Function at 0x10031fba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013450a
mov eax, dword fs:[0]
push eax
sub esp, 0x7f4
mov eax, dword [0x10167b84]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x550], ecx
push 0x10139f4c
lea ecx, [ebp - 0x538]
call fcn.10015730
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x548], eax
mov ecx, dword [ebp - 0x548]
sub ecx, 1
mov dword [ebp - 0x548], ecx
cmp dword [ebp - 0x548], 6
ja case.default.0x10031fb3
mov edx, dword [ebp - 0x548]
jmp dword [edx*4 + 0x10032b90]
push 0x208
push 0
lea eax, [ebp - 0x4a4]
push eax
call fcn.1010db20
add esp, 0xc
mov dword [ebp - 0x578], 1
mov dword [ebp - 0x574], 0x104
mov ecx, 0x53
mov word [ebp - 0x94], cx
mov edx, 0x6f
mov word [ebp - 0x92], dx
mov eax, 0x66
mov word [ebp - 0x90], ax
mov ecx, 0x74
mov word [ebp - 0x8e], cx
mov edx, 0x77
mov word [ebp - 0x8c], dx
mov eax, 0x61
mov word [ebp - 0x8a], ax
mov ecx, 0x72
mov word [ebp - 0x88], cx
mov edx, 0x65
mov word [ebp - 0x86], dx
mov eax, 0x5c
mov word [ebp - 0x84], ax
mov ecx, 0x4d
mov word [ebp - 0x82], cx
mov edx, 0x69
mov word [ebp - 0x80], dx
mov eax, 0x63
mov word [ebp - 0x7e], ax
mov ecx, 0x72
mov word [ebp - 0x7c], cx
mov edx, 0x6f
mov word [ebp - 0x7a], dx
mov eax, 0x73
mov word [ebp - 0x78], ax
mov ecx, 0x6f
mov word [ebp - 0x76], cx
mov edx, 0x66
mov word [ebp - 0x74], dx
mov eax, 0x74
mov word [ebp - 0x72], ax
mov ecx, 0x5c
mov word [ebp - 0x70], cx
mov edx, 0x57
mov word [ebp - 0x6e], dx
mov eax, 0x69
mov word [ebp - 0x6c], ax
mov ecx, 0x6e
mov word [ebp - 0x6a], cx
mov edx, 0x64
mov word [ebp - 0x68], dx
mov eax, 0x6f
mov word [ebp - 0x66], ax
mov ecx, 0x77
mov word [ebp - 0x64], cx
mov edx, 0x73
mov word [ebp - 0x62], dx
mov eax, 0x5c
mov word [ebp - 0x60], ax
mov ecx, 0x43
mov word [ebp - 0x5e], cx
mov edx, 0x75
mov word [ebp - 0x5c], dx
mov eax, 0x72
mov word [ebp - 0x5a], ax
mov ecx, 0x72
mov word [ebp - 0x58], cx
mov edx, 0x65
mov word [ebp - 0x56], dx
mov eax, 0x6e
mov word [ebp - 0x54], ax
mov ecx, 0x74
mov word [ebp - 0x52], cx
mov edx, 0x56
mov word [ebp - 0x50], dx
mov eax, 0x65
mov word [ebp - 0x4e], ax
mov ecx, 0x72
mov word [ebp - 0x4c], cx
mov edx, 0x73
mov word [ebp - 0x4a], dx
mov eax, 0x69
mov word [ebp - 0x48], ax
mov ecx, 0x6f
mov word [ebp - 0x46], cx
mov edx, 0x6e
mov word [ebp - 0x44], dx
mov eax, 0x5c
mov word [ebp - 0x42], ax
mov ecx, 0x55
mov word [ebp - 0x40], cx
mov edx, 0x6e
mov word [ebp - 0x3e], dx
mov eax, 0x69
mov word [ebp - 0x3c], ax
mov ecx, 0x6e
mov word [ebp - 0x3a], cx
mov edx, 0x73
mov word [ebp - 0x38], dx
mov eax, 0x74
mov word [ebp - 0x36], ax
mov ecx, 0x61
mov word [ebp - 0x34], cx
mov edx, 0x6c
mov word [ebp - 0x32], dx
mov eax, 0x6c
mov word [ebp - 0x30], ax
mov ecx, 0x5c
mov word [ebp - 0x2e], cx
mov edx, 0x33
mov word [ebp - 0x2c], dx
mov eax, 0x36
mov word [ebp - 0x2a], ax
mov ecx, 0x30
mov word [ebp - 0x28], cx
mov edx, 0x73
mov word [ebp - 0x26], dx
mov eax, 0x65
mov word [ebp - 0x24], ax
mov ecx, 0x36
mov word [ebp - 0x22], cx
xor edx, edx
mov word [ebp - 0x20], dx
lea eax, [ebp - 0x574]
push eax
lea ecx, [ebp - 0x4a4]
push ecx
lea edx, [ebp - 0x578]
push edx
push 0x1013aa38
lea eax, [ebp - 0x94]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x10032266
mov byte [ebp - 0x53d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x538]
call fcn.100159b0
mov al, byte [ebp - 0x53d]
jmp 0x10032b72
mov ecx, 0x33
mov word [ebp - 0x1c], cx
mov edx, 0x36
mov word [ebp - 0x1a], dx
mov eax, 0x30
mov word [ebp - 0x18], ax
mov ecx, 0x73
mov word [ebp - 0x16], cx
