecx, 0xfffffff0
call fcn.1800687d
and dword [ebp - 0x54], 0
mov edi, 0x181dc620
push 0
push ecx
push 0xf003f
push ecx
push ecx
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x50], 0x200
call fcn.18016313
test eax, eax
js 0x1803a9ac
mov ecx, ebx
call fcn.1804114d
push edx
push eax
lea ecx, [ebp - 0x3c]
call fcn.1801106d
pop ecx
pop ecx
push 1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x58]
push str.lastrun
call fcn.18016a96
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.1800687d
xor esi, esi
mov dword [ebp - 0x58], edi
cmp dword [ebp - 0x54], esi
je 0x1803a9c9
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 0x200
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.1800687d
mov ecx, dword [ebp - 0x60]
lea ecx, [ecx - 0x10]
call fcn.1800687d
jmp 0x1803a9e6
mov edi, 0x181dc620
cmp dword [ebp - 0x44], 0
mov dword [ebp - 0x48], edi
je 0x1803aa03
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0x200
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1814cf3d
leave
ret 4