Function at 0x18052602
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x181c700c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
lea eax, [edi + 4]
push eax
call fcn.180157dd
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x1819541c
push eax
push ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x10], esi
push eax
mov ecx, ebx
mov dword [ebp - 0xc], 0x200
call fcn.1805b93e
pop ecx
push eax
mov ecx, edi
call fcn.1805187c
mov esi, eax
test esi, esi
js 0x1805291d
xor eax, eax
push eax
push eax
push eax
push eax
push str.ping_freshness
lfence
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x180526c0
mov esi, 0x1816bc5c
lea edi, [ebp - 0x38]
lea eax, [ebp - 0x38]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.ole32.dll_CoCreateGuid]
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x18]
call fcn.1800d3e0
push 1
lea ecx, [ebp - 0x14]
push dword [eax]
push str.ping_freshness
call fcn.1801aa62
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18007012
mov edi, dword [ebp - 0x44]
mov ecx, ebx
call fcn.1805b9f1
mov ecx, ebx
lfence
test al, al
je 0x180526e4
lea eax, [ebp - 0x18]
push eax
call fcn.1805b91e
mov cl, byte [edi]
mov edx, eax
call fcn.1802a931
jmp 0x18052710
lea eax, [ebp - 0x38]
push eax
call fcn.1805b93e
push eax
mov ecx, edi
call fcn.180512e0
test al, al
jne 0x18052725
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
lfence
call fcn.1805b91e
mov cl, byte [edi]
mov edx, eax
call fcn.1802a8dd
mov ecx, dword [ebp - 0x18]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.18007012
test esi, esi
js 0x1805291d
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
lfence
call fcn.1805b995
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.18007012
test esi, esi
je 0x1805276e
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1805b995
push 1
lea ecx, [ebp - 0x14]
push dword [eax]
push str.lang
call fcn.1801aa62
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18007012
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1805c522
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax]
lea ecx, [ecx - 0x10]
mov esi, dword [eax - 0xc]
call fcn.18007012
test esi, esi
jne 0x1805279c
push 0x1819ef60
lea ecx, [ebp - 0x14]
call fcn.1801a036
jmp 0x180527c3
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1805c522
push 1
lea ecx, [ebp - 0x14]
push dword [eax]
push 0x1819ef60
call fcn.1801aa62
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18007012
lea eax, [ebp - 0x24]
xor esi, esi
push eax
mov ecx, ebx
mov dword [ebp - 0x28], esi
call fcn.1805b93e
push eax
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.1805167b
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
lea esi, [ebx + 8]
mov eax, dword [esi]
xchg dword [esi], eax
add eax, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.180157dd
mov edi, dword [ebx + 0xfc]
lea ecx, [ebp - 0x1c]
call fcn.18015808
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
mov eax, dword [esi]
xchg dword [esi], eax
add eax, 4
lea ecx, [ebp - 0x30]
push eax
call fcn.180157dd
mov ecx, dword [ebx + 0x88]
sub ecx, 0x10
call fcn.1800a175
add eax, 0x10
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], eax
call fcn.18015808
lea eax, [ebp - 0x4c]
mov ecx, ebx
push eax
call fcn.1805bb8a
mov esi, eax
mov ecx, ebx
lea eax, [ebp - 0x48]
push eax
call fcn.1805bfb6
push edi
lea ecx, [ebp - 0x18]
mov edx, eax
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.1802c14c
mov ecx, dword [ebp - 0x48]
add esp, 0xc
lea ecx, [ecx - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.18007012
mov edi, dword [ebp - 0x44]
mov cl, byte [edi]
call fcn.18026520
test al, al
je 0x180528a8
push 1
push 0x181a3cec
push 0x181a4878
lea ecx, [ebp - 0x14]
call fcn.1801aa62
mov ecx, ebx
call fcn.1805bf20
test eax, eax
jne 0x180528c2
push str.browser
lea ecx, [ebp - 0x14]
call fcn.1801a036
jmp 0x180528d7
mov ecx, ebx
call fcn.1805bf20
push eax
push str.browser
lea ecx, [ebp - 0x14]
call fcn.1801aa0e
mov ecx, ebx
call fcn.1805bf6b
cmp eax, 2
je 0x18052910
mov ecx, ebx
lfence
call fcn.1805bf6b
mov esi, eax
mov ecx, ebx
lea eax, [ebp - 0x44]
push eax
call fcn.1805b91e
mov cl, byte [edi]
mov edx, eax
push esi
call fcn.1802bd86
pop ecx
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.18007012
mov ecx, dword [ebp - 0x28]
xor esi, esi
lea ecx, [ecx - 0x10]
call fcn.18007012
cmp dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x1819541c
je 0x1805293e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x200
lea ecx, [ebp - 0x40]
call fcn.18015808
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.181188e8
leave
ret 4