mov edx, 0x65
mov word [ebp - 0x14], dx
xor eax, eax
mov word [ebp - 0x12], ax
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x538]
call fcn.10015ac0
mov dword [ebp - 0x54c], 0
lea edx, [ebp - 0x54c]
push edx
push 0x1013aa48
lea eax, [ebp - 0x4a4]
push eax
call fcn.1001d230
add esp, 0xc
mov dword [ebp - 0x618], eax
cmp dword [ebp - 0x54c], 7
je 0x100322e5
cmp dword [ebp - 0x54c], 8
jne 0x10032321
lea ecx, [ebp - 0x538]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x60c]
push eax
call fcn.1001e130
add esp, 0xc
mov dword [ebp - 0x57c], eax
mov ecx, dword [ebp - 0x57c]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.10025d30
lea ecx, [ebp - 0x60c]
call fcn.1000be40
jmp 0x1003238a
cmp dword [ebp - 0x54c], 8
jle 0x10032366
lea edx, [ebp - 0x538]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x614]
push ecx
call fcn.1001f900
add esp, 0xc
mov dword [ebp - 0x580], eax
mov edx, dword [ebp - 0x580]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.10025d30
lea ecx, [ebp - 0x614]
call fcn.1000be40
jmp 0x1003238a
mov byte [ebp - 0x53e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x538]
call fcn.100159b0
mov al, byte [ebp - 0x53e]
jmp 0x10032b72
jmp case.default.0x10031fb3
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x53c]
push ecx
mov ecx, dword [ebp - 0x550]
call fcn.100319b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x53c]
call fcn.10017180
movzx edx, al
test edx, edx
jne 0x10032547
call fcn.100e2550
mov dword [ebp - 0x554], eax
push 1
mov eax, dword [ebp - 0x554]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x554]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x584], al
cmp byte [ebp - 0x584], 1
je 0x100323f3
jmp 0x100324b9
push 0x10138874
lea ecx, [ebp - 0x51c]
call fcn.1000a760
mov byte [ebp - 4], 2
push 0x1013887c
lea ecx, [ebp - 0x534]
call fcn.1000a760
mov byte [ebp - 4], 3
call fcn.100e2550
mov dword [ebp - 0x558], eax
lea ecx, [ebp - 0x53c]
push ecx
push str.browser_filename:
push 0x126
lea edx, [ebp - 0x51c]
push edx
lea eax, [ebp - 0x534]
push eax
lea ecx, [ebp - 0x6d0]
call fcn.1000afc0
mov dword [ebp - 0x588], eax
mov ecx, dword [ebp - 0x588]
mov dword [ebp - 0x58c], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x58c]
call fcn.10007450
mov ecx, eax
call fcn.10015360
push eax
mov edx, dword [ebp - 0x558]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x558]
mov edx, dword [eax + 0x1c]
call edx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6d0]
call fcn.1000c0c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x534]
call fcn.1000bc00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x51c]
call fcn.1000bc00
push 0
push 0x1013aa64
lea ecx, [ebp - 0x53c]
call fcn.1001a970
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0
jle 0x1003252a
mov eax, dword [ebp - 0x55c]
push eax
lea ecx, [ebp - 0x5e8]
push ecx
lea ecx, [ebp - 0x53c]
call fcn.10017210
mov dword [ebp - 0x590], eax
mov edx, dword [ebp - 0x590]
mov dword [ebp - 0x594], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x594]
push eax
lea ecx, [ebp - 0x53c]
call fcn.10018670
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5e8]
call fcn.100159b0
lea ecx, [ebp - 0x53c]
call fcn.1002d4e0
lea ecx, [ebp - 0x53c]
push ecx
lea ecx, [ebp - 0x538]
call fcn.10018670
lea ecx, [ebp - 0x538]
call fcn.10017180
movzx edx, al
test edx, edx
jne 0x1003259d
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x5fc]
push ecx
mov ecx, dword [ebp - 0x550]
add ecx, 0x6c
call fcn.10031830
push eax
lea edx, [ebp - 0x600]
