Function at 0x5157c1
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov edi, ecx
call fcn.0050fe8c
mov ecx, edi
call fcn.005166a1
mov ecx, edi
call fcn.00516e19
mov ecx, edi
call fcn.0051664b
mov ecx, edi
call fcn.00516dca
mov ecx, edi
call fcn.00516d09
mov ecx, edi
call fcn.0050df54
sub esp, 0x18
mov ecx, edi
mov eax, esp
push 0
push eax
call fcn.00510a4e
call fcn.005b1650
add esp, 0x18
call fcn.005b1810
test al, al
je 0x515869
push str.qbclipboard
lea ecx, [ebp - 0x34]
call fcn.0040921d
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x1c]
call fcn.0040921d
push 0x20006
push SysReAllocString
sub esp, 0x18
push esp
call fcn.005b1990
pop ecx
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.005ab340
add esp, 0x28
lea ecx, [ebp - 0x1c]
call fcn.00403f80
lea ecx, [ebp - 0x34]
call fcn.00403f80
lea esi, [edi + 0xd4]
mov ecx, esi
call fcn.005058c4
test al, al
je 0x515896
mov ecx, edi
call fcn.00510711
cmp eax, 1
jne 0x515896
mov ecx, esi
call fcn.0050574c
test al, al
jne 0x515896
xor ebx, ebx
inc ebx
jmp 0x515898
xor ebx, ebx
push str.DefaultBrowserFirstRun
lea ecx, [ebp - 0x34]
call fcn.0040921d
push ebx
lea eax, [ebp - 0x34]
push eax
push 1
call fcn.005aaa10
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.00403f80
push str.www.baidu.com__tn98010089_dgch14www.baidu.com__www.sogou.com__hdqsogou_brse_e64c9ec33f19c7dewww.sogou.com_
lea ecx, [ebp - 0x4c]
call fcn.0040921d
push str.CC_SRU0507
lea ecx, [ebp - 0x34]
call fcn.0040921d
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x34]
push eax
push 8
call fcn.005aa910
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.00403f80
mov ecx, esi
call fcn.0050575b
test al, al
jne 0x515923
push str.CheckIfDefaultBrowser
lea ecx, [ebp - 0x34]
call fcn.0040921d
xor ebx, ebx
lea eax, [ebp - 0x34]
push ebx
push eax
push 7
call fcn.005aaa10
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.00403f80
jmp 0x515925
xor ebx, ebx
push str.ExtendId
lea ecx, [ebp - 0x34]
call fcn.0040921d
mov ecx, esi
call fcn.0050344f
push eax
lea eax, [ebp - 0x34]
push eax
push 1
call fcn.005aaa10
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.00403f80
push str.FirstLaunch
lea ecx, [ebp - 0x34]
call fcn.0040921d
push 1
lea eax, [ebp - 0x34]
push eax
push 1
call fcn.005aaa10
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.00403f80
push 0x5f9b84
lea ecx, [ebp - 0x34]
call fcn.0040921d
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.005ad3a0
push eax
lea eax, [ebp - 0x34]
push eax
push 0xd
call fcn.005aa910
add esp, 0x18
lea ecx, [ebp - 0x1c]
call fcn.00403f80
lea ecx, [ebp - 0x34]
call fcn.00403f80
push ebx
call fcn.00579c00
lea ecx, [ebp - 0x34]
mov dword [ebp - 8], edx
mov esi, eax
mov dword [esp], str.InstallTimeForDlg
call fcn.0040921d
push esi
lea eax, [ebp - 0x34]
xor esi, esi
push eax
inc esi
push esi
call fcn.005aaa10
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.00403f80
push 0x5d342c
lea ecx, [ebp - 0x34]
call fcn.0040921d
lea eax, [ebp - 0x34]
push eax
push 8
call fcn.005aa750
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.00403f80
mov ecx, edi
call fcn.00510711
cmp eax, esi
jne 0x515a9f
mov ecx, edi
call fcn.00516bc6
push str.NewInstall
lea ecx, [ebp - 0x34]
call fcn.0040921d
push esi
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.005aaa10
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.00403f80
push str.DefaultBrowser
lea ecx, [ebp - 0x34]
call fcn.0040921d
lea eax, [ebp - 0x64]
push eax
call fcn.005b2f40
push eax
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.005aa910
add esp, 0x10
lea ecx, [ebp - 0x64]
call fcn.00403f80
lea ecx, [ebp - 0x34]
call fcn.00403f80
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push str.NewInstallDate
lea ecx, [ebp - 0x34]
call fcn.0040921d
push esi
lea eax, [ebp - 0x34]
push eax
push 2
call fcn.005aaa10
add esp, 0xc
jmp 0x515ab9
push str.CC_NRPN
lea ecx, [ebp - 0x34]
call fcn.0040921d
lea eax, [ebp - 0x34]
push eax
push 8
call fcn.005aa750
pop ecx
pop ecx
lea ecx, [ebp - 0x34]
call fcn.00403f80
mov edi, str.scrollSnapClick
mov dword [ebp - 4], ebx
push edi
lea ecx, [ebp - 0x34]
call fcn.0040921d
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x13
call fcn.005ab780
add esp, 0x10
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.00403f80
test esi, esi
jne 0x515b13
push edi
lea ecx, [ebp - 0x34]
call fcn.0040921d
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x13
call fcn.005aaa10
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.00403f80
lea ecx, [ebp - 0x4c]
call fcn.00403f80
pop edi
pop esi
pop ebx
leave
ret