Function at 0x180547cf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x181d700c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
lea eax, [edi + 4]
push eax
call fcn.1801582d
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x181a193c
push eax
push ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], esi
push eax
mov ecx, ebx
mov dword [ebp - 0xc], 0x200
call fcn.1805dd6e
pop ecx
push eax
mov ecx, edi
call fcn.18053a4c
mov esi, eax
test esi, esi
js 0x18054b11
xor eax, eax
push eax
push eax
push eax
push eax
push 0x181b2cd8
lfence
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1805488d
mov esi, 0x18175cac
lea edi, [ebp - 0x38]
lea eax, [ebp - 0x38]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ole32.dll_CoCreateGuid]
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x18]
call fcn.1800d35c
push 1
lea ecx, [ebp - 0x14]
push dword [eax]
push 0x181b2cd8
call fcn.1801aa32
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18006f72
mov edi, dword [ebp - 0x44]
mov ecx, ebx
call fcn.1805de21
mov ecx, ebx
lfence
test al, al
je 0x180548b1
lea eax, [ebp - 0x18]
push eax
call fcn.1805dd4e
mov cl, byte [edi]
mov edx, eax
call fcn.180329f7
jmp 0x180548dd
lea eax, [ebp - 0x38]
push eax
call fcn.1805dd6e
push eax
mov ecx, edi
call fcn.180534b0
test al, al
jne 0x180548f2
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
lfence
call fcn.1805dd4e
mov cl, byte [edi]
mov edx, eax
call fcn.180329a3
mov ecx, dword [ebp - 0x18]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.18006f72
test esi, esi
js 0x18054b11
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
lfence
call fcn.1805ddc5
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.18006f72
test esi, esi
je 0x1805493b
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1805ddc5
push 1
lea ecx, [ebp - 0x14]
push dword [eax]
push str.lang
call fcn.1801aa32
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18006f72
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1805e952
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.18006f72
test esi, esi
jne 0x18054969
push 0x181ade6c
lea ecx, [ebp - 0x14]
call fcn.1801a005
jmp 0x18054990
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1805e952
push 1
lea ecx, [ebp - 0x14]
push dword [eax]
push 0x181ade6c
call fcn.1801aa32
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18006f72
lea eax, [ebp - 0x24]
xor esi, esi
push eax
mov ecx, ebx
mov dword [ebp - 0x28], esi
call fcn.1805dd6e
push eax
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.1805384b
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
lea esi, [ebx + 8]
mov eax, dword [esi]
xchg dword [esi], eax
add eax, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.1801582d
mov edi, dword [ebx + 0xfc]
lea ecx, [ebp - 0x1c]
call fcn.18015858
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
mov eax, dword [esi]
xchg dword [esi], eax
add eax, 4
lea ecx, [ebp - 0x30]
push eax
call fcn.1801582d
mov ecx, dword [ebx + 0x88]
sub ecx, 0x10
call fcn.1800a0da
add eax, 0x10
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], eax
call fcn.18015858
lea eax, [ebp - 0x4c]
mov ecx, ebx
push eax
call fcn.1805dfba
mov esi, eax
mov ecx, ebx
lea eax, [ebp - 0x48]
push eax
call fcn.1805e3e6
push edi
lea ecx, [ebp - 0x18]
mov edx, eax
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.18034363
mov ecx, dword [ebp - 0x48]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.18006f72
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18006f72
mov edi, dword [ebp - 0x44]
mov cl, byte [edi]
call fcn.18026c60
test al, al
je 0x18054a75
push 1
push 0x181b2020
push str.oeminstall
lea ecx, [ebp - 0x14]
call fcn.1801aa32
mov ecx, ebx
call fcn.1805e350
test eax, eax
jne 0x18054a8f
push str.browser
lea ecx, [ebp - 0x14]
call fcn.1801a005
jmp 0x18054aa4
mov ecx, ebx
call fcn.1805e350
push eax
push str.browser
lea ecx, [ebp - 0x14]
call fcn.1801a9de
mov ecx, ebx
call fcn.1805e39b
cmp eax, 2
je 0x18054ada
mov ecx, ebx
call fcn.1805e39b
mov esi, eax
mov ecx, ebx
lea eax, [ebp - 0x44]
push eax
call fcn.1805dd4e
mov cl, byte [edi]
mov edx, eax
push esi
call fcn.18033f9d
pop ecx
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.18006f72
lea eax, [ebp - 0x50]
mov ecx, ebx
push eax
call fcn.1805e9ae
mov ecx, dword [ebp - 0x50]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.18006f72
test esi, esi
je 0x18054b04
push ebx
mov ecx, edi
lfence
call fcn.1805562b
mov ecx, dword [ebp - 0x28]
xor esi, esi
lea ecx, [ecx - 0x10]
call fcn.18006f72
cmp dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x181a193c
je 0x18054b32
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x200
lea ecx, [ebp - 0x40]
call fcn.18015858
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.18122478
leave
ret 4