push edx
mov ecx, dword [ebp - 0x550]
add ecx, 0x6c
call fcn.100310d0
mov ecx, eax
call fcn.1002baa0
movzx eax, al
test eax, eax
je 0x100326ca
call fcn.100e2550
mov dword [ebp - 0x560], eax
push 1
mov ecx, dword [ebp - 0x560]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x560]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x5e4], al
cmp byte [ebp - 0x5e4], 1
je 0x100325d1
jmp 0x10032697
push 0x10138874
lea ecx, [ebp - 0x504]
call fcn.1000a760
mov byte [ebp - 4], 6
push 0x1013887c
lea ecx, [ebp - 0x4bc]
call fcn.1000a760
mov byte [ebp - 4], 7
call fcn.100e2550
mov dword [ebp - 0x564], eax
lea ecx, [ebp - 0x538]
push ecx
push str.Chrome_WidgetWin_1_skip._browserName:
push 0x132
lea edx, [ebp - 0x504]
push edx
lea eax, [ebp - 0x4bc]
push eax
lea ecx, [ebp - 0x768]
call fcn.1000afc0
mov dword [ebp - 0x5e0], eax
mov ecx, dword [ebp - 0x5e0]
mov dword [ebp - 0x5dc], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x5dc]
call fcn.10007450
mov ecx, eax
call fcn.10015360
push eax
mov edx, dword [ebp - 0x564]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x564]
mov edx, dword [eax + 0x1c]
call edx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x768]
call fcn.1000c0c0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4bc]
call fcn.1000bc00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x504]
call fcn.1000bc00
mov byte [ebp - 0x53f], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x53c]
call fcn.100159b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x538]
call fcn.100159b0
mov al, byte [ebp - 0x53f]
jmp 0x10032b72
push str.liebao
lea ecx, [ebp - 0x538]
call fcn.10010af0
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100328aa
push 0x208
push 0
lea eax, [ebp - 0x29c]
push eax
call fcn.1010db20
add esp, 0xc
mov dword [ebp - 0x5d0], 1
mov dword [ebp - 0x5d8], 0x104
lea ecx, [ebp - 0x5d8]
push ecx
lea edx, [ebp - 0x29c]
push edx
lea eax, [ebp - 0x5d0]
push eax
push str.DisplayVersion
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100328aa
mov dword [ebp - 0x568], 0
lea ecx, [ebp - 0x568]
push ecx
push 0x1013aa48
lea edx, [ebp - 0x29c]
push edx
call fcn.1001d230
add esp, 0xc
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x568], 7
jl 0x100328aa
call fcn.100e2550
mov dword [ebp - 0x56c], eax
push 1
mov eax, dword [ebp - 0x56c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x56c]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x5cc], al
cmp byte [ebp - 0x5cc], 1
je 0x100327b1
jmp 0x10032877
push 0x10138874
lea ecx, [ebp - 0x4d4]
call fcn.1000a760
mov byte [ebp - 4], 9
push 0x1013887c
lea ecx, [ebp - 0x4ec]
call fcn.1000a760
mov byte [ebp - 4], 0xa
call fcn.100e2550
mov dword [ebp - 0x570], eax
lea ecx, [ebp - 0x538]
push ecx
push str.Chrome_WidgetWin_1_skip._browserName:
push 0x142
lea edx, [ebp - 0x4d4]
push edx
lea eax, [ebp - 0x4ec]
push eax
lea ecx, [ebp - 0x800]
call fcn.1000afc0
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp - 0x5c4], ecx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x5c4]
call fcn.10007450
mov ecx, eax
call fcn.10015360
push eax
mov edx, dword [ebp - 0x570]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x570]
mov edx, dword [eax + 0x1c]
call edx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x800]
call fcn.1000c0c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4ec]
call fcn.1000bc00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4d4]
call fcn.1000bc00
mov byte [ebp - 0x540], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x53c]
