Function at 0x10032f59
Capabilities:
Create http request
Query or enumerate registry value
Read data from internet
Receive data
Set registry value

Disassembly:
mov eax, 0x1006cb9c
call fcn.10055640
sub esp, 0x51c
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x128]
push eax
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov esi, ecx
mov dword [ebp - 0x1c], 0x3c
call fcn.100087dc
add esp, 0x18
test al, al
jne 0x10032fa6
mov word [ebp - 0x128], bx
lea ecx, [ebp - 0x14]
call fcn.1000b767
cmp dword [esi + 0x24], 0x10
mov dword [ebp - 4], ebx
jb 0x10032fbc
mov eax, dword [esi + 0x10]
jmp 0x10032fbf
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0xd0]
call fcn.10005c35
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.1000b574
push eax
lea ecx, [ebp - 0xb4]
call fcn.10005c35
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 2
call fcn.100058c1
mov esi, eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xec]
push eax
mov byte [ebp - 4], 3
call fcn.100058c1
add esp, 0x10
cmp dword [esi + 0x18], 8
push 4
pop ebx
mov byte [ebp - 4], bl
jb 0x10033026
mov esi, dword [esi + 4]
jmp 0x10033029
add esi, 4
cmp dword [eax + 0x18], 8
jb 0x10033034
mov eax, dword [eax + 4]
jmp 0x10033037
add eax, 4
lea ecx, [ebp - 0x128]
push ecx
push esi
push dword [ebp + 8]
push eax
push str.version2
push str.http:__toolbar.google.com
lea eax, [ebp - 0x14]
push str._s__s_dll_shl_sbranch_sbrowser_s
push eax
call fcn.10003caa
xor esi, esi
add esp, 0x20
inc esi
push esi
lea ecx, [ebp - 0xec]
call fcn.1000289a
push esi
lea ecx, [ebp - 0x8c]
call fcn.1000289a
push esi
lea ecx, [ebp - 0xb4]
call fcn.10002e29
and byte [ebp - 4], 0
push esi
lea ecx, [ebp - 0xd0]
call fcn.10002e29
and dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x44]
push eax
push str.SignatureVerified
push str.SoftwareGoogleNavClient1.1
push SysReAllocString
mov dword [ebp - 0x1c], ebx
call fcn.100087dc
add esp, 0x18
test al, al
je 0x100330ff
lea ecx, [ebp + 8]
mov dword [ebp - 0x20], esi
call fcn.1000b767
push dword [ebp - 0x44]
lea eax, [ebp + 8]
push str.sigchk_d
push eax
mov byte [ebp - 4], 5
call fcn.10003caa
mov esi, dword [ebp + 8]
add esp, 0xc
push dword [esi - 0xc]
lea ecx, [ebp - 0x14]
push esi
call fcn.1000332b
and byte [ebp - 4], 0
lea ecx, [esi - 0x10]
call fcn.10001337
push 0x2001f
mov esi, str.SoftwareGoogleNavClient
push esi
push edi
lea ecx, [ebp - 0x18]
call fcn.10038798
push 7
pop edi
push 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x28], edi
call fcn.1000205b
mov dword [ebp - 0x58], edi
xor edi, edi
push edi
lea ecx, [ebp - 0x70]
call fcn.1000205b
lea eax, [ebp - 0x40]
push eax
push str.brand
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.100388d3
cmp dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], edi
jne 0x1003315b
push str.GGLE
lea ecx, [ebp - 0x40]
call fcn.10004249
cmp dword [ebp - 0x2c], ebx
jb 0x1003322f
lea eax, [ebp - 0x70]
push eax
push str.installtime
lea ecx, [ebp - 0x18]
call fcn.100388d3
cmp dword [ebp - 0x58], 8
mov eax, dword [ebp - 0x6c]
jae 0x10033181
lea eax, [ebp - 0x6c]
push eax
call fcn.100565c8
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x98]
push eax
call fcn.10056fc1
mov eax, dword [ebp - 0x98]
pop ecx
pop ecx
push ebx
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x48]
push eax
push str.sent
push esi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp + 8], edi
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
cmp dword [ebp - 0x10], 1
jae 0x100331db
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x24]
cmp eax, 0xd2f00
jle 0x1003320d
push ebx
push edi
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x40]
call fcn.1000e3cb
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 9
call fcn.10004148
push 1
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 8
call fcn.1000289a
push str.tbbrand
lea ecx, [ebp - 0x14]
call fcn.1000cf85
cmp dword [ebp - 0x28], 8
mov eax, dword [ebp - 0x3c]
jae 0x10033226
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000cf85
push edi
push edi
push edi
push edi
push str.Google_Versionbot
call dword [sym.imp.WININET.dll_InternetOpenW]
cmp eax, edi
mov dword [ebp + 8], eax
je 0x1003335d
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], edi
je 0x10033261
cmp dword [eax + 0x18], 8
jb 0x1003325c
mov eax, dword [eax + 4]
jmp 0x10033263
add eax, 4
jmp 0x10033263
xor eax, eax
push edi
push 0x4000000
push 0xffffffffffffffff
push eax
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
cmp eax, edi
mov dword [ebp + 0xc], eax
jne 0x1003328d
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1003335d
push 0x400
lea eax, [ebp - 0x528]
push edi
push eax
mov dword [ebp - 0x4c], edi
call fcn.10055e00
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
push 0x3ff
lea eax, [ebp - 0x528]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [ebp - 0x2c], ebx
jb 0x10033322
cmp dword [ebp - 0x10], 1
jae 0x10033322
inc dword [ebp - 0x10]
push 0xa
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push str.sent
push esi
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
push ebx
push edi
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x40]
call fcn.1000e3cb
cmp dword [eax + 0x18], 8
mov byte [ebp - 4], 0xa
jb 0x10033300
mov eax, dword [eax + 4]
jmp 0x10033303
add eax, 4
push eax
push str.brand
lea ecx, [ebp - 0x18]
call fcn.100386d0
push 1
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 8
call fcn.1000289a
push dword [ebp + 0xc]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp + 8]
call esi
cmp dword [ebp - 0x20], edi
je 0x1003334e
push str.SignatureVerified
push str.SoftwareGoogleNavClient1.1
push SysReAllocString
call fcn.100098a7
add esp, 0xc
lea eax, [ebp - 0x528]
push eax
call fcn.10032de2
pop ecx
mov edi, eax
push 1
lea ecx, [ebp - 0x70]
call fcn.1000289a
push 1
lea ecx, [ebp - 0x40]
call fcn.1000289a
and byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.100385bd
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001337
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8