Function at 0x1803dd09
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x1822b00c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x3c], edi
lea eax, [edi + 4]
push eax
call fcn.1801396e
and dword [ebp - 0x44], 0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x48], 0x181f4a50
push eax
mov ecx, ebx
mov dword [ebp - 0x40], 0x200
call fcn.180441e5
push eax
mov ecx, edi
call fcn.1803d1c1
mov esi, eax
test esi, esi
js 0x1803e0d4
xor esi, esi
push esi
push esi
push esi
push esi
push str.ping_freshness
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1803ddc0
mov esi, 0x181c827c
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x18]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ole32.dll_CoCreateGuid]
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x2c]
call fcn.1800c532
push 1
lea ecx, [ebp - 0x48]
push dword [eax]
push str.ping_freshness
call fcn.18018014
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.1800694d
mov edi, dword [ebp - 0x3c]
xor esi, esi
mov ecx, ebx
call fcn.18044259
mov ecx, ebx
test al, al
je 0x1803dde6
lea eax, [ebp - 0x2c]
push eax
call fcn.180441ae
mov cl, byte [edi]
mov edx, eax
call fcn.180218b7
mov ecx, dword [ebp - 0x2c]
mov esi, eax
jmp 0x1803de3b
lea eax, [ebp - 0x18]
push eax
call fcn.180441e5
push eax
mov ecx, edi
call fcn.1803cdfb
test al, al
jne 0x1803de4b
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.180441ae
mov dl, byte [edi]
lea ecx, [ebp - 0x4c]
push eax
call fcn.18021788
pop ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
push ecx
mov ecx, dword [eax]
mov edx, str.eulaaccepted
push 4
call fcn.18017a42
mov ecx, dword [ebp - 0x4c]
add esp, 0xc
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.1800694d
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.1800694d
test esi, esi
js 0x1803e0d4
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.1804421c
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.1800694d
test esi, esi
je 0x1803de91
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.1804421c
push 1
lea ecx, [ebp - 0x48]
push dword [eax]
push str.lang
call fcn.18018014
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.1800694d
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.180448f1
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.1800694d
test esi, esi
jne 0x1803debf
push 0x181f9088
lea ecx, [ebp - 0x48]
call fcn.180177b4
jmp 0x1803dee6
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.180448f1
push 1
lea ecx, [ebp - 0x48]
push dword [eax]
push 0x181f9088
call fcn.18018014
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.1800694d
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.180441e5
push eax
lea eax, [ebp - 0x60]
mov ecx, edi
push eax
call fcn.1803d110
lea esi, [ebx + 8]
mov eax, dword [esi]
xchg dword [esi], eax
add eax, 4
lea ecx, [ebp - 0x34]
push eax
call fcn.1801396e
mov ecx, dword [ebp - 0x34]
mov ebx, dword [ebx + 0xbc]
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [esi]
xchg dword [esi], eax
add eax, 4
lea ecx, [ebp - 0x10]
push eax
call fcn.1801396e
mov esi, dword [ebp - 0x38]
mov ecx, dword [esi + 0x88]
sub ecx, 0x10
call fcn.18009f92
mov ecx, dword [ebp - 0x10]
lea edi, [eax + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x30], edi
call dword [eax + 8]
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.1804435c
mov ecx, dword [ebp - 0x38]
mov esi, eax
lea eax, [ebp - 0x4c]
push eax
call fcn.1804466d
push ebx
lea ecx, [ebp - 0x30]
mov edx, eax
push ecx
push esi
lea ecx, [ebp - 0x60]
call fcn.18021fca
mov ecx, dword [ebp - 0x4c]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.1800694d
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.1800694d
lea ecx, [edi - 0x10]
call fcn.1800694d
mov edi, dword [ebp - 0x3c]
mov cl, byte [edi]
call fcn.180211f8
test al, al
je 0x1803dfb9
push 1
push 0x181fc970
push str.oeminstall
lea ecx, [ebp - 0x48]
call fcn.18018014
mov ebx, dword [ebp - 0x38]
mov ecx, ebx
call fcn.18044611
test eax, eax
jne 0x1803dfd6
push str.browser
lea ecx, [ebp - 0x48]
call fcn.180177b4
jmp 0x1803dfeb
mov ecx, ebx
call fcn.18044611
push eax
push str.browser
lea ecx, [ebp - 0x48]
call fcn.18017fc2
mov ecx, ebx
call fcn.1804463f
cmp eax, 2
je 0x1803e021
mov ecx, ebx
call fcn.1804463f
mov esi, eax
mov ecx, ebx
lea eax, [ebp - 0x38]
push eax
call fcn.180441ae
mov cl, byte [edi]
mov edx, eax
push esi
call fcn.18021c73
pop ecx
mov ecx, dword [ebp - 0x38]
lea ecx, [ecx - 0x10]
call fcn.1800694d
lea eax, [ebp - 0x64]
mov ecx, ebx
push eax
call fcn.180441ae
push eax
xor dl, dl
lea ecx, [ebp - 0x5c]
call fcn.18021788
pop ecx
mov ecx, dword [ebp - 0x64]
add ecx, 0xfffffff0
call fcn.1800694d
and dword [ebp - 0x54], 0
mov edi, 0x181f4a50
push 0
push ecx
push 0xf003f
push ecx
push ecx
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x50], 0x200
call fcn.18017891
test eax, eax
js 0x1803e09f
mov ecx, ebx
call fcn.180448b6
push edx
push eax
lea ecx, [ebp - 0x3c]
call fcn.18011bbf
pop ecx
pop ecx
push 1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x58]
push str.lastrun
call fcn.18018014
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.1800694d
xor esi, esi
mov dword [ebp - 0x58], edi
cmp dword [ebp - 0x54], esi
je 0x1803e0bc
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 0x200
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx - 0x10]
call fcn.1800694d
mov ecx, dword [ebp - 0x60]
lea ecx, [ecx - 0x10]
call fcn.1800694d
jmp 0x1803e0d9
mov edi, 0x181f4a50
cmp dword [ebp - 0x44], 0
mov dword [ebp - 0x48], edi
je 0x1803e0f6
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0x200
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181605f4
leave
ret 4