call fcn.100159b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x538]
call fcn.100159b0
mov al, byte [ebp - 0x540]
jmp 0x10032b72
lea eax, [ebp - 0x538]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x638]
push edx
call fcn.1001f900
add esp, 0xc
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x5d4]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.10025d30
lea ecx, [ebp - 0x638]
call fcn.1000be40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x53c]
call fcn.100159b0
jmp case.default.0x10031fb3
push str.firefox
lea ecx, [ebp - 0x538]
call fcn.10015ac0
lea ecx, [ebp - 0x538]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x620]
push eax
call fcn.10022ce0
add esp, 0xc
mov dword [ebp - 0x598], eax
mov ecx, dword [ebp - 0x598]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.10025d30
lea ecx, [ebp - 0x620]
call fcn.1000be40
jmp case.default.0x10031fb3
push str.iexplore
lea ecx, [ebp - 0x538]
call fcn.10015ac0
lea edx, [ebp - 0x538]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x628]
push ecx
call fcn.10024aa0
add esp, 0xc
mov dword [ebp - 0x59c], eax
mov edx, dword [ebp - 0x59c]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.10025d30
lea ecx, [ebp - 0x628]
call fcn.1000be40
jmp case.default.0x10031fb3
push str.liebao7
lea ecx, [ebp - 0x538]
call fcn.10015ac0
lea eax, [ebp - 0x538]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x630]
push edx
call fcn.1001f900
add esp, 0xc
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x5a0]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.10025d30
lea ecx, [ebp - 0x630]
call fcn.1000be40
jmp case.default.0x10031fb3
push str.qqbrowser
lea ecx, [ebp - 0x538]
call fcn.10015ac0
lea ecx, [ebp - 0x538]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x5f0]
push eax
call fcn.1001f900
add esp, 0xc
mov dword [ebp - 0x5a4], eax
mov ecx, dword [ebp - 0x5a4]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.10025d30
lea ecx, [ebp - 0x5f0]
call fcn.1000be40
jmp case.default.0x10031fb3
push str.sogouexplorer
lea ecx, [ebp - 0x538]
call fcn.10015ac0
lea edx, [ebp - 0x538]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x5f8]
push ecx
call fcn.10034910
add esp, 0xc
mov dword [ebp - 0x5a8], eax
mov edx, dword [ebp - 0x5a8]
push edx
mov ecx, dword [ebp + 0x10]
call fcn.10025d30
lea ecx, [ebp - 0x5f8]
call fcn.1000be40
lea ecx, [ebp - 0x538]
call fcn.10017180
movzx eax, al
test eax, eax
je 0x10032ab1
mov byte [ebp - 0x541], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x538]
call fcn.100159b0
mov al, byte [ebp - 0x541]
jmp 0x10032b72
push 0
push 0
push 1
lea ecx, [ebp - 0x538]
push ecx
lea edx, [ebp - 0x5c0]
push edx
call fcn.100d32c0
add esp, 8
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x5b0], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x5b0]
mov edx, dword [ecx]
push edx
push str.ex1_s
lea eax, [ebp - 0x5bc]
push eax
call fcn.100d31c0
add esp, 0xc
mov dword [ebp - 0x5b4], eax
mov ecx, dword [ebp - 0x5b4]
mov dword [ebp - 0x5b8], ecx
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x5b8]
call fcn.10010af0
push eax
push str.addwnd_succ
push 1
call fcn.10020c00
mov ecx, eax
call fcn.100e3390
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x5bc]
call fcn.100159b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c0]
call fcn.100159b0
mov byte [ebp - 0x542], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x538]
call fcn.100159b0
mov al, byte [ebp - 0x542]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100faee9
mov esp, ebp
pop ebp
ret 